Skip to content

OU-1344: Add granular permission checks #1185

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PeterYurkovich wants to merge 2 commits into
base: main
Choose a base branch
from
+727 −1,262
Open

OU-1344: Add granular permission checks #1185

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
abf60d4
feat: remove perses /permissions api call for direct RBAC checks
PeterYurkovich Aug 25, 2026
54e3f1e
test: update tests for removal of /permissions api cal
PeterYurkovich Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 18 additions & 10 deletions web/cypress/support/perses/99.coo_rbac_perses_user1.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,11 +266,14 @@ export function testCOORBACPersesTestsDevUser1(perspective: PerspectiveConfig) {
listPersesDashboardsPage.assertCreateButtonIsEnabled();
listPersesDashboardsPage.clickCreateButton();
persesCreateDashboardsPage.createDashboardShouldBeLoaded();
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('observ-test');
// Non-viewable projects are absent from the dropdown.
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('perses-dev');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('openshift-monitoring');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('empty-namespace3');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('empty-namespace4');
// Viewable but non-creatable projects are listed but creation is denied.
persesCreateDashboardsPage.assertCreateAccessDenied('observ-test');
persesCreateDashboardsPage.assertCreateAccessDenied('openshift-monitoring');
// Editable project is selectable and creatable.
persesCreateDashboardsPage.assertProjectDropdown('openshift-cluster-observability-operator');
persesCreateDashboardsPage.createDashboardDialogCancelButton();

Expand Down Expand Up @@ -434,11 +437,11 @@ export function testCOORBACPersesTestsDevUser1(perspective: PerspectiveConfig) {
cy.log(`6.2. Change namespace to observ-test`);
cy.changeNamespace('observ-test');

cy.log(`6.3. Assert Kebab icon is disabled`);
cy.log(`6.3. Assert Rename/Delete row actions are disabled`);
listPersesDashboardsPage.filter.byName(
persesDashboardsDashboardDropdownPersesDev.PERSES_DASHBOARD_SAMPLE[0],
);
listPersesDashboardsPage.assertKebabIconDisabled();
listPersesDashboardsPage.assertKebabRowActionsDisabled();

cy.log(`6.4. Change namespace to openshift-cluster-observability-operator`);
cy.changeNamespace('openshift-cluster-observability-operator');
Expand All @@ -464,8 +467,7 @@ export function testCOORBACPersesTestsDevUser1(perspective: PerspectiveConfig) {
persesDashboardsDashboardDropdownPersesDev.PERSES_DASHBOARD_SAMPLE[0],
);
listPersesDashboardsPage.countDashboards('1');
listPersesDashboardsPage.clickKebabIcon();
listPersesDashboardsPage.assertKebabIconDisabled();
listPersesDashboardsPage.assertKebabRowActionsDisabled();
listPersesDashboardsPage.clearAllFilters();

cy.log(`6.8. Filter by Project and Name`);
Expand Down Expand Up @@ -568,11 +570,14 @@ export function testCOORBACPersesTestsDevUser1(perspective: PerspectiveConfig) {
listPersesDashboardsPage.clickDuplicateOption();

cy.log(`8.5. Assert project dropdown options`);
listPersesDashboardsPage.assertDuplicateProjectDropdownNotExists('observ-test');
// Non-viewable projects are absent from the dropdown.
listPersesDashboardsPage.assertDuplicateProjectDropdownNotExists('perses-dev');
listPersesDashboardsPage.assertDuplicateProjectDropdownNotExists('empty-namespace3');
listPersesDashboardsPage.assertDuplicateProjectDropdownNotExists('empty-namespace4');
listPersesDashboardsPage.assertDuplicateProjectDropdownNotExists('openshift-monitoring');
// Viewable but non-creatable projects are listed but duplication is denied.
listPersesDashboardsPage.assertDuplicateProjectDenied('observ-test');
listPersesDashboardsPage.assertDuplicateProjectDenied('openshift-monitoring');
// Editable project is selectable and creatable.
listPersesDashboardsPage.assertDuplicateProjectDropdownExists(
'openshift-cluster-observability-operator',
);
Expand Down Expand Up @@ -648,11 +653,14 @@ export function testCOORBACPersesTestsDevUser1(perspective: PerspectiveConfig) {
persesImportDashboardsPage.assertPersesDashboardDetected();

