diff --git a/pkg/apiserver/authorization/authorizer/interfaces.go b/pkg/apiserver/authorization/authorizer/interfaces.go index 181b9cb5c..7756d3c5c 100644 --- a/pkg/apiserver/authorization/authorizer/interfaces.go +++ b/pkg/apiserver/authorization/authorizer/interfaces.go @@ -209,4 +209,6 @@ const ( VerbGet = "get" // VerbWatch represents the verb of watching a resource VerbWatch = "watch" + // VerbDelete represents the verb of deleting a resource + VerbDelete = "delete" ) diff --git a/pkg/kapis/devops/v1alpha2/devops.go b/pkg/kapis/devops/v1alpha2/devops.go index d5de97d38..4e8bb15b3 100644 --- a/pkg/kapis/devops/v1alpha2/devops.go +++ b/pkg/kapis/devops/v1alpha2/devops.go @@ -307,8 +307,9 @@ func (h *ProjectPipelineHandler) approvableCheck(nodes []clientDevOps.NodesDetai if userInfo, ok = request.UserFrom(pipe.Context); ok { createAuth := authorizer.AttributesRecord{ User: userInfo, - Verb: authorizer.VerbCreate, + Verb: authorizer.VerbDelete, Workspace: pipe.Workspace, + DevOps: pipe.ProjectName, Resource: "devopsprojects", ResourceRequest: true, ResourceScope: request.DevOpsScope,