module Api

module V2

class SettingsController < V2::BaseController

before_action :find_resource, :only => %w{show update}

api :GET, "/settings/", N_("List all settings")

include Foreman::Controller::AutoCompleteSearch

include Foreman::Controller::Parameters::Filter

before_action :setup_search_options, :only => :index

def index

class SettingsController < ApplicationController

include Foreman::Controller::AutoCompleteSearch

helper_method :xeditable?

# This can happen in development when removing a plugin

end

def xeditable?(object = nil, permission = nil)

end

end

false

end

def ensure_taxonomies_not_escalated

end

belongs_to :role

MANAGER = 'Manager'

ORG_ADMIN = 'Organization admin'

VIEWER = 'Viewer'

has_associated_audits

scope :givable, -> { where(:builtin => 0).order(:name) }

scope :builtin, lambda { |*args|

compare = 'not' if args.first

where("#{compare} builtin = 0")

permission_names - current_names

end

save!

end

def permission_records(permissions)

perms = permissions.flatten

collection = Permission.where(:name => perms).all

collection

end

end

end

# user must be assigned all given roles in order to delegate them

end

# only admin can change admin flag

map.permission :revoke_personal_access_tokens,

:"api/v2/personal_access_tokens" => [:destroy]

end

end

class Plugin

class RbacSupport

# These plugins can be extended by plugins through plugin API

def add_all_permissions_to_default_roles(all_permissions)

view_permissions = all_permissions.where("name LIKE :name", :name => "view_%")

Role.without_auditing do

existing_permissions = this_role.permissions.where(:name => permission_names).pluck(:name)

to_add = permission_names.select { |name| !existing_permissions.include?(name) }

end

end

end

</div>

<div class="tab-pane" id="roles">

<%= checkbox_f f, :admin if User.current.can_change_admin_flag? %>

</div>

<% if AuthSource.non_internal.present? %>

<div class="tab-pane" id="external">

<div class='tab-pane' id='roles'>

<%= checkbox_f f, :admin if User.current.can_change_admin_flag? %>

<% usergroups = @user.cached_usergroups.includes(:roles).distinct %>

<% if usergroups.any? %>

<div class="form-group" id="inherited-roles">

['Role', 'create_roles'],

['Role', 'edit_roles'],

['Role', 'destroy_roles'],

['SmartProxy', 'view_smart_proxies'],

['SmartProxy', 'create_smart_proxies'],

['SmartProxy', 'edit_smart_proxies'],

class << self

def seeded_roles

{

:description => 'Role granting all available permissions. With this role, user is able to do everything that admin can except for changing settings.' },

Role::ORG_ADMIN => { :permissions => base_manage_permissions + view_permissions,

:description => 'Role granting all permissions except for managing organizations. It can be used to delegate administration of specific organization to a user. In order to create such role, clone this role and assign desired organizations' },

'Edit partition tables' => { :permissions => [:view_ptables, :create_ptables, :edit_ptables, :destroy_ptables], :description => 'Role granting permissions required for managing partition tables' },

'View hosts' => { :permissions => [:view_hosts],

:description => 'Role granting permission only to view hosts' },

end

def base_manage_permissions

end

def manage_organizations_permissions

]

end

def role_managements_permissions

[

:create_roles, :edit_roles, :destroy_roles,

end

def view_permissions

end

end

end

response = ActiveSupport::JSON.decode(@response.body)

assert response["results"][0].key?("full_name")

end

end

assert_response :success

assert_equal JSON.parse(@response.body)['roles'].map { |role| role["id"] }, roles.map { |role| role.id }, "Can't update user with valid roles #{roles}"

end

end

crud_hosts_1_3:

filter: crud_hosts_1

permission: view_hosts

<% Foreman::Plugin.all.map(&:default_roles).inject({}, :merge).each do |role,permissions| %>

<% role_id = role.tr(' ', '_').scan(/[a-z_]/i).join %>

<% permissions.each do |permission| %>

role_id: 11

crud_hosts_1:

role_id: 12

<% Foreman::Plugin.all.map(&:default_roles).inject({}, :merge).each do |role, permissions| %>

<% role_id = role.tr(' ', '_').scan(/[a-z_]/i).join %>

# This line assumes permissions come in the form of a symbol 'action_resource'

resource_type: ReportTemplate

created_at: "2014-01-07 15:09:32.783442"

updated_at: "2014-01-07 15:09:32.783442"

<% Foreman::Plugin.all.map(&:permissions).inject({}, :merge).each do |permission,attrs| %>

<%= permission %>:

name: <%= permission %>

builtin: "0"

origin: foreman

<% Foreman::Plugin.all.map do |plugin| %>

<% plugin.default_roles.each do |role_name, permissions| %>

<%= role_name.tr(' ', '_').scan(/[a-z_]/i).join %>:

user_restricted_manage_compute_resources:

owner: restricted

role_id: 11

auth_source: internal

password_hash: 02d7ff9921071af778ff4f8608579dcd6d80dfba

password_salt: 80a167f1effbd82c2485ed81c3cfd68b11bc40dc

assert_valid f

end

test 'disable overriding recalculates taxonomies' do

f = FactoryBot.build(:filter, :resource_type => 'Domain')

f.role = FactoryBot.build(:role, :organizations => [ FactoryBot.build(:organization) ])

it { subject.wont_include(second) }

end

end

end

end

end

end

end

end

end

assert user.save

end

extra_role = Role.where(:name => "foobar").first_or_create

assert user.can_assign?([extra_role.id])

end

end

end

test "non admin user #can_assign? only his assigned roles" do

foobar = Role.where(:name => "foobar").first_or_create

barfoo = Role.where(:name => "barfoo").first_or_create

user.roles << foobar

# Check all access control have a matching seeded permission

assert_equal [], access_permissions - seeded_permissions

# Check all seeded permissions have a matching access control

end

seed('020-permissions_list.rb', '030-permissions.rb', '020-roles_list.rb', '040-roles.rb')

assert_equal [], view_permissions - Role.unscoped.find_by_name('Viewer').permissions

end

end