Merge pull request #3595 from LinuxSuRen/fix-pipe-input-admin

Fix that devops admin users cannot approve a Pipeline input
2021-03-29 10:42:09 +08:00
parent 0f2ac8ae17 baa7ae4d69
commit 652c1a4c68
2 changed files with 4 additions and 1 deletions
--- a/pkg/apiserver/authorization/authorizer/interfaces.go
+++ b/pkg/apiserver/authorization/authorizer/interfaces.go
@@ -209,4 +209,6 @@ const (
 	VerbGet = "get"
 	// VerbWatch represents the verb of watching a resource
 	VerbWatch = "watch"
+	// VerbDelete represents the verb of deleting a resource
+	VerbDelete = "delete"
 )
--- a/pkg/kapis/devops/v1alpha2/devops.go
+++ b/pkg/kapis/devops/v1alpha2/devops.go
@@ -307,8 +307,9 @@ func (h *ProjectPipelineHandler) approvableCheck(nodes []clientDevOps.NodesDetai
 	if userInfo, ok = request.UserFrom(pipe.Context); ok {
 		createAuth := authorizer.AttributesRecord{
 			User:            userInfo,
-			Verb:            authorizer.VerbCreate,
+			Verb:            authorizer.VerbDelete,
 			Workspace:       pipe.Workspace,
+			DevOps:          pipe.ProjectName,
 			Resource:        "devopsprojects",
 			ResourceRequest: true,
 			ResourceScope:   request.DevOpsScope,