Skip to content

Commit 1609af9

Browse files
mms-giannimms-gianni
authored
Merge pull request #647 from kubero-dev/migrate/readonly-mode
migrate read only mode
2 parents 5b28cb4 + 3b0a5a8 commit 1609af9

File tree

15 files changed

+67
-32
lines changed

15 files changed

+67
-32
lines changed

‎server/src/addons/addons.controller.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import {
55
ApiForbiddenResponse,
66
ApiOperation,
77
} from '@nestjs/swagger';
8-
import { OKDTO } from '../shared/dto/ok.dto';
8+
import { OKDTO } from '../common/dto/ok.dto';
99
import { JwtAuthGuard } from '../auth/strategies/jwt.guard';
1010

1111
@Controller({ path: 'api/addons', version: '1' })

‎server/src/apps/apps.controller.ts

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,9 @@ import {
2121
} from '@nestjs/swagger';
2222
import { ApiBearerAuth } from '@nestjs/swagger';
2323
import { GetAppDTO } from './apps.dto';
24-
import { OKDTO } from '../shared/dto/ok.dto';
24+
import { OKDTO } from '../common/dto/ok.dto';
2525
import { JwtAuthGuard } from '../auth/strategies/jwt.guard';
26+
import { ReadonlyGuard } from '../common/guards/readonly.guard';
2627

2728
@Controller({ path: 'api/apps', version: '1' })
2829
export class AppsController {
@@ -48,15 +49,16 @@ export class AppsController {
4849
return this.appsService.getApp(pipeline, phase, app);
4950
}
5051

51-
@ApiOperation({ summary: 'Create an app' })
5252
@Post('/:pipeline/:phase/:app')
53+
@UseGuards(JwtAuthGuard)
54+
@UseGuards(ReadonlyGuard)
5355
@HttpCode(HttpStatus.CREATED)
56+
@ApiOperation({ summary: 'Create an app' })
5457
@ApiForbiddenResponse({
5558
description: 'Error: Unauthorized',
5659
type: OKDTO,
5760
isArray: false,
5861
})
59-
@UseGuards(JwtAuthGuard)
6062
@ApiBearerAuth('bearerAuth')
6163
async createApp(
6264
@Param('pipeline') pipeline: string,
@@ -90,14 +92,15 @@ export class AppsController {
9092
return this.appsService.createApp(app, user);
9193
}
9294

93-
@ApiOperation({ summary: 'Update an app' })
9495
@Put('/:pipeline/:phase/:app/:resourceVersion')
96+
@UseGuards(JwtAuthGuard)
97+
@UseGuards(ReadonlyGuard)
98+
@ApiOperation({ summary: 'Update an app' })
9599
@ApiForbiddenResponse({
96100
description: 'Error: Unauthorized',
97101
type: OKDTO,
98102
isArray: false,
99103
})
100-
@UseGuards(JwtAuthGuard)
101104
@ApiBearerAuth('bearerAuth')
102105
async updateApp(
103106
@Param('pipeline') pipeline: string,
@@ -123,14 +126,15 @@ export class AppsController {
123126
return this.appsService.updateApp(app, resourceVersion, user);
124127
}
125128

126-
@ApiOperation({ summary: 'Delete an app' })
127129
@Delete('/:pipeline/:phase/:app')
130+
@UseGuards(JwtAuthGuard)
131+
@UseGuards(ReadonlyGuard)
132+
@ApiOperation({ summary: 'Delete an app' })
128133
@ApiForbiddenResponse({
129134
description: 'Error: Unauthorized',
130135
type: OKDTO,
131136
isArray: false,
132137
})
133-
@UseGuards(JwtAuthGuard)
134138
@ApiBearerAuth('bearerAuth')
135139
async deleteApp(
136140
@Param('pipeline') pipeline: string,
@@ -147,14 +151,15 @@ export class AppsController {
147151
return this.appsService.deleteApp(pipeline, phase, app, user);
148152
}
149153

150-
@ApiOperation({ summary: 'Start a Pull Request App' })
151154
@Post('/pullrequest')
155+
@UseGuards(JwtAuthGuard)
156+
@UseGuards(ReadonlyGuard)
157+
@ApiOperation({ summary: 'Start a Pull Request App' })
152158
@ApiForbiddenResponse({
153159
description: 'Error: Unauthorized',
154160
type: OKDTO,
155161
isArray: false,
156162
})
157-
@UseGuards(JwtAuthGuard)
158163
@ApiBearerAuth('bearerAuth')
159164
async startPullRequest(@Body() body: any) {
160165
return this.appsService.createPRApp(
@@ -165,14 +170,14 @@ export class AppsController {
165170
);
166171
}
167172

