mgr/dashboard: exclude user scope from read-only system role

Read-only users could see the Settings icon but were denied access
to user management pages. Remove user read permission from the
read-only role so the administration menu stays hidden.

Fixes: https://tracker.ceph.com/issues/77952
Signed-off-by: Abhishek Desai <adesai@redhat.com>

diff --git a/src/pybind/mgr/dashboard/services/access_control.py b/src/pybind/mgr/dashboard/services/access_control.py
index 392b3ab799960689672390e0d6d6a2d317926eef..81b0995a1e997f04a91542fb5854bcb99766725b 100644 (file)
--- a/src/pybind/mgr/dashboard/services/access_control.py
+++ b/src/pybind/mgr/dashboard/services/access_control.py
@@ -218,9 +218,9 @@ ADMIN_ROLE = Role(
 # read-only role provides read-only permission for all scopes
 READ_ONLY_ROLE = Role(
     'read-only',
-    'allows read permission for all security scope except dashboard settings and config-opt', {
+    'allows read permission for all security scope except user, dashboard settings and config-opt', {
         scope_name: [_P.READ] for scope_name in Scope.all_scopes()
-        if scope_name not in (Scope.DASHBOARD_SETTINGS, Scope.CONFIG_OPT)
+        if scope_name not in (Scope.USER, Scope.DASHBOARD_SETTINGS, Scope.CONFIG_OPT)
     })
 
 

diff --git a/src/pybind/mgr/dashboard/tests/test_access_control.py b/src/pybind/mgr/dashboard/tests/test_access_control.py
index a5f425e6db351440c0d48b5eb38c2142e4f39410..bd68733c1e37889967595f017831411355736177 100644 (file)
--- a/src/pybind/mgr/dashboard/tests/test_access_control.py
+++ b/src/pybind/mgr/dashboard/tests/test_access_control.py
@@ -156,7 +156,7 @@ class AccessControlTest(unittest.TestCase, CLICommandTestMixin):
         self.assertEqual(role['name'], 'read-only')
         self.assertEqual(
             role['description'],
-            'allows read permission for all security scope except dashboard settings and config-opt'
+            'allows read permission for all security scope except user, dashboard settings and config-opt'
         )
 
     def test_delete_system_role(self):