rework api perms to allow read by authed user, edit by superuser

Author: dogboat

dojo/authorization/api_permissions.py

@@ -19,6 +19,7 @@
 from dojo.importers.auto_create_context import AutoCreateContextManager
 from dojo.location.models import Location
 from dojo.models import (
+    CICDInfrastructure,
     Development_Environment,
     Endpoint,
     Engagement,
@@ -919,6 +920,19 @@ class UserHasRegulationPermission(BaseDjangoModelPermission):
     }
 
 
+class UserHasCICDInfrastructurePermission(BaseDjangoModelPermission):
+    django_model = CICDInfrastructure
+    # Reads are open to any authenticated user (engagement views surface CICD
+    # references and need to render them). Writes require the configuration
+    # permission — superuser/staff on OS, full RBAC under Pro shadowing.
+    request_method_permission_map = {
+        "POST": "add",
+        "PUT": "change",
+        "PATCH": "change",
+        "DELETE": "delete",
+    }
+
+
 def raise_no_auto_create_import_validation_error(
     test_title,
     scan_type,

dojo/cicd_infrastructure/api/views.py

@@ -1,20 +1,21 @@
 from django_filters.rest_framework import DjangoFilterBackend
+from rest_framework.permissions import IsAuthenticated
 
 from dojo.api_v2.views import DojoModelViewSet
 from dojo.authorization import api_permissions as permissions
 from dojo.cicd_infrastructure.api.serializers import CICDInfrastructureSerializer
 from dojo.models import CICDInfrastructure
 
 
-# Authorization: configuration
+# Authorization: read open to authenticated users; write requires configuration permission.
 class CICDInfrastructureViewSet(
     DojoModelViewSet,
 ):
     serializer_class = CICDInfrastructureSerializer
     queryset = CICDInfrastructure.objects.none()
     filter_backends = (DjangoFilterBackend,)
     filterset_fields = ["id", "name", "infrastructure_type"]
-    permission_classes = (permissions.UserHasConfigurationPermissionSuperuser,)
+    permission_classes = (IsAuthenticated, permissions.UserHasCICDInfrastructurePermission)
 
     def get_queryset(self):
         return CICDInfrastructure.objects.all().order_by("id")

unittests/test_cicd_infrastructure.py

@@ -96,8 +96,9 @@ def test_disabled_field_ignores_posted_value(self):
 class CICDInfrastructureAPITests(APITestCase):
 
     """
-    The /cicd_infrastructure endpoint uses UserHasConfigurationPermissionSuperuser
-    — superusers can do anything; non-superusers need the explicit Django permission.
+    The /cicd_infrastructure endpoint uses UserHasCICDInfrastructurePermission
+    — reads are open to any authenticated user; writes require the configuration
+    permission (superuser/staff on OS, full RBAC under Pro).
     """
 
     fixtures = ["dojo_testdata.json"]
@@ -144,11 +145,25 @@ def test_create_allows_same_name_different_type(self):
         )
         self.assertEqual(r.status_code, 201, r.content[:1000])
 
-    def test_non_superuser_is_rejected(self):
+    def test_non_superuser_can_list(self):
         # 'user1' (pk=2 in dojo_testdata.json) is a non-superuser with a token.
+        # Reads are open to authenticated users.
         try:
             c = self._client_for("user1")
         except Token.DoesNotExist:
             self.skipTest("user1 token not present in dojo_testdata fixture.")
         r = c.get(reverse("cicd_infrastructure-list"))
-        self.assertIn(r.status_code, (401, 403), f"expected 401/403, got {r.status_code}")
+        self.assertEqual(r.status_code, 200, r.content[:1000])
+
+    def test_non_superuser_cannot_create(self):
+        try:
+            c = self._client_for("user1")
+        except Token.DoesNotExist:
+            self.skipTest("user1 token not present in dojo_testdata fixture.")
+        r = c.post(
+            reverse("cicd_infrastructure-list"),
+            {"name": "NonSuperCreate", "infrastructure_type": "build_server"},
+            format="json",
+        )
+        self.assertEqual(r.status_code, 403, r.content[:1000])
+        self.assertFalse(CICDInfrastructure.objects.filter(name="NonSuperCreate").exists())