EVEREST-1096 | remove the hard-coded resource map for enforcer RBAC

api/everest.go

@@ -209,8 +209,12 @@ func (e *EverestServer) rbacMiddleware(ctx context.Context, basePath string) (ec
 	}
 	e.rbacEnforcer = enforcer
 
+	skipper, err := rbac.NewSkipper(basePath)
+	if err != nil {
+		return nil, errors.Join(err, errors.New("could not create RBAC skipper"))
+	}
 	return casbinmiddleware.MiddlewareWithConfig(casbinmiddleware.Config{
-		Skipper:        rbac.Skipper,
+		Skipper:        skipper,
 		UserGetter:     rbac.GetUser,
 		EnforceHandler: rbac.NewEnforceHandler(basePath, enforcer),
 	}), nil

api/rbac/rbac.go

@@ -32,6 +32,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 
 	configmapadapter "github.com/percona/everest/api/rbac/configmap-adapter"
+	everestclient "github.com/percona/everest/client"
 	"github.com/percona/everest/data"
 	"github.com/percona/everest/pkg/common"
 	"github.com/percona/everest/pkg/kubernetes"
@@ -121,27 +122,43 @@ func GetUser(c echo.Context) (string, error) {
 	return subject, nil
 }
 
+// buildPathResourceMap builds a map of paths to resources and a list of resources.
+// Returns: (resourceMap, skipPaths, error) .
+func buildPathResourceMap(basePath string) (map[string]string, []string, error) {
+	swg, err := everestclient.GetSwagger()
+	if err != nil {
+		return nil, nil, errors.Join(err, errors.New("failed to get swagger"))
+	}
+
+	// parseEndpoint replaces the curly braces in the endpoint with colons.
+	// example: '/{namespace}/clusters' -> '/:namespace/clusters'
+	parseEndpoint := func(ep string) string {
+		parsed := strings.ReplaceAll(ep, "{", ":")
+		parsed = strings.ReplaceAll(parsed, "}", "")
+		return basePath + parsed
+	}
+
+	resourceMap := make(map[string]string)
+	skipPaths := []string{}
+	for path, pathItem := range swg.Paths.Map() {
+		parsedPath := parseEndpoint(path)
+		if val, ok := pathItem.Extensions[common.EverestAPIExtnResourceName]; ok {
+			if resourceName, ok := val.(string); ok {
+				resourceMap[parsedPath] = resourceName
+			}
+			continue
+		}
+		skipPaths = append(skipPaths, parsedPath)
+	}
+	return resourceMap, skipPaths, nil
+}
+
 // NewEnforceHandler returns a function that checks if a user is allowed to access a resource.
 func NewEnforceHandler(basePath string, enforcer *casbin.Enforcer) func(c echo.Context, user string) (bool, error) {
 	return func(c echo.Context, user string) (bool, error) {
-		pathResourceMap := map[string]string{
-			basePath + "/backup-storages":                                           "backup-storages",
-			basePath + "/backup-storages/:name":                                     "backup-storages",
-			basePath + "/monitoring-instances":                                      "monitoring-instances",
-			basePath + "/monitoring-instances/:name":                                "monitoring-instances",
-			basePath + "/namespaces/:namespace/database-engines":                    "database-engines",
-			basePath + "/namespaces/:namespace/database-engines/:name":              "database-engines",
-			basePath + "/namespaces/:namespace/database-clusters":                   "database-clusters",
-			basePath + "/namespaces/:namespace/database-clusters/:name":             "database-clusters",
-			basePath + "/namespaces/:namespace/database-clusters/:name/backups":     "database-clusters",
-			basePath + "/namespaces/:namespace/database-clusters/:name/credentials": "database-clusters",
-			basePath + "/namespaces/:namespace/database-clusters/:name/pitr":        "database-clusters",
-			basePath + "/namespaces/:namespace/database-clusters/:name/restores":    "database-clusters",
-			basePath + "/namespaces/:namespace/database-clusters/:name/components":  "database-clusters",
-			basePath + "/namespaces/:namespace/database-cluster-backups":            "database-cluster-backups",
-			basePath + "/namespaces/:namespace/database-cluster-backups/:name":      "database-cluster-backups",
-			basePath + "/namespaces/:namespace/database-cluster-restores":           "database-cluster-restores",
-			basePath + "/namespaces/:namespace/database-cluster-restores/:name":     "database-cluster-restores",
+		pathResourceMap, _, err := buildPathResourceMap(basePath)
+		if err != nil {
+			return false, errors.Join(err, errors.New("failed to build path resource map"))
 		}
 		actionMethodMap := map[string]string{
 			"GET":    "read",
@@ -176,17 +193,14 @@ func NewEnforceHandler(basePath string, enforcer *casbin.Enforcer) func(c echo.C
 	}
 }
 
-// Skipper is called by the RBAC middleware to decide if a path must be skipped from RBAC.
-func Skipper(c echo.Context) bool {
-	skipPaths := []string{
-		"/session",
-		"/version",
-		"/cluster-info",
-		"/resources",
-		"/namespaces",
-		"/settings",
-		"/permissions",
+// NewSkipper returns a new function that checks if a given request should be skipped
+// from RBAC checks.
+func NewSkipper(basePath string) (func(echo.Context) bool, error) {
+	_, skipPaths, err := buildPathResourceMap(basePath)
+	if err != nil {
+		return nil, err
 	}
-	path := strings.TrimPrefix(c.Request().URL.Path, "/v1")
-	return slices.Contains(skipPaths, path)
+	return func(c echo.Context) bool {
+		return slices.Contains(skipPaths, c.Request().URL.Path)
+	}, nil
 }