cy.log(`10.4. Verify project dropdown options`);
persesImportDashboardsPage.assertProjectNotExistsInDropdown('observ-test');
// Non-viewable projects are absent from the dropdown.
persesImportDashboardsPage.assertProjectNotExistsInDropdown('perses-dev');
persesImportDashboardsPage.assertProjectNotExistsInDropdown('openshift-monitoring');
persesImportDashboardsPage.assertProjectNotExistsInDropdown('empty-namespace3');
persesImportDashboardsPage.assertProjectNotExistsInDropdown('empty-namespace4');
// Viewable but non-creatable projects are listed but import is denied.
persesImportDashboardsPage.assertImportAccessDenied('observ-test');
persesImportDashboardsPage.assertImportAccessDenied('openshift-monitoring');
// Editable project is selectable and creatable.
persesImportDashboardsPage.assertProjectDropdown('openshift-cluster-observability-operator');
persesImportDashboardsPage.clickCancelButton();

Expand Down
59 changes: 31 additions & 28 deletions web/cypress/support/perses/99.coo_rbac_perses_user2.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
import { persesDashboardsPage } from '../../views/perses-dashboards';
import { listPersesDashboardsPage } from '../../views/perses-dashboards-list-dashboards';
import { persesCreateDashboardsPage } from '../../views/perses-dashboards-create-dashboard';
import { persesImportDashboardsPage } from '../../views/perses-dashboards-import-dashboard';
import {
persesDashboardsDashboardDropdownCOO,
persesDashboardsDashboardDropdownPersesDev,
Expand Down Expand Up @@ -120,67 +122,68 @@ export function testCOORBACPersesTestsDevUser2(perspective: PerspectiveConfig) {
persesDashboardsPage.assertEditButtonIsDisabled();
});

it(`3.${perspective.name} perspective - Create button validation - Disabled`, () => {
it(`3.${perspective.name} perspective - Create button validation - Access denied`, () => {
cy.log(`3.1. use sidebar nav to go to Observe > Dashboards (Perses)`);
listPersesDashboardsPage.shouldBeLoaded(perspective.dashboardsPageName);

cy.log(`3.2. Verify Create button is disabled`);
listPersesDashboardsPage.assertCreateButtonIsDisabled();

cy.log(`3.3 change namespace to perses-dev`);
cy.log(`3.2 change namespace to perses-dev`);
cy.changeNamespace('perses-dev');

cy.log(`3.4. Verify Create button is disabled`);
listPersesDashboardsPage.assertCreateButtonIsDisabled();

cy.log(`3.5. Change namespace to openshift-monitoring`);
cy.changeNamespace('openshift-monitoring');
listPersesDashboardsPage.assertCreateButtonIsDisabled();
cy.log(`3.3. Verify Create button is enabled but creation is denied for perses-dev`);
listPersesDashboardsPage.assertCreateButtonIsEnabled();
listPersesDashboardsPage.clickCreateButton();
persesCreateDashboardsPage.createDashboardShouldBeLoaded();
persesCreateDashboardsPage.assertCreateAccessDenied('perses-dev');
persesCreateDashboardsPage.assertCreateAccessDenied('openshift-monitoring');
persesCreateDashboardsPage.createDashboardDialogCancelButton();
});

it(`4.${perspective.name} perspective - Kebab icon - Disabled`, () => {
it(`4.${perspective.name} perspective - Kebab icon - Row actions denied`, () => {
cy.log(`4.1. use sidebar nav to go to Observe > Dashboards (Perses)`);
listPersesDashboardsPage.shouldBeLoaded(perspective.dashboardsPageName);

cy.log(`4.2. Change namespace to perses-dev`);
cy.changeNamespace('perses-dev');

cy.log(`4.3. Assert Kebab icon is disabled`);
cy.log(`4.3. Assert Rename/Delete row actions are disabled`);
listPersesDashboardsPage.filter.byName(
persesDashboardsDashboardDropdownPersesDev.PERSES_DASHBOARD_SAMPLE[0],
);
listPersesDashboardsPage.assertKebabIconDisabled();
listPersesDashboardsPage.assertKebabRowActionsDisabled();

