Merge pull request #254 from devtron-labs/feat/user-groups

feat: add support for user groups in image approval and user permissions

Author: eshankvaish

package-lock.json

@@ -1,6 +1,6 @@
 {
     "name": "@devtron-labs/devtron-fe-common-lib",
-    "version": "0.2.17",
+    "version": "0.2.18",
     "description": "Supporting common component library",
     "type": "module",
     "main": "dist/index.js",

package.json

@@ -32,8 +32,18 @@ import {
     CDMaterialFilterQuery,
     ImagePromotionMaterialInfo,
     EnvironmentListHelmResponse,
+    UserGroupApproverType,
+    ImageApprovalPolicyUserGroupDataType,
+    ImageApprovalPolicyType,
+    ImageApprovalUsersInfoDTO,
+    UserApprovalMetadataType,
+    UserApprovalConfigType,
+    CDMaterialListModalServiceUtilProps,
 } from './Types'
 import { ApiResourceType } from '../Pages'
+import { getIsManualApprovalSpecific, sanitizeUserApprovalConfig, stringComparatorBySortOrder } from '@Shared/Helpers'
+import { API_TOKEN_PREFIX } from '@Shared/constants'
+import { DefaultUserKey } from '@Shared/types'
 
 export const getTeamListMin = (): Promise<TeamList> => {
     // ignore active field
@@ -80,13 +90,35 @@ export function setImageTags(request, pipelineId: number, artifactId: number) {
     return post(`${ROUTES.IMAGE_TAGGING}/${pipelineId}/${artifactId}`, request)
 }
 
-const cdMaterialListModal = (
-    artifacts: any[],
-    offset: number,
-    artifactId?: number,
-    artifactStatus?: string,
-    disableDefaultSelection?: boolean,
-) => {
+const sanitizeApprovalConfigFromApprovalMetadata = (
+    approvalMetadata: UserApprovalMetadataType,
+    userApprovalConfig: UserApprovalConfigType,
+): UserApprovalMetadataType => {
+    if (!approvalMetadata) {
+        return null
+    }
+
+    const approvedUsersData = approvalMetadata.approvedUsersData || []
+    const unsanitizedApprovalConfig = approvalMetadata.approvalConfig || userApprovalConfig
+
+    return {
+        ...approvalMetadata,
+        approvedUsersData: approvedUsersData.map((userData) => ({
+            ...userData,
+            userGroups: userData.userGroups?.filter((group) => !!group?.identifier && !!group?.name) ?? [],
+        })),
+        approvalConfig: sanitizeUserApprovalConfig(unsanitizedApprovalConfig),
+    }
+}
+
+const cdMaterialListModal = ({
+    artifacts,
+    offset,
+    artifactId,
+    artifactStatus,
+    disableDefaultSelection,
+    userApprovalConfig,
+}: CDMaterialListModalServiceUtilProps) => {
     if (!artifacts || !artifacts.length) return []
 
     const markFirstSelected = offset === 0
@@ -130,7 +162,10 @@ const cdMaterialListModal = (
             vulnerable: material.vulnerable,
             runningOnParentCd: material.runningOnParentCd,
             artifactStatus: artifactStatusValue,
-            userApprovalMetadata: material.userApprovalMetadata,
+            userApprovalMetadata: sanitizeApprovalConfigFromApprovalMetadata(
+                material.userApprovalMetadata,
+                userApprovalConfig,
+            ),
             triggeredBy: material.triggeredBy,
             isVirtualEnvironment: material.isVirtualEnvironment,
             imageComment: material.imageComment,
@@ -175,19 +210,110 @@ const cdMaterialListModal = (
     return materials
 }
 