168-
@ApiOperation({ summary: 'Download the app templates' })
169173
@Get('/:pipeline/:phase/:app/download')
174+
@UseGuards(JwtAuthGuard)
175+
@ApiOperation({ summary: 'Download the app templates' })
170176
@ApiForbiddenResponse({
171177
description: 'Error: Unauthorized',
172178
type: OKDTO,
173179
isArray: false,
174180
})
175-
@UseGuards(JwtAuthGuard)
176181
@ApiBearerAuth('bearerAuth')
177182
async downloadAppTemplates(
178183
@Param('pipeline') pipeline: string,
@@ -182,14 +187,15 @@ export class AppsController {
182187
return this.appsService.getTemplate(pipeline, phase, app);
183188
}
184189

185-
@ApiOperation({ summary: 'Restart/Reload an app' })
186190
@Get('/:pipeline/:phase/:app/restart')
191+
@UseGuards(JwtAuthGuard)
192+
@UseGuards(ReadonlyGuard)
193+
@ApiOperation({ summary: 'Restart/Reload an app' })
187194
@ApiForbiddenResponse({
188195
description: 'Error: Unauthorized',
189196
type: OKDTO,
190197
isArray: false,
191198
})
192-
@UseGuards(JwtAuthGuard)
193199
@ApiBearerAuth('bearerAuth')
194200
async restartApp(
195201
@Param('pipeline') pipeline: string,
@@ -207,14 +213,14 @@ export class AppsController {
207213
return this.appsService.restartApp(pipeline, phase, app, user);
208214
}
209215

210-
@ApiOperation({ summary: 'Get the app pods' })
211216
@Get('/:pipeline/:phase/:app/pods')
217+
@UseGuards(JwtAuthGuard)
218+
@ApiOperation({ summary: 'Get the app pods' })
212219
@ApiForbiddenResponse({
213220
description: 'Error: Unauthorized',
214221
type: OKDTO,
215222
isArray: false,
216223
})
217-
@UseGuards(JwtAuthGuard)
218224
@ApiBearerAuth('bearerAuth')
219225
async getPods(
220226
@Param('pipeline') pipeline: string,
@@ -224,14 +230,15 @@ export class AppsController {
224230
return this.appsService.getPods(pipeline, phase, app);
225231
}
226232

227-
@ApiOperation({ summary: 'Start a container console' })
228233
@Post('/:pipeline/:phase/:app/console')
234+
@UseGuards(JwtAuthGuard)
235+
@UseGuards(ReadonlyGuard)
236+
@ApiOperation({ summary: 'Start a container console' })
229237
@ApiForbiddenResponse({
230238
description: 'Error: Unauthorized',
231239
type: OKDTO,
232240
isArray: false,
233241
})
234-
@UseGuards(JwtAuthGuard)
235242
@ApiBearerAuth('bearerAuth')
236243
async execInContainer(
237244
@Param('pipeline') pipeline: string,

‎server/src/audit/audit.controller.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import {
1313
ApiForbiddenResponse,
1414
ApiOperation,
1515
} from '@nestjs/swagger';
16-
import { OKDTO } from '../shared/dto/ok.dto';
16+
import { OKDTO } from '../common/dto/ok.dto';
1717
import { JwtAuthGuard } from '../auth/strategies/jwt.guard';
1818

1919
@Controller({ path: 'api/audit', version: '1' })

‎server/src/auth/auth.controller.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ import {
2222
LoginDTO,
2323
GetSessionDTO,
2424
} from './auth.dto';
25-
import { OKDTO } from '../shared/dto/ok.dto';
25+
import { OKDTO } from '../common/dto/ok.dto';
2626
import { JwtAuthGuard } from './strategies/jwt.guard';
2727
import { AuthGuard } from '@nestjs/passport';
2828

‎server/src/shared/dto/ok.dto.ts renamed to ‎server/src/common/dto/ok.dto.ts

File renamed without changes.

‎server/src/common/guards/readonly.guard.ts

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
import { CanActivate, ExecutionContext, Injectable, HttpException, Logger } from '@nestjs/common';
2+
3+
@Injectable()
4+
export class ReadonlyGuard implements CanActivate {
5+
private logger = new Logger(ReadonlyGuard.name);
6+
canActivate(context: ExecutionContext): boolean {
7+
if (process.env.KUBERO_READONLY === 'true') {
8+
this.logger.warn('Kubero is in read-only mode, write operations are blocked');
9+
throw new HttpException('Kubero is in read-only mode', 202);
10+
}
11+
return true;
12+
}
13+
}

‎server/src/config/config.controller.ts

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,9 @@ import {
88
ApiOperation,
99
ApiParam,
1010
} from '@nestjs/swagger';
11-
import { OKDTO } from '../shared/dto/ok.dto';
11+
import { OKDTO } from '../common/dto/ok.dto';
1212
import { JwtAuthGuard } from '../auth/strategies/jwt.guard';
13+
import { ReadonlyGuard } from '../common/guards/readonly.guard';
1314

1415
@Controller({ path: 'api/config', version: '1' })
1516
export class ConfigController {
@@ -30,6 +31,7 @@ export class ConfigController {
3031

3132
@Post('/')
3233
@UseGuards(JwtAuthGuard)
34+
@UseGuards(ReadonlyGuard)
3335
@ApiBearerAuth('bearerAuth')
3436
@ApiOperation({ summary: 'Update the Kubero settings' })
3537
@ApiForbiddenResponse({
@@ -143,6 +145,7 @@ export class ConfigController {
143145