cy.log(`4.4. Assert Duplicate is blocked by access-denied in the modal`);
listPersesDashboardsPage.assertDuplicateAccessDenied('perses-dev');
listPersesDashboardsPage.clearAllFilters();

cy.log(`4.4. Change namespace to All Projects`);
cy.log(`4.5. Change namespace to All Projects`);
cy.changeNamespace('All Projects');

cy.log(`4.5. Assert Kebab icon is disabled`);
cy.log(`4.6. Assert Rename/Delete row actions are disabled`);
listPersesDashboardsPage.filter.byProject('perses-dev');
listPersesDashboardsPage.filter.byName(
persesDashboardsDashboardDropdownPersesDev.PERSES_DASHBOARD_SAMPLE[0],
);
listPersesDashboardsPage.countDashboards('1');
listPersesDashboardsPage.assertKebabIconDisabled();
listPersesDashboardsPage.assertKebabRowActionsDisabled();
listPersesDashboardsPage.clearAllFilters();
});

it(`5.${perspective.name} perspective - Import button validation - Disabled`, () => {
it(`5.${perspective.name} perspective - Import button validation - Access denied`, () => {
cy.log(`5.1. use sidebar nav to go to Observe > Dashboards (Perses)`);
listPersesDashboardsPage.shouldBeLoaded(perspective.dashboardsPageName);

cy.log(`5.2. Change namespace to perses-dev`);
cy.changeNamespace('perses-dev');

cy.log(`5.3. Verify Import button is disabled`);
listPersesDashboardsPage.assertImportButtonIsDisabled();

cy.log(`5.5. Change namespace to openshift-monitoring`);
cy.changeNamespace('openshift-monitoring');
listPersesDashboardsPage.assertImportButtonIsDisabled();

cy.log(`5.6. Change namespace to All Projects`);
cy.changeNamespace('All Projects');
listPersesDashboardsPage.assertImportButtonIsDisabled();
cy.log(`5.3. Verify Import button is enabled but import is denied for perses-dev`);
listPersesDashboardsPage.assertImportButtonIsEnabled();
listPersesDashboardsPage.clickImportButton();
persesImportDashboardsPage.importDashboardShouldBeLoaded();
persesImportDashboardsPage.uploadFile(
'./cypress/fixtures/coo/coo140_perses/import/testing-perses-dashboard.json',
);
persesImportDashboardsPage.assertPersesDashboardDetected();
persesImportDashboardsPage.assertImportAccessDenied('perses-dev');
persesImportDashboardsPage.clickCancelButton();
});
}
12 changes: 6 additions & 6 deletions web/cypress/support/perses/99.coo_rbac_perses_user3.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ export function testCOORBACPersesTestsDevUser3(perspective: PerspectiveConfig) {
);
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('observ-test');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('perses-dev');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('openshift-monitoring');
persesCreateDashboardsPage.assertCreateAccessDenied('openshift-monitoring');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('empty-namespace4');
persesCreateDashboardsPage.assertProjectDropdown('empty-namespace3');
persesCreateDashboardsPage.createDashboardDialogCancelButton();
Expand All @@ -78,7 +78,7 @@ export function testCOORBACPersesTestsDevUser3(perspective: PerspectiveConfig) {
);
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('observ-test');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('perses-dev');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('openshift-monitoring');
persesCreateDashboardsPage.assertCreateAccessDenied('openshift-monitoring');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('empty-namespace4');
persesCreateDashboardsPage.assertProjectDropdown('empty-namespace3');

