#583: Added granular multi-org control and read-only user

backend/go-app/main.go

@@ -2853,7 +2853,7 @@ func echoOpenapiData(resp http.ResponseWriter, request *http.Request) {
 	}
 
 	// Just here to verify that the user is logged in
-	_, err := shuffle.HandleApiAuthentication(resp, request)
+	user, err := shuffle.HandleApiAuthentication(resp, request)
 	if err != nil {
 		log.Printf("Api authentication failed in validate swagger: %s", err)
 		resp.WriteHeader(401)
@@ -2861,6 +2861,13 @@ func echoOpenapiData(resp http.ResponseWriter, request *http.Request) {
 		return
 	}
 
+	if user.Role == "org-reader" {
+		log.Printf("[WARNING] Org-reader doesn't have access to echo OpenAPI data: %s (%s)", user.Username, user.Id)
+		resp.WriteHeader(401)
+		resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
+		return
+	}
+
 	body, err := ioutil.ReadAll(request.Body)
 	if err != nil {
 		log.Printf("Bodyreader err: %s", err)
@@ -3335,6 +3342,13 @@ func verifySwagger(resp http.ResponseWriter, request *http.Request) {
 		return
 	}
 
+	if user.Role == "org-reader" {
+		log.Printf("[WARNING] Org-reader doesn't have access to check swagger doc: %s (%s)", user.Username, user.Id)
+		resp.WriteHeader(401)
+		resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
+		return
+	}
+
 	body, err := ioutil.ReadAll(request.Body)
 	if err != nil {
 		resp.WriteHeader(401)
@@ -5571,6 +5585,13 @@ func makeWorkflowPublic(resp http.ResponseWriter, request *http.Request) {
 		return
 	}
 
+	if user.Role == "org-reader" {
+		log.Printf("[WARNING] Org-reader doesn't have access publish workflow: %s (%s)", user.Username, user.Id)
+		resp.WriteHeader(401)
+		resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
+		return
+	}
+
 	location := strings.Split(request.URL.String(), "/")
 	var fileId string
 	if location[1] == "api" {

backend/go-app/walkoff.go

@@ -676,6 +676,13 @@ func deleteWorkflow(resp http.ResponseWriter, request *http.Request) {
 		return
 	}
 
+	if user.Role == "org-reader" {
+		log.Printf("[WARNING] Org-reader doesn't have access to stop schedule: %s (%s)", user.Username, user.Id)
+		resp.WriteHeader(401)
+		resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
+		return
+	}
+
 	location := strings.Split(request.URL.String(), "/")
 
 	var fileId string
@@ -1036,6 +1043,13 @@ func executeWorkflow(resp http.ResponseWriter, request *http.Request) {
 		return
 	}
 
+	if user.Role == "org-reader" {
+		log.Printf("[WARNING] Org-reader doesn't have access to run workflow: %s (%s)", user.Username, user.Id)
+		resp.WriteHeader(401)
+		resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
+		return
+	}
+
 	location := strings.Split(request.URL.String(), "/")
 
 	var fileId string
@@ -1106,6 +1120,13 @@ func stopSchedule(resp http.ResponseWriter, request *http.Request) {
 		return
 	}
 
+	if user.Role == "org-reader" {
+		log.Printf("[WARNING] Org-reader doesn't have access to stop schedule: %s (%s)", user.Username, user.Id)
+		resp.WriteHeader(401)
+		resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
+		return
+	}
+
 	location := strings.Split(request.URL.String(), "/")
 
 	var fileId string
@@ -1358,6 +1379,13 @@ func scheduleWorkflow(resp http.ResponseWriter, request *http.Request) {
 		return
 	}
 
+	if user.Role == "org-reader" {
+		log.Printf("[WARNING] Org-reader doesn't have access to schedule workflow: %s (%s)", user.Username, user.Id)
+		resp.WriteHeader(401)
+		resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
+		return
+	}
+
 	location := strings.Split(request.URL.String(), "/")
 
 	var fileId string
@@ -1744,7 +1772,7 @@ func validateAppInput(resp http.ResponseWriter, request *http.Request) {
 
 	// Just need to be logged in
 	// FIXME - should have some permissions?
-	_, err := shuffle.HandleApiAuthentication(resp, request)
+	user, err := shuffle.HandleApiAuthentication(resp, request)
 	if err != nil {
 		log.Printf("Api authentication failed in set new app: %s", err)
 		resp.WriteHeader(401)
@@ -1752,6 +1780,13 @@ func validateAppInput(resp http.ResponseWriter, request *http.Request) {
 		return
 	}
 
