Scope REST and websocket events to the caller's environments

api/src/routes/v2/deployment_permissions.rs

@@ -3,6 +3,7 @@ use crate::result::ApiResult;
 use actix_web::{HttpResponse, delete, get, post, web};
 use platz_auth::ApiIdentity;
 use platz_db::{
+    AccessScope,
     diesel_pagination::{Paginated, PaginationParams},
     schema::deployment_permission::{
         DeploymentPermission, DeploymentPermissionFilters, NewDeploymentPermission,
@@ -28,12 +29,14 @@ use uuid::Uuid;
 )]
 #[get("/deployment-permissions")]
 async fn get_all(
-    _identity: ApiIdentity,
+    identity: ApiIdentity,
     filters: web::Query<DeploymentPermissionFilters>,
     pagination: web::Query<PaginationParams>,
 ) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
     Ok(HttpResponse::Ok().json(
-        DeploymentPermission::all_filtered(filters.into_inner(), pagination.into_inner()).await?,
+        DeploymentPermission::all_filtered(filters.into_inner(), pagination.into_inner(), &scope)
+            .await?,
     ))
 }
 
@@ -53,8 +56,9 @@ async fn get_all(
     ),
 )]
 #[get("/deployment-permissions/{id}")]
-async fn get_one(_identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
-    Ok(HttpResponse::Ok().json(DeploymentPermission::find(id.into_inner()).await?))
+async fn get_one(identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
+    Ok(HttpResponse::Ok().json(DeploymentPermission::find_scoped(id.into_inner(), &scope).await?))
 }
 
 #[utoipa::path(

api/src/routes/v2/deployment_resources.rs

@@ -3,12 +3,14 @@ use actix_web::{HttpResponse, delete, get, post, put, web};
 use futures::future::try_join_all;
 use platz_auth::ApiIdentity;
 use platz_db::{
+    AccessScope,
     diesel_pagination::{Paginated, PaginationParams},
     schema::{
         deployment::Deployment,
         deployment_resource::{
-            DeploymentResource, DeploymentResourceFilters, DeploymentResourceSyncStatus,
-            NewDeploymentResource, UpdateDeploymentResource, UpdateDeploymentResourceSyncStatus,
+            DeploymentResource, DeploymentResourceExtraFilters, DeploymentResourceFilters,
+            DeploymentResourceSyncStatus, NewDeploymentResource, UpdateDeploymentResource,
+            UpdateDeploymentResourceSyncStatus,
         },
         deployment_resource_type::DeploymentResourceType,
     },
@@ -34,12 +36,19 @@ use uuid::Uuid;
 )]
 #[get("/deployment-resources")]
 async fn get_all(
-    _identity: ApiIdentity,
+    identity: ApiIdentity,
     filters: web::Query<DeploymentResourceFilters>,
+    extra_filters: web::Query<DeploymentResourceExtraFilters>,
     pagination: web::Query<PaginationParams>,
 ) -> ApiResult {
-    let mut result =
-        DeploymentResource::all_filtered(filters.into_inner(), pagination.into_inner()).await?;
+    let scope = AccessScope::for_identity(identity.inner()).await?;
+    let mut result = DeploymentResource::all_filtered(
+        filters.into_inner(),
+        extra_filters.into_inner(),
+        pagination.into_inner(),
+        &scope,
+    )
+    .await?;
     result.items = try_join_all(
         result
             .items
@@ -66,9 +75,10 @@ async fn get_all(
     ),
 )]
 #[get("/deployment-resources/{id}")]
-async fn get_one(_identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
+async fn get_one(identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
     Ok(HttpResponse::Ok().json(
-        DeploymentResource::find(id.into_inner())
+        DeploymentResource::find_scoped(id.into_inner(), &scope)
             .await?
             .without_sensitive_props()
             .await?,