Expand All @@ -95,7 +95,7 @@ export function testCOORBACPersesTestsDevUser3(perspective: PerspectiveConfig) {
);
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('observ-test');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('perses-dev');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('openshift-monitoring');
persesCreateDashboardsPage.assertCreateAccessDenied('openshift-monitoring');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('empty-namespace4');
persesCreateDashboardsPage.assertProjectDropdown('empty-namespace3');
persesCreateDashboardsPage.createDashboardDialogCancelButton();
Expand All @@ -119,7 +119,7 @@ export function testCOORBACPersesTestsDevUser3(perspective: PerspectiveConfig) {
persesCreateDashboardsPage.createDashboardShouldBeLoaded();
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('observ-test');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('perses-dev');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('openshift-monitoring');
persesCreateDashboardsPage.assertCreateAccessDenied('openshift-monitoring');
persesCreateDashboardsPage.assertProjectNotExistsInDropdown('empty-namespace4');
persesCreateDashboardsPage.assertProjectDropdown('empty-namespace3');
persesCreateDashboardsPage.createDashboardDialogCancelButton();
Expand Down Expand Up @@ -378,10 +378,10 @@ export function testCOORBACPersesTestsDevUser3(perspective: PerspectiveConfig) {
listPersesDashboardsPage.assertDuplicateProjectDropdownNotExists(
'openshift-cluster-observability-operator',
);
listPersesDashboardsPage.assertDuplicateProjectDropdownNotExists('openshift-monitoring');
listPersesDashboardsPage.assertDuplicateProjectDropdownNotExists('observ-test');
listPersesDashboardsPage.assertDuplicateProjectDropdownNotExists('perses-dev');
listPersesDashboardsPage.assertDuplicateProjectDropdownNotExists('empty-namespace4');
listPersesDashboardsPage.assertDuplicateProjectDenied('openshift-monitoring');
listPersesDashboardsPage.assertDuplicateProjectDropdownExists('empty-namespace3');

cy.log(`6.6. Enter new dashboard name`);
Expand Down Expand Up @@ -458,8 +458,8 @@ export function testCOORBACPersesTestsDevUser3(perspective: PerspectiveConfig) {
);
persesImportDashboardsPage.assertProjectNotExistsInDropdown('observ-test');
persesImportDashboardsPage.assertProjectNotExistsInDropdown('perses-dev');
persesImportDashboardsPage.assertProjectNotExistsInDropdown('openshift-monitoring');
persesImportDashboardsPage.assertProjectNotExistsInDropdown('empty-namespace4');
persesImportDashboardsPage.assertImportAccessDenied('openshift-monitoring');
persesImportDashboardsPage.assertProjectDropdown('empty-namespace3');
persesImportDashboardsPage.clickCancelButton();

Expand Down
43 changes: 29 additions & 14 deletions web/cypress/support/perses/99.coo_rbac_perses_user4.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
import { listPersesDashboardsPage } from '../../views/perses-dashboards-list-dashboards';
import { persesCreateDashboardsPage } from '../../views/perses-dashboards-create-dashboard';
import { persesImportDashboardsPage } from '../../views/perses-dashboards-import-dashboard';

export interface PerspectiveConfig {
name: string;
Expand Down Expand Up @@ -35,38 +37,51 @@ export function testCOORBACPersesTestsDevUser4(perspective: PerspectiveConfig) {
cy.log(`1.2. All Projects validation - Dashboard search - empty state`);
cy.changeNamespace('All Projects');
listPersesDashboardsPage.noDashboardsFoundState();
listPersesDashboardsPage.assertCreateButtonIsDisabled();
listPersesDashboardsPage.assertCreateButtonIsEnabled();

cy.log(`1.3. empty-namespace4 validation - Dashboard search - empty state`);
cy.changeNamespace('empty-namespace4');
listPersesDashboardsPage.noDashboardsFoundState();
listPersesDashboardsPage.assertCreateButtonIsDisabled();
listPersesDashboardsPage.assertCreateButtonIsEnabled();

cy.log(`1.4. openshift-monitoring validation - Dashboard search - empty state`);
cy.changeNamespace('openshift-monitoring');
listPersesDashboardsPage.noDashboardsFoundState();
listPersesDashboardsPage.assertCreateButtonIsDisabled();
listPersesDashboardsPage.assertCreateButtonIsEnabled();
},
);

it(`2.${perspective.name} perspective - Import button validation - Disabled`, () => {
it(`2.${perspective.name} perspective - Create button validation - Access denied`, () => {
cy.log(`2.1. use sidebar nav to go to Observe > Dashboards (Perses)`);
listPersesDashboardsPage.noDashboardsFoundState();

cy.log(`2.2 change namespace to empty-namespace4`);
cy.changeNamespace('empty-namespace4');

