fix(api): getWorkerModelSecretHandler permission (#6141)

fsamin · web-flow · commit e80eb410f177 · 2022-04-07T09:35:55.000+02:00
Signed-off-by: francois  samin &lt;francois.samin@corp.ovh.com&gt;
diff --git a/engine/api/router_middleware_auth_permission.go b/engine/api/router_middleware_auth_permission.go
@@ -367,6 +367,10 @@ func (api *API) checkGroupPermissions(ctx context.Context, w http.ResponseWriter
 			}
 		}
 	} else {
+		// Hatcheries started for "shared.infra" group are granted for group "shared.infra"
+		if isHatcheryShared(ctx) {
+			return nil
+		}
 		if !isGroupMember(ctx, g) && !isMaintainer(ctx) { // Only group member or CDS maintainer can get a group or its dependencies
 			return sdk.WithStack(sdk.ErrForbidden)
 		}

Original file line number	Diff line number	Diff line change
`@@ -367,6 +367,10 @@ func (api *API) checkGroupPermissions(ctx context.Context, w http.ResponseWriter`
`367`	`367`	`}`
`368`	`368`	`}`
`369`	`369`	`} else {`
	`370`	`+ // Hatcheries started for "shared.infra" group are granted for group "shared.infra"`
	`371`	`+ if isHatcheryShared(ctx) {`
	`372`	`+ return nil`
	`373`	`+ }`
`370`	`374`	`if !isGroupMember(ctx, g) && !isMaintainer(ctx) { // Only group member or CDS maintainer can get a group or its dependencies`
`371`	`375`	`return sdk.WithStack(sdk.ErrForbidden)`
`372`	`376`	`}`