+	if user.Role == "org-reader" {
+		log.Printf("[WARNING] Org-reader doesn't have access to delete apps: %s (%s)", user.Username, user.Id)
+		resp.WriteHeader(401)
+		resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
+		return
+	}
+
 	filebytes, err := handleGetfile(resp, request)
 	if err != nil {
 		resp.WriteHeader(401)
@@ -2237,8 +2272,7 @@ func setNewWorkflowApp(resp http.ResponseWriter, request *http.Request) {
 	}
 
 	// Just need to be logged in
-	// FIXME - should have some permissions?
+	user, err := shuffle.HandleApiAuthentication(resp, request)
-	_, err := shuffle.HandleApiAuthentication(resp, request)
 	if err != nil {
 		log.Printf("Api authentication failed in set new app: %s", err)
 		resp.WriteHeader(401)
@@ -2246,6 +2280,13 @@ func setNewWorkflowApp(resp http.ResponseWriter, request *http.Request) {
 		return
 	}
 
+	if user.Role == "org-reader" {
+		log.Printf("[WARNING] Org-reader doesn't have access to set new workflowapp: %s (%s)", user.Username, user.Id)
+		resp.WriteHeader(401)
+		resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
+		return
+	}
+
 	body, err := ioutil.ReadAll(request.Body)
 	if err != nil {
 		log.Printf("Error with body read: %s", err)
@@ -2470,6 +2511,13 @@ func executeSingleAction(resp http.ResponseWriter, request *http.Request) {
 		return
 	}
 
+	if user.Role == "org-reader" {
+		log.Printf("[WARNING] Org-reader doesn't have access to execute single action: %s (%s)", user.Username, user.Id)
+		resp.WriteHeader(401)
+		resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
+		return
+	}
+
 	location := strings.Split(request.URL.String(), "/")
 	var fileId string
 	if location[1] == "api" {
@@ -2925,6 +2973,13 @@ func LoadSpecificApps(resp http.ResponseWriter, request *http.Request) {
 		return
 	}
 
+	if user.Role != "admin" {
+		log.Printf("[WARNING] Not admin during app loading: %s (%s).", user.Username, user.Id)
+		resp.WriteHeader(401)
+		resp.Write([]byte(`{"success": false, "reason": "Not admin"}`))
+		return
+	}
+
 	body, err := ioutil.ReadAll(request.Body)
 	if err != nil {
 		log.Printf("Error with body read: %s", err)

frontend/package.json

@@ -17,7 +17,7 @@
     "babel-eslint": "^10.1.0",
     "class-transformer": "^0.4.0",
     "create-react-app": "^4.0.3",
-    "cytoscape": "^3.20.0",
+    "cytoscape": "^3.15.1",
     "cytoscape-clipboard": "^2.2.1",
     "cytoscape-cxtmenu": "^3.1.1",
     "cytoscape-edgehandles": "^3.6.0",

frontend/src/views/Admin.jsx

@@ -2834,7 +2834,7 @@ const Admin = (props) => {
                             }}
                             value={"admin"}
                           >
-                            Admin
+                            Org Admin
                           </MenuItem>
                           <MenuItem
                             style={{
@@ -2843,7 +2843,16 @@ const Admin = (props) => {
                             }}
                             value={"user"}
                           >
-                            User
+                            Org User
+                          </MenuItem>
+													<MenuItem
+                            style={{
+                              backgroundColor: theme.palette.inputColor,
+                              color: "white",
+                            }}
+                            value={"org-reader"}
+                          >
+                           	Org Reader
                           </MenuItem>
                         </Select>
                       }

frontend/src/views/Workflows.jsx

@@ -1194,7 +1194,7 @@ const Workflows = (props) => {
       .then((response) => {
         if (response.status !== 200) {
           console.log("Status not 200 for setting workflows :O!");
-          alert.error("Failed deleting workflow");
+          alert.error("Failed deleting workflow. Do you have access?");
         } else {
           alert.success("Deleted workflow " + id);
         }
@@ -1302,7 +1302,7 @@ const Workflows = (props) => {
           style={{ backgroundColor: inputColor, color: "white" }}
           onClick={() => {
             setModalOpen(true);
-            setEditingWorkflow(data);
+            setEditingWorkflow(JSON.parse(JSON.stringify(data)));
             setNewWorkflowName(data.name);
             setNewWorkflowDescription(data.description);
             setDefaultReturnValue(data.default_return_value);
@@ -1728,6 +1728,16 @@ const Workflows = (props) => {
         return response.json();
       })
       .then((responseJson) => {
+				if (responseJson.success === false) {
+					if (responseJson.reason !== undefined) {
+						alert.error("Error setting workflow: ", responseJson.reason)
+					} else {
+						alert.error("Error setting workflow.")
+					}
+
+					return
+				}
+
         if (method === "POST" && redirect) {
           window.location.pathname = "/workflows/" + responseJson["id"];
           setModalOpen(false);