144146
@Post('/setup/kubeconfig/validate')
145147
@UseGuards(JwtAuthGuard)
148+
@UseGuards(ReadonlyGuard)
146149
@ApiBearerAuth('bearerAuth')
147150
@ApiForbiddenResponse({
148151
description: 'Error: Unauthorized',
@@ -178,6 +181,7 @@ export class ConfigController {
178181

179182
@Post('/setup/save')
180183
@UseGuards(JwtAuthGuard)
184+
@UseGuards(ReadonlyGuard)
181185
@ApiBearerAuth('bearerAuth')
182186
@ApiForbiddenResponse({
183187
description: 'Error: Unauthorized',

‎server/src/deployments/deployments.controller.ts

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,20 +18,21 @@ import {
1818
} from '@nestjs/swagger';
1919
import { IUser } from '../auth/auth.interface';
2020
import { CreateBuild } from './dto/CreateBuild.dto';
21-
import { OKDTO } from '../shared/dto/ok.dto';
21+
import { OKDTO } from '../common/dto/ok.dto';
2222
import { JwtAuthGuard } from '../auth/strategies/jwt.guard';
23+
import { ReadonlyGuard } from '../common/guards/readonly.guard';
2324

2425
@Controller({ path: 'api/deployments', version: '1' })
2526
export class DeploymentsController {
2627
constructor(private readonly deploymentsService: DeploymentsService) {}
2728

2829
@Get('/:pipeline/:phase/:app')
30+
@UseGuards(JwtAuthGuard)
2931
@ApiForbiddenResponse({
3032
description: 'Error: Unauthorized',
3133
type: OKDTO,
3234
isArray: false,
3335
})
34-
@UseGuards(JwtAuthGuard)
3536
@ApiBearerAuth('bearerAuth')
3637
@ApiOperation({ summary: 'List deployments for a specific app' })
3738
@ApiParam({ name: 'pipeline', description: 'Pipeline name' })
@@ -46,12 +47,13 @@ export class DeploymentsController {
4647
}
4748

4849
@Post('/build/:pipeline/:phase/:app')
50+
@UseGuards(JwtAuthGuard)
51+
@UseGuards(ReadonlyGuard)
4952
@ApiForbiddenResponse({
5053
description: 'Error: Unauthorized',
5154
type: OKDTO,
5255
isArray: false,
5356
})
54-
@UseGuards(JwtAuthGuard)
5557
@ApiBearerAuth('bearerAuth')
5658
@ApiOperation({ summary: 'Build a specific app' })
5759
@ApiParam({ name: 'pipeline', description: 'Pipeline name' })
@@ -89,6 +91,7 @@ export class DeploymentsController {
8991

9092
@Delete('/:pipeline/:phase/:app/:buildName')
9193
@UseGuards(JwtAuthGuard)
94+
@UseGuards(ReadonlyGuard)
9295
@ApiBearerAuth('bearerAuth')
9396
@ApiForbiddenResponse({
9497
description: 'Error: Unauthorized',
@@ -154,6 +157,7 @@ export class DeploymentsController {
154157

155158
@Put('/:pipeline/:phase/:app/:tag')
156159
@UseGuards(JwtAuthGuard)
160+
@UseGuards(ReadonlyGuard)
157161
@ApiBearerAuth('bearerAuth')
158162
@ApiForbiddenResponse({
159163
description: 'Error: Unauthorized',

‎server/src/kubernetes/kubernetes.controller.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import {
1212
ContextDTO,
1313
GetEventsDTO,
1414
} from './dto/kubernetes.dto';
15-
import { OKDTO } from '../shared/dto/ok.dto';
15+
import { OKDTO } from '../common/dto/ok.dto';
1616
import { JwtAuthGuard } from '../auth/strategies/jwt.guard';
1717

1818
@Controller({ path: 'api/kubernetes', version: '1' })
@@ -79,12 +79,12 @@ export class KubernetesController {
7979
}
8080

8181
@Get('/contexts')
82+
@UseGuards(JwtAuthGuard)
8283
@ApiForbiddenResponse({
8384
description: 'Error: Unauthorized',
8485
type: OKDTO,
8586
isArray: false,
8687
})
87-
@UseGuards(JwtAuthGuard)
8888
@ApiBearerAuth('bearerAuth')
8989
@ApiOkResponse({
9090
description: 'A List of available contexts',

‎server/src/logs/logs.controller.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import {
77
} from '@nestjs/swagger';
88
import { LogsService } from './logs.service';
99
import { JwtAuthGuard } from '../auth/strategies/jwt.guard';
10-
import { OKDTO } from '../shared/dto/ok.dto';
10+
import { OKDTO } from '../common/dto/ok.dto';
1111

1212
@Controller({ path: 'api/logs', version: '1' })
1313
export class LogsController {

0 commit comments

Comments
 (0)