+const getImageApprovalPolicyDetailsFromMaterialResult = (cdMaterialsResult): ImageApprovalPolicyType => {
+    const approvalUsers: string[] = cdMaterialsResult.approvalUsers || []
+    const userApprovalConfig = sanitizeUserApprovalConfig(cdMaterialsResult.userApprovalConfig)
+    const isPolicyConfigured = getIsManualApprovalSpecific(userApprovalConfig)
+    const imageApprovalUsersInfo: ImageApprovalUsersInfoDTO = cdMaterialsResult.imageApprovalUsersInfo || {}
+
+    const approvalUsersMap = approvalUsers.reduce(
+        (acc, user) => {
+            acc[user] = true
+            return acc
+        },
+        {} as Record<string, true>,
+    )
+
+    const specificUsersAPIToken = userApprovalConfig.specificUsers.identifiers
+        .filter((user) => user.startsWith(API_TOKEN_PREFIX))
+        .sort(stringComparatorBySortOrder)
+    const specificUsersEmails = userApprovalConfig.specificUsers.identifiers
+        .filter((user) => !user.startsWith(API_TOKEN_PREFIX) && user !== DefaultUserKey.system)
+        .sort(stringComparatorBySortOrder)
+
+    const specificUsersData: ImageApprovalPolicyType['specificUsersData'] = {
+        dataStore: userApprovalConfig.specificUsers.identifiers.reduce(
+            (acc, email) => {
+                acc[email] = {
+                    email,
+                    hasAccess: approvalUsersMap[email] ?? false,
+                }
+                return acc
+            },
+            {} as Record<string, UserGroupApproverType>,
+        ),
+        requiredCount: userApprovalConfig.specificUsers.requiredCount,
+        emails: specificUsersEmails.concat(specificUsersAPIToken),
+    }
+
+    const validGroups = userApprovalConfig.userGroups.map((group) => group.identifier)
+
+    // Have moved from Object.keys(imageApprovalUsersInfo) to approvalUsers since backend is not filtering out the users without approval
+    // TODO: This check should be on BE. Need to remove this once BE is updated 
+    const usersList = approvalUsers.filter((user) => user !== DefaultUserKey.system)
+    const groupIdentifierToUsersMap = usersList.reduce(
+        (acc, user) => {
+            const userGroups = imageApprovalUsersInfo[user] || []
+            userGroups.forEach((group) => {
+                if (!acc[group.identifier]) {
+                    acc[group.identifier] = {}
+                }
+                acc[group.identifier][user] = true
+            })
+            return acc
+        },
+        {} as Record<string, Record<string, true>>,
+    )
+
+    return {
+        isPolicyConfigured,
+        specificUsersData,
+        userGroupData: userApprovalConfig.userGroups.reduce(
+            (acc, group) => {
+                const identifier = group.identifier
+                // No need of handling api tokens here since they are not part of user groups
+                const users = Object.keys(groupIdentifierToUsersMap[identifier] || {}).sort(stringComparatorBySortOrder)
+
+                acc[identifier] = {
+                    dataStore: users.reduce(
+                        (acc, user) => {
+                            acc[user] = {
+                                email: user,
+                                // As of now it will always be true, but UI has handled it in a way that can support false as well
+                                hasAccess: approvalUsersMap[user] ?? false,
+                            }
+                            return acc
+                        },
+                        {} as Record<string, UserGroupApproverType>,
+                    ),
+                    requiredCount: group.requiredCount,
+                    emails: users,
+                }
+
+                return acc
+            },
+            {} as Record<string, ImageApprovalPolicyUserGroupDataType>,
+        ),
+        // Not sorting since would change them in approval info modal to name
+        validGroups,
+    }
+}
+
 const processCDMaterialsApprovalInfo = (enableApproval: boolean, cdMaterialsResult): CDMaterialsApprovalInfo => {
     if (!enableApproval || !cdMaterialsResult) {
         return {
             approvalUsers: [],
             userApprovalConfig: null,
             canApproverDeploy: cdMaterialsResult?.canApproverDeploy ?? false,
+            imageApprovalPolicyDetails: null,
         }
     }
 
     return {
         approvalUsers: cdMaterialsResult.approvalUsers,
-        userApprovalConfig: cdMaterialsResult.userApprovalConfig,
+        userApprovalConfig: sanitizeUserApprovalConfig(cdMaterialsResult.userApprovalConfig),
         canApproverDeploy: cdMaterialsResult.canApproverDeploy ?? false,
+        imageApprovalPolicyDetails: getImageApprovalPolicyDetailsFromMaterialResult(cdMaterialsResult),
     }
 }
 
@@ -243,13 +369,14 @@ export const processCDMaterialServiceResponse = (
         }
     }
 
-    const materials = cdMaterialListModal(
-        cdMaterialsResult.ci_artifacts,
-        offset ?? 0,
-        cdMaterialsResult.latest_wf_artifact_id,
-        cdMaterialsResult.latest_wf_artifact_status,
+    const materials = cdMaterialListModal({
+        artifacts: cdMaterialsResult.ci_artifacts,
+        offset: offset ?? 0,
+        artifactId: cdMaterialsResult.latest_wf_artifact_id,
+        artifactStatus: cdMaterialsResult.latest_wf_artifact_status,
         disableDefaultSelection,
-    )
+        userApprovalConfig: cdMaterialsResult.userApprovalConfig,
+    })
     const approvalInfo = processCDMaterialsApprovalInfo(
         stage === DeploymentNodeType.CD || stage === DeploymentNodeType.APPROVAL,
         cdMaterialsResult,

src/Common/Common.service.ts

@@ -107,6 +107,7 @@ export const ROUTES = {
     PLUGIN_GLOBAL_LIST_V2: 'plugin/global/list/v2',
     PLUGIN_GLOBAL_LIST_TAGS: 'plugin/global/list/tags',
     DEPLOYMENT_CHARTS_LIST: 'deployment/template/fetch',
+    USER_LIST_MIN: 'user/list/min',
     CONFIG_DATA: 'config/data',
 }
 

src/Common/Constants.ts

@@ -18,6 +18,7 @@ import React, { ReactNode, CSSProperties } from 'react'
 import { Placement } from 'tippy.js'
 import { ImageComment, ReleaseTag } from './ImageTags.Types'
 import { ACTION_STATE, DEPLOYMENT_WINDOW_TYPE, DockerConfigOverrideType, SortingOrder, TaskErrorObj } from '.'
+import { UserGroupDTO } from '@Pages/GlobalConfigurations'
 import { RegistryType, Severity } from '../Shared'
 