api/src/routes/v2/deployment_tasks.rs

@@ -5,7 +5,7 @@ use actix_web::{HttpResponse, delete, get, post, web};
 use chrono::prelude::*;
 use platz_auth::ApiIdentity;
 use platz_db::{
-    DbError, DbTableOrDeploymentResource, Json,
+    AccessScope, DbError, DbTableOrDeploymentResource, Json,
     diesel_pagination::{Paginated, PaginationParams},
     schema::{
         deployment::Deployment,
@@ -41,16 +41,18 @@ use uuid::Uuid;
 )]
 #[get("/deployment-tasks")]
 async fn get_all(
-    _identity: ApiIdentity,
+    identity: ApiIdentity,
     filters: web::Query<DeploymentTaskFilters>,
     extra_filters: web::Query<DeploymentTaskExtraFilters>,
     pagination: web::Query<PaginationParams>,
 ) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
     Ok(HttpResponse::Ok().json(
         DeploymentTask::all_filtered(
             filters.into_inner(),
             extra_filters.into_inner(),
             pagination.into_inner(),
+            &scope,
         )
         .await?,
     ))
@@ -72,8 +74,9 @@ async fn get_all(
     ),
 )]
 #[get("/deployment-tasks/{id}")]
-async fn get_one(_identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
-    Ok(HttpResponse::Ok().json(DeploymentTask::find(id.into_inner()).await?))
+async fn get_one(identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
+    Ok(HttpResponse::Ok().json(DeploymentTask::find_scoped(id.into_inner(), &scope).await?))
 }
 
 #[derive(Debug, Deserialize, ToSchema)]
@@ -105,7 +108,8 @@ async fn cancel_one(
     body: web::Json<CancelDeploymentTask>,
 ) -> ApiResult {
     let body = body.into_inner();
-    let task = DeploymentTask::find(id.into_inner()).await?;
+    let scope = AccessScope::for_identity(identity.inner()).await?;
+    let task = DeploymentTask::find_scoped(id.into_inner(), &scope).await?;
     let canceled_by_user_id = identity.inner().user_id();
     let canceled_by_deployment_id = identity.inner().deployment_id();
 

api/src/routes/v2/deployments.rs

@@ -6,7 +6,7 @@ use actix_web::{HttpResponse, delete, get, post, put, web};
 use platz_auth::ApiIdentity;
 use platz_chart_ext::ChartExtCardinality;
 use platz_db::{
-    DbTable, DbTableOrDeploymentResource,
+    AccessScope, DbTable, DbTableOrDeploymentResource,
     diesel_pagination::{Paginated, PaginationParams},
     schema::{
         deployment::{
@@ -38,16 +38,18 @@ use uuid::Uuid;
 )]
 #[get("/deployments")]
 async fn get_all(
-    _identity: ApiIdentity,
+    identity: ApiIdentity,
     filters: web::Query<DeploymentFilters>,
     extra_filters: web::Query<DeploymentExtraFilters>,
     pagination: web::Query<PaginationParams>,
 ) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
     Ok(HttpResponse::Ok().json(
         Deployment::all_filtered(
             filters.into_inner(),
             extra_filters.into_inner(),
             pagination.into_inner(),
+            &scope,
         )
         .await?,
     ))
@@ -69,8 +71,9 @@ async fn get_all(
     ),
 )]
 #[get("/deployments/{id}")]
-async fn get_one(_identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
-    Ok(HttpResponse::Ok().json(Deployment::find(id.into_inner()).await?))
+async fn get_one(identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
+    Ok(HttpResponse::Ok().json(Deployment::find_scoped(id.into_inner(), &scope).await?))
 }
 
 #[utoipa::path(

api/src/routes/v2/env_user_permissions.rs

@@ -2,6 +2,7 @@ use crate::{permissions::verify_env_admin, result::ApiResult};
 use actix_web::{HttpResponse, delete, get, post, web};
 use platz_auth::ApiIdentity;
 use platz_db::{
+    AccessScope,
     diesel_pagination::{Paginated, PaginationParams},
     schema::env_user_permission::{
         EnvUserPermission, EnvUserPermissionFilters, NewEnvUserPermission,
@@ -28,12 +29,14 @@ use uuid::Uuid;
 )]
 #[get("/env-user-permissions")]
 async fn get_all(
-    _identity: ApiIdentity,
+    identity: ApiIdentity,
     filters: web::Query<EnvUserPermissionFilters>,
     pagination: web::Query<PaginationParams>,
 ) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
     Ok(HttpResponse::Ok().json(
-        EnvUserPermission::all_filtered(filters.into_inner(), pagination.into_inner()).await?,
+        EnvUserPermission::all_filtered(filters.into_inner(), pagination.into_inner(), &scope)
+            .await?,
     ))
 }
 
