Merge pull request ManageIQ#22779 from Fryguy/fix_my_settings

Add my_settings_view product feature for the My Settings page

app/models/miq_group.rb

@@ -62,10 +62,16 @@ def settings=(new_settings)
  super(indifferent_settings)
  end
 
- def self.with_roles_excluding(identifier)
- where.not(:id => MiqGroup.unscope(:select).joins(:miq_product_features)
- .where(:miq_product_features => {:identifier => identifier})
- .select(:id))
+ def self.with_roles_excluding(identifier, allowed_ids: nil)
+ scope = where.not(
+ :id => MiqGroup
+ .unscope(:select)
+ .joins(:miq_product_features)
+ .where(:miq_product_features => {:identifier => identifier})
+ .select(:id)
+ )
+ scope = scope.or(where(:id => allowed_ids)) if allowed_ids.present?
+ scope
  end
 
  def self.next_sequence

app/models/miq_user_role.rb

@@ -65,10 +65,16 @@ def limited_self_service?(klass = nil)
  (settings || {}).fetch_path(:restrictions, restriction_type(klass)) == :user
  end
 
- def self.with_roles_excluding(identifier)
- where.not(:id => MiqUserRole.unscope(:select).joins(:miq_product_features)
- .where(:miq_product_features => {:identifier => identifier})
- .select(:id))
+ def self.with_roles_excluding(identifier, allowed_ids: nil)
+ scope = where.not(
+ :id => MiqUserRole
+ .unscope(:select)
+ .joins(:miq_product_features)
+ .where(:miq_product_features => {:identifier => identifier})
+ .select(:id)
+ )
+ scope = scope.or(where(:id => allowed_ids)) if allowed_ids.present?
+ scope
  end
 
  def self.seed

app/models/user.rb

@@ -61,10 +61,16 @@ class User < ApplicationRecord
 
  scope :in_all_regions, ->(id) { where(:userid => User.default_scoped.where(:id => id).select(:userid)) }
 
- def self.with_roles_excluding(identifier)
- where.not(:id => User.unscope(:select).joins(:miq_groups => :miq_product_features)
- .where(:miq_product_features => {:identifier => identifier})
- .select(:id))
+ def self.with_roles_excluding(identifier, allowed_ids: nil)
+ scope = where.not(
+ :id => User
+ .unscope(:select)
+ .joins(:miq_groups => :miq_product_features)
+ .where(:miq_product_features => {:identifier => identifier})
+ .select(:id)
+ )
+ scope = scope.or(where(:id => allowed_ids)) if allowed_ids.present?
+ scope
  end
 
  def self.scope_by_tenant?

db/fixtures/miq_product_features.yml

@@ -2815,6 +2815,10 @@
  :feature_type: node
  :identifier: my_settings
  :children:
+ - :name: View
+ :description: View My Settings
+ :feature_type: view
+ :identifier: my_settings_view
  - :name: Modify
  :description: Modify My Settings
  :feature_type: admin