cy.log(`2.3. Verify Import button is disabled`);
listPersesDashboardsPage.assertImportButtonIsDisabled();
cy.log(`2.3. Verify Create button is enabled but creation is denied for empty-namespace4`);
listPersesDashboardsPage.assertCreateButtonIsEnabled();
listPersesDashboardsPage.clickCreateButton();
persesCreateDashboardsPage.createDashboardShouldBeLoaded();
persesCreateDashboardsPage.assertCreateAccessDenied('empty-namespace4');
persesCreateDashboardsPage.createDashboardDialogCancelButton();
});

it(`3.${perspective.name} perspective - Import button validation - Access denied`, () => {
cy.log(`3.1. use sidebar nav to go to Observe > Dashboards (Perses)`);
listPersesDashboardsPage.noDashboardsFoundState();

cy.log(`2.4. Change namespace to openshift-monitoring`);
cy.changeNamespace('openshift-monitoring');
cy.log(`2.5. Verify Import button is disabled`);
listPersesDashboardsPage.assertImportButtonIsDisabled();
cy.log(`3.2 change namespace to empty-namespace4`);
cy.changeNamespace('empty-namespace4');

cy.log(`2.6. Change namespace to All Projects`);
cy.changeNamespace('All Projects');
cy.log(`2.7. Verify Import button is disabled`);
listPersesDashboardsPage.assertImportButtonIsDisabled();
cy.log(`3.3. Verify Import button is enabled but import is denied for empty-namespace4`);
listPersesDashboardsPage.assertImportButtonIsEnabled();
listPersesDashboardsPage.clickImportButton();
persesImportDashboardsPage.importDashboardShouldBeLoaded();
persesImportDashboardsPage.uploadFile(
'./cypress/fixtures/coo/coo140_perses/import/testing-perses-dashboard.json',
);
persesImportDashboardsPage.assertPersesDashboardDetected();
persesImportDashboardsPage.assertImportAccessDenied('empty-namespace4');
persesImportDashboardsPage.clickCancelButton();
});
}
24 changes: 19 additions & 5 deletions web/cypress/support/perses/99.coo_rbac_perses_user6.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
import { listPersesDashboardsPage } from '../../views/perses-dashboards-list-dashboards';
import { persesCreateDashboardsPage } from '../../views/perses-dashboards-create-dashboard';
import { persesImportDashboardsPage } from '../../views/perses-dashboards-import-dashboard';

export interface PerspectiveConfig {
name: string;
Expand Down Expand Up @@ -29,16 +31,28 @@ export function testCOORBACPersesTestsDevUser6(perspective: PerspectiveConfig) {
cy.assertNamespace('empty-namespace3', false);
cy.assertNamespace('empty-namespace4', false);

cy.log(`1.2. Create button validation`);
listPersesDashboardsPage.assertCreateButtonIsDisabled();
cy.log(`1.2. Create button is enabled but no project is selectable, so Create is disabled`);
listPersesDashboardsPage.assertCreateButtonIsEnabled();
listPersesDashboardsPage.clickCreateButton();
persesCreateDashboardsPage.createDashboardShouldBeLoaded();
cy.byPFRole('dialog').find('button').contains('Create').should('be.disabled');
persesCreateDashboardsPage.createDashboardDialogCancelButton();
},
);

it(`2.${perspective.name} perspective - Import button validation - Disabled`, () => {
it(`2.${perspective.name} perspective - Import button validation - Access denied`, () => {
cy.log(`2.1. use sidebar nav to go to Observe > Dashboards (Perses)`);
listPersesDashboardsPage.noDashboardsFoundState();

cy.log(`2.2. Verify Import button is disabled`);
listPersesDashboardsPage.assertImportButtonIsDisabled();
cy.log(`2.2. Verify Import button is enabled but import is disabled without a project`);
listPersesDashboardsPage.assertImportButtonIsEnabled();
listPersesDashboardsPage.clickImportButton();
persesImportDashboardsPage.importDashboardShouldBeLoaded();
persesImportDashboardsPage.uploadFile(
'./cypress/fixtures/coo/coo140_perses/import/testing-perses-dashboard.json',
);
persesImportDashboardsPage.assertPersesDashboardDetected();
cy.byPFRole('dialog').find('button').contains('Import').should('be.disabled');
persesImportDashboardsPage.clickCancelButton();
});
}
Loading