 /**
@@ -320,24 +321,75 @@ export enum DeploymentNodeType {
     APPROVAL = 'APPROVAL',
 }
 
-export interface UserApprovalConfigType {
+export enum ManualApprovalType {
+    specific = 'SPECIFIC',
+    any = 'ANY',
+    notConfigured = 'NOT_CONFIGURED',
+}
+
+export interface UserGroupApproverType {
+    email: string
+    hasAccess: boolean
+}
+
+export interface ImageApprovalPolicyUserGroupDataType {
+    // Mapping email to data
+    dataStore: Record<string, UserGroupApproverType>
     requiredCount: number
+    emails: string[]
 }
 
+export interface ImageApprovalPolicyType {
+    isPolicyConfigured: boolean
+    specificUsersData: ImageApprovalPolicyUserGroupDataType
+    userGroupData: Record<string, ImageApprovalPolicyUserGroupDataType>
+    // Assuming name of groups are unique
+    validGroups: string[]
+}
+
+export type ImageApprovalUsersInfoDTO = Record<string, Pick<UserGroupDTO, 'identifier' | 'name'>[]>
+
+// TODO: Need to verify this change for all impacting areas
+export interface UserApprovalConfigType {
+    type: ManualApprovalType
+    requiredCount: number
+    specificUsers: {
+        identifiers: string[]
+        // FIXME: Remove this ? check later when time permits
+        requiredCount?: number
+    }
+    userGroups: (Pick<UserGroupDTO, 'identifier'> & {
+        requiredCount: number
+    })[]
+}
+
+export type UserApprovalConfigPayloadType =
+    | ({
+          type: ManualApprovalType.any
+      } & Pick<UserApprovalConfigType, 'requiredCount'>)
+    | ({
+          type: ManualApprovalType.specific
+      } & Pick<UserApprovalConfigType, 'userGroups' | 'specificUsers'>)
+    | {
+          type: ManualApprovalType.notConfigured
+      }
+
 interface ApprovalUserDataType {
     dataId: number
     userActionTime: string
     userComment: string
     userEmail: string
     userId: number
     userResponse: number
+    userGroups?: Pick<UserGroupDTO, 'identifier' | 'name'>[]
 }
 
 export interface UserApprovalMetadataType {
     approvalRequestId: number
     approvalRuntimeState: number
     approvedUsersData: ApprovalUserDataType[]
     requestedUserData: ApprovalUserDataType
+    approvalConfig?: UserApprovalConfigType
 }
 
 export enum FilterStates {
@@ -397,6 +449,15 @@ export interface ArtifactReleaseMappingType {
     version: string
 }
 
+export interface CDMaterialListModalServiceUtilProps {
+    artifacts: any[],
+    offset: number,
+    artifactId?: number,
+    artifactStatus?: string,
+    disableDefaultSelection?: boolean,
+    userApprovalConfig?: UserApprovalConfigType,
+}
+
 export interface CDMaterialType {
     index: number
     id: string
@@ -618,6 +679,10 @@ export interface CDMaterialsApprovalInfo {
     approvalUsers: string[]
     userApprovalConfig: UserApprovalConfigType
     canApproverDeploy: boolean
+    /**
+     * Only available incase of approvals do'nt use in cd materials or any other flow since approvalUsers are not present there
+     */
+    imageApprovalPolicyDetails: ImageApprovalPolicyType
 }
 
 export interface CDMaterialsMetaInfo {

src/Common/Types.ts

@@ -1,5 +1,5 @@
 import { BuildStageType, FormType } from '@Common/CIPipeline.Types'
-import { DeploymentAppTypes } from '@Common/Types'
+import { DeploymentAppTypes, UserApprovalConfigType } from '@Common/Types'
 import { DeploymentStrategy } from '@Shared/Components'
 import { EnvListMinDTO } from '@Shared/types'
 
@@ -61,9 +61,7 @@ export interface CDFormType {
     preStageConfigMapSecretNames: { configMaps: ConfigSecretType[]; secrets: ConfigSecretType[] }
     postStageConfigMapSecretNames: { configMaps: ConfigSecretType[]; secrets: ConfigSecretType[] }
     requiredApprovals: string
-    userApprovalConfig?: {
-        requiredCount: number
-    }
+    userApprovalConfig?: UserApprovalConfigType
     isClusterCdActive: boolean
     deploymentAppCreated: boolean
     clusterId: string

src/Pages/CDPipeline/types.tsx

@@ -15,5 +15,7 @@
  */
 
 export * from './constants'
-export type { UserListFilterParams, UserRoleGroup } from './types'
+export type { UserListFilterParams, UserRoleGroup, UserGroupDTO, UserGroupType } from './types'
 export * from './shared'
+export * from './service'
+export { getUserAndApiTokenOption } from './utils'