462c6653ac
* Allow running jobs from a namespace-limited token * qpNamespace cleanup * Looks like parse can deal with a * namespace * A little diff cleanup * Defensive destructuring * Removing accidental friendly-fire on can-scale * Testfix: Job run buttons from jobs index * Testfix: activeRegion job adapter string * Testfix: unit tests for job abilities correctly reflect the any-namespace rule * Testfix: job editor test looks for requests with namespace applied on plan
71 lines
2 KiB
JavaScript
71 lines
2 KiB
JavaScript
import AbstractAbility from './abstract';
|
|
import { computed, get } from '@ember/object';
|
|
import { or } from '@ember/object/computed';
|
|
|
|
export default class Job extends AbstractAbility {
|
|
@or('bypassAuthorization', 'selfTokenIsManagement', 'policiesSupportRunning')
|
|
canRun;
|
|
|
|
@or(
|
|
'bypassAuthorization',
|
|
'selfTokenIsManagement',
|
|
'specificNamespaceSupportsRunning',
|
|
'policiesSupportScaling'
|
|
)
|
|
canScale;
|
|
|
|
// TODO: A person can also see all jobs if their token grants read access to all namespaces,
|
|
// but given the complexity of namespaces and policy precedence, there isn't a good quick way
|
|
// to confirm this.
|
|
@or('bypassAuthorization', 'selfTokenIsManagement')
|
|
canListAll;
|
|
|
|
@or(
|
|
'bypassAuthorization',
|
|
'selfTokenIsManagement',
|
|
'policiesSupportDispatching'
|
|
)
|
|
canDispatch;
|
|
|
|
policyNamespacesIncludePermissions(policies = [], permissions = []) {
|
|
// For each policy record, extract all policies of all namespaces
|
|
const allNamespacePolicies = policies
|
|
.toArray()
|
|
.map((policy) => get(policy, 'rulesJSON.Namespaces'))
|
|
.flat()
|
|
.map((namespace = {}) => {
|
|
return namespace.Capabilities;
|
|
})
|
|
.flat()
|
|
.compact();
|
|
|
|
// Check for requested permissions
|
|
return allNamespacePolicies.some((policy) => {
|
|
return permissions.includes(policy);
|
|
});
|
|
}
|
|
|
|
@computed('token.selfTokenPolicies.[]')
|
|
get policiesSupportRunning() {
|
|
return this.policyNamespacesIncludePermissions(
|
|
this.token.selfTokenPolicies,
|
|
['submit-job']
|
|
);
|
|
}
|
|
|
|
@computed('rulesForNamespace.@each.capabilities')
|
|
get specificNamespaceSupportsRunning() {
|
|
return this.namespaceIncludesCapability('submit-job');
|
|
}
|
|
|
|
@computed('rulesForNamespace.@each.capabilities')
|
|
get policiesSupportScaling() {
|
|
return this.namespaceIncludesCapability('scale-job');
|
|
}
|
|
|
|
@computed('rulesForNamespace.@each.capabilities')
|
|
get policiesSupportDispatching() {
|
|
return this.namespaceIncludesCapability('dispatch-job');
|
|
}
|
|
}
|