Skip to content

fix(openapi): align environment access permissions - #4982

Merged
leozhang2018 merged 7 commits into
koderover:mainfrom
huanghongbo-hhb:fix/cli-env-list-project-validation
Sep 16, 2026
Merged

fix(openapi): align environment access permissions#4982
leozhang2018 merged 7 commits into
koderover:mainfrom
huanghongbo-hhb:fix/cli-env-list-project-validation

Conversation

@huanghongbo-hhb

@huanghongbo-hhb huanghongbo-hhb commented Sep 15, 2026 •
edited by landylee007
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Align environment detail and list OpenAPI authorization with Aslan APIs.

Why

  • Prevent unauthorized environment detail reads and distinguish missing projects from unauthorized projects.

Main Changes

  • Enforce project, environment View, and collaboration-mode View permissions for test and production details.
  • Return 404 for missing projects and 403 for unauthorized projects in environment list and detail APIs.
  • Preserve production license checks and full-list access for users with project-level environment View permission.

Risk / Compatibility

  • Unauthorized detail requests now return 403; authorized payloads are unchanged.

Test

  • go test ./pkg/microservice/aslan/core/environment/handler -count=1
  • git diff --check

Contact

This change is Reviewable

@huanghongbo-hhb
fix(openapi): align environment access permissions
6d849a4 
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
@huanghongbo-hhb
chore: remove openapi permission test
5ab047d 
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
@huanghongbo-hhb
fix(openapi): preserve environment access behavior
e080ae8 
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
@huanghongbo-hhb
fix(openapi): return not found for missing environment
776812f 
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
@huanghongbo-hhb
fix(openapi): align registry access permissions
a19d278 
Add a project scoped registry OpenAPI endpoint mirroring the aslan API so
project members and collaboration mode users can resolve the registries
their workflows use, and require registry view permission on the
system wide registry list.

Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
PetrusZ
PetrusZ reviewed Sep 16, 2026
View reviewed changes
Comment thread pkg/microservice/aslan/core/environment/handler/openapi.go Outdated
@huanghongbo-hhb
fix(openapi): reuse environment project handling
2ba386c 
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
PetrusZ
PetrusZ reviewed Sep 16, 2026
View reviewed changes
Comment thread pkg/microservice/aslan/core/system/handler/openapi.go Outdated
@huanghongbo-hhb
fix(openapi): drop redundant project lookup in registry list
4cedf22 
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
@leozhang2018
leozhang2018 merged commit fd2e6cf into koderover:main Sep 16, 2026
3 checks passed
@huanghongbo-hhb huanghongbo-hhb mentioned this pull request Sep 16, 2026
Open
huanghongbo-hhb added a commit to huanghongbo-hhb/zadig that referenced this pull request Sep 16, 2026
@huanghongbo-hhb
fix(openapi): align environment access permissions
a63d35a 
Cherry pick koderover#4982 to release 5.0.0 for the Zadig CLI.

(cherry picked from commit fd2e6cf)
Signed-off-by: huanghongbo-hhb <huanghongbo@koderover.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PetrusZ PetrusZ PetrusZ approved these changes

Assignees

No one assigned

Labels

service/aslan

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@huanghongbo-hhb @PetrusZ @leozhang2018