mgr/dashboard: restricting admin user to revoke its own admin permissions

Fixes: https://tracker.ceph.com/issues/77813
Signed-off-by: Devika Babrekar <devika.babrekar@ibm.com>
Conflicts:
	src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
-conflict while rebasing for SSO related parameters
	src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
-conflict while rebasing for SSO related variables

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form-role.model.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form-role.model.ts
index abf529196f62855c4b56316309bbf004929f37fb..fd56ec957f61a4f0bdeb573883419f387633d4fb 100644 (file)
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form-role.model.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form-role.model.ts
@@ -4,6 +4,7 @@ export class UserFormRoleModel implements SelectOption {
   name: string;
   description: string;
   selected = false;
+  disabled: boolean = false;
   scopes_permissions?: object;
   enabled: boolean;
   content: string;

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
index 409b84d1f9aaa99167aaedfa46af8bc5f7dc653e..bdfe497b9dda6de3554da6a52079d4bd14d8ce40 100644 (file)
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.html
@@ -235,15 +235,37 @@
           [invalidText]="rolesError"
           i18n
         >
-          <cds-dropdown-list></cds-dropdown-list>
+          <cds-dropdown-list [listTpl]="roleItemTpl"></cds-dropdown-list>
         </cds-combo-box>
+
         <ng-template #rolesError>
           <span
             class="invalid-feedback"
             *ngIf="userForm.showError('roles', formDir, 'required')"
             i18n
-            >This field is required.</span
-          >
+            >This field is required.</span>
+        </ng-template>        
+        
+        <ng-template #roleItemTpl
+                    let-item="item">
+          <div class="cds--form-item cds--checkbox-wrapper">
+            <label class="cds--checkbox-label"
+                  [attr.data-contained-checkbox-disabled]="item.disabled ? 'true' : null"
+                  [attr.data-contained-checkbox-state]="item.selected ? 'true' : 'false'"
+                  [ngbTooltip]="item.disabled ? roleTooltipTpl : null">
+              <input class="cds--checkbox"
+                    type="checkbox"
+                    [checked]="item.selected"
+                    [disabled]="item.disabled"
+                    tabindex="-1"/>
+              <span class="cds--checkbox-appearance"></span>
+              <span class="cds--checkbox-label-text">{{ item.content }}</span>
+            </label>
+          </div>
+        </ng-template>
+
+        <ng-template #roleTooltipTpl>
+          <span i18n>You cannot remove the administrator role from your own account.</span>
         </ng-template>
       </div>
       <!-- Enabled -->

diff --git a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
index 2f33440f2e98a9654662e7fde8c9fdcefe00ef20..f994c0b4d2e2c20e5803de87b9cdd2777a725bd6 100644 (file)
--- a/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
+++ b/src/pybind/mgr/dashboard/frontend/src/app/core/auth/user-form/user-form.component.ts
@@ -180,6 +180,13 @@ export class UserFormComponent extends CdForm implements OnInit {
       this.userService.get(username).subscribe((userFormModel: UserFormModel) => {
         this.response = _.cloneDeep(userFormModel);
         this.setResponse(userFormModel);
+        if (this.authStorageService.getUsername() === username) {
+          this.allRoles = _.map(this.allRoles, (role) => {
+            role.disabled =
+              role.name.toLowerCase() === 'administrator' && this.isCurrentUser() ? true : false;
+            return role;
+          });
+        }
         this.loadingReady();
       });
     });