@@ -53,8 +56,9 @@ async fn get_all(
     ),
 )]
 #[get("/env-user-permissions/{id}")]
-async fn get_one(_identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
-    Ok(HttpResponse::Ok().json(EnvUserPermission::find(id.into_inner()).await?))
+async fn get_one(identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
+    Ok(HttpResponse::Ok().json(EnvUserPermission::find_scoped(id.into_inner(), &scope).await?))
 }
 
 #[utoipa::path(

api/src/routes/v2/envs.rs

@@ -4,6 +4,7 @@ use actix_web::{HttpResponse, delete, get, post, put, web};
 use itertools::Itertools;
 use platz_auth::ApiIdentity;
 use platz_db::{
+    AccessScope,
     diesel_pagination::{Paginated, PaginationParams},
     schema::{
         deployment::Deployment,
@@ -32,12 +33,13 @@ use uuid::Uuid;
 )]
 #[get("/envs")]
 async fn get_all(
-    _identity: ApiIdentity,
+    identity: ApiIdentity,
     filters: web::Query<EnvFilters>,
     pagination: web::Query<PaginationParams>,
 ) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
     Ok(HttpResponse::Ok()
-        .json(Env::all_filtered(filters.into_inner(), pagination.into_inner()).await?))
+        .json(Env::all_filtered(filters.into_inner(), pagination.into_inner(), &scope).await?))
 }
 
 #[utoipa::path(
@@ -56,8 +58,9 @@ async fn get_all(
     ),
 )]
 #[get("/envs/{id}")]
-async fn get_one(_identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
-    Ok(HttpResponse::Ok().json(Env::find(id.into_inner()).await?))
+async fn get_one(identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
+    Ok(HttpResponse::Ok().json(Env::find_scoped(id.into_inner(), &scope).await?))
 }
 
 #[utoipa::path(

api/src/routes/v2/secrets.rs

@@ -3,7 +3,7 @@ use crate::{permissions::verify_env_admin, result::ApiResult};
 use actix_web::{HttpResponse, delete, get, post, put, web};
 use platz_auth::ApiIdentity;
 use platz_db::{
-    DbTable, DbTableOrDeploymentResource,
+    AccessScope, DbTable, DbTableOrDeploymentResource,
     diesel_pagination::{Paginated, PaginationParams},
     schema::{
         deployment::Deployment,
@@ -31,12 +31,13 @@ use uuid::Uuid;
 )]
 #[get("/secrets")]
 async fn get_all(
-    _identity: ApiIdentity,
+    identity: ApiIdentity,
     filters: web::Query<SecretFilters>,
     pagination: web::Query<PaginationParams>,
 ) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
     Ok(HttpResponse::Ok()
-        .json(Secret::all_filtered(filters.into_inner(), pagination.into_inner()).await?))
+        .json(Secret::all_filtered(filters.into_inner(), pagination.into_inner(), &scope).await?))
 }
 
 #[utoipa::path(
@@ -55,8 +56,9 @@ async fn get_all(
     ),
 )]
 #[get("/secrets/{id}")]
-async fn get_one(_identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
-    Ok(HttpResponse::Ok().json(Secret::find(id.into_inner()).await?))
+async fn get_one(identity: ApiIdentity, id: web::Path<Uuid>) -> ApiResult {
+    let scope = AccessScope::for_identity(identity.inner()).await?;
+    Ok(HttpResponse::Ok().json(Secret::find_scoped(id.into_inner(), &scope).await?))
 }
 
 #[utoipa::path(