db/fixtures/miq_user_roles.yml

@@ -132,6 +132,7 @@
  - host_initiator
  - host_initiator_group
  - miq_task_my_ui
+ - my_settings_view
  - my_settings_default_views
  - my_settings_time_profiles
  - my_settings_visuals
@@ -232,6 +233,7 @@
  - host_perf
  - host_tag
  - host_timeline
+ - my_settings_view
  - my_settings_default_views
  - my_settings_time_profiles
  - my_settings_visuals
@@ -334,6 +336,7 @@
  - host_check_compliance
  - host_tag
  - miq_task_my_ui
+ - my_settings_view
  - my_settings_default_views
  - my_settings_time_profiles
  - my_settings_visuals
@@ -419,6 +422,7 @@
  - miq_template_show
  - miq_template_show_list
  - miq_template_timeline
+ - my_settings_view
  - my_settings_default_views
  - my_settings_time_profiles
  - my_settings_visuals
@@ -526,6 +530,7 @@
  - host_perf
  - host_tag
  - host_timeline
+ - my_settings_view
  - my_settings_default_views
  - my_settings_time_profiles
  - my_settings_visuals
@@ -621,6 +626,7 @@
  - host_perf
  - host_tag
  - host_timeline
+ - my_settings_view
  - my_settings_default_views
  - my_settings_time_profiles
  - my_settings_visuals
@@ -707,6 +713,7 @@
  - host_tag
  - host_timeline
  - miq_task_my_ui
+ - my_settings_view
  - my_settings_default_views
  - my_settings_time_profiles
  - my_settings_visuals
@@ -795,6 +802,7 @@
  - host_tag
  - host_timeline
  - miq_task_my_ui
+ - my_settings_view
  - my_settings_default_views
  - my_settings_time_profiles
  - my_settings_visuals
@@ -900,6 +908,7 @@
  - miq_request_admin
  - miq_request_view
  - miq_task_my_ui
+ - my_settings_view
  - my_settings_default_views
  - my_settings_time_profiles
  - my_settings_visuals
@@ -956,6 +965,7 @@
  - miq_request_admin
  - miq_request_view
  - miq_task_my_ui
+ - my_settings_view
  - my_settings_default_views
  - my_settings_visuals
  - service_edit
@@ -1053,6 +1063,7 @@
  - host_initiator_group_show_list
  - host_initiator_group_edit
  - miq_task_my_ui
+ - my_settings_view
  - my_settings_default_views
  - my_settings_time_profiles
  - my_settings_visuals
@@ -1159,6 +1170,7 @@
  - miq_template_snapshot
  - miq_template_tag
  - miq_template_timeline
+ - my_settings_view
  - my_settings_default_views
  - my_settings_visuals
  - miq_request_admin
@@ -1222,6 +1234,7 @@
  - miq_template_snapshot
  - miq_template_tag
  - miq_template_timeline
+ - my_settings_view
  - my_settings_default_views
  - my_settings_visuals
  - vm_check_compliance
@@ -1394,6 +1407,7 @@
  - dashboard
  - chargeback
  - miq_report
+ - my_settings_view
 
 - :name: EvmRole-container_administrator
  :read_only: true

lib/rbac/filterer.rb

@@ -638,17 +638,35 @@ def scope_to_cloud_tenant(scope, user, miq_group)
  def scope_for_user_role_group(klass, scope, miq_group, user, managed_filters)
  user_or_group = miq_group || user
 
- if user_or_group.try!(:self_service?) && MiqUserRole != klass
+ if user_or_group.try!(:self_service?) && klass != MiqUserRole
  scope.where(:id => klass == User ? user.id : miq_group.id)
  else
  role = user_or_group.miq_user_role
- # hide creating admin group / roles from non-super administrators
+
+ # Exclude users/groups/roles tied to the super admin user if the current user isn't also
+ # a super admin user. This prevents a tenant admin from creating a super admin and then
+ # escalating privileges.
  unless role&.super_admin_user?
- scope = scope.with_roles_excluding(MiqProductFeature::SUPER_ADMIN_FEATURE)
+ # In the case that the user is not currently in a super admin group, but can _become_
+ # a super admin by virtue of being in multiple groups, then they will be filtered by
+ # with_roles_excluding. The allowed_ids option ensures the user can still see themselves.
+ #
+ # TODO: Determine if this same logic should apply to MiqUserRole as well
+ with_roles_excluding_options =
+ if klass == User
+ {:allowed_ids => user.id}
+ elsif klass == MiqGroup
+ {:allowed_ids => miq_group.id}
+ else
+ {}
+ end
+
+ scope = scope.with_roles_excluding(MiqProductFeature::SUPER_ADMIN_FEATURE, **with_roles_excluding_options)
  end
 
- if MiqUserRole != klass
+ if klass != MiqUserRole
  filtered_ids = pluck_ids(get_managed_filter_object_ids(scope, managed_filters))
+
  # Non tenant admins can only see their own groups. Note - a super admin is also a tenant admin
  scope = scope.with_groups(user.miq_group_ids) unless role&.tenant_admin_user?
  end