Replace admin check with check for access (#297)

Signed-off-by: Adam Malcontenti-Wilson <adman.com@gmail.com>

dashboard/client/components/+storage/storage.tsx

@@ -20,7 +20,7 @@ interface Props extends RouteComponentProps<{}> {
 export class Storage extends React.Component<Props> {
   static get tabRoutes() {
     const tabRoutes: TabRoute[] = [];
-    const { isClusterAdmin } = configStore;
+    const { allowedResources } = configStore;
     const query = namespaceStore.getContextParams()
 
     tabRoutes.push({
@@ -30,7 +30,7 @@ export class Storage extends React.Component<Props> {
       path: volumeClaimsRoute.path,
     })
 
-    if (isClusterAdmin) {
+    if (allowedResources.includes('persistentvolumes')) {
       tabRoutes.push({
         title: <Trans>Persistent Volumes</Trans>,
         component: PersistentVolumes,
@@ -39,7 +39,7 @@ export class Storage extends React.Component<Props> {
       });
     }
 
-    if (isClusterAdmin) {
+    if (allowedResources.includes('storageclasses')) {
       tabRoutes.push({
         title: <Trans>Storage Classes</Trans>,
         component: StorageClasses,

dashboard/client/components/+user-management/user-management.tsx

@@ -21,7 +21,7 @@ interface Props extends RouteComponentProps<{}> {
 export class UserManagement extends React.Component<Props> {
   static get tabRoutes() {
     const tabRoutes: TabRoute[] = [];
-    const { isClusterAdmin } = configStore;
+    const { allowedResources } = configStore;
     const query = namespaceStore.getContextParams()
     tabRoutes.push(
       {
@@ -43,7 +43,7 @@ export class UserManagement extends React.Component<Props> {
         path: rolesRoute.path,
       },
     )
-    if (isClusterAdmin) {
+    if (allowedResources.includes("podsecuritypolicies")) {
       tabRoutes.push({
         title: <Trans>Pod Security Policies</Trans>,
         component: PodSecurityPolicies,

dashboard/client/components/app.tsx

@@ -46,7 +46,7 @@ class App extends React.Component {
   };
 
   render() {
-    const homeUrl = configStore.isClusterAdmin ? clusterURL() : workloadsURL();
+    const homeUrl = clusterURL();
     return (
       <I18nProvider i18n={_i18n}>
         <Router history={browserHistory}>

dashboard/client/components/layout/sidebar.tsx

@@ -71,7 +71,7 @@ export class Sidebar extends React.Component<Props> {
 
   render() {
     const { toggle, isPinned, className } = this.props;
-    const { isClusterAdmin } = configStore;
+    const { isClusterAdmin, allowedResources } = configStore;
     const query = namespaceStore.getContextParams();
     return (
       <SidebarContext.Provider value={{ pinned: isPinned }}>
@@ -91,14 +91,13 @@ export class Sidebar extends React.Component<Props> {
           <div className="sidebar-nav flex column box grow-fixed">
             <SidebarNavItem
               id="cluster"
-              isHidden={!isClusterAdmin}
               url={clusterURL()}
               text={<Trans>Cluster</Trans>}
               icon={<Icon svg="kube"/>}
             />
             <SidebarNavItem
               id="nodes"
-              isHidden={!isClusterAdmin}
+              isHidden={!allowedResources.includes('nodes')}
               url={nodesURL()}
               text={<Trans>Nodes</Trans>}
               icon={<Icon svg="nodes"/>}
@@ -166,7 +165,7 @@ export class Sidebar extends React.Component<Props> {
             />
             <SidebarNavItem
               id="custom-resources"
-              isHidden={!isClusterAdmin}
+              isHidden={!allowedResources.includes('customresourcedefinitions')}
               url={crdURL()}
               subMenus={CustomResources.tabRoutes}
               routePath={crdRoute.path}

dashboard/client/config.store.ts

@@ -45,6 +45,10 @@ export class ConfigStore {
     return this.config.allowedNamespaces || [];
   }
 
+  get allowedResources() {
+    return this.config.allowedResources;
+  }
+
   get isClusterAdmin() {
     return this.config.isClusterAdmin;
   }

dashboard/client/kube-object.store.ts

@@ -57,18 +57,15 @@ export abstract class KubeObjectStore<T extends KubeObject = any> extends ItemSt
     }
   }
 
-  protected async loadItems(namespaces?: string[]): Promise<T[]> {
-    if (!configStore.isClusterAdmin && !this.api.isNamespaced) {
-      return []
-    }
-    if (!namespaces) {
+  protected async loadItems(allowedNamespaces?: string[]): Promise<T[]> {
+    if (!this.api.isNamespaced || !allowedNamespaces) {
       const { limit } = this;
       const query: IKubeApiQueryParams = limit ? { limit } : {};
       return this.api.list({}, query);
     }
     else {
       return Promise
-        .all(namespaces.map(namespace => this.api.list({ namespace })))
+        .all(allowedNamespaces.map(namespace => this.api.list({ namespace })))
         .then(items => items.flat())
     }
   }
@@ -155,7 +152,6 @@ export abstract class KubeObjectStore<T extends KubeObject = any> extends ItemSt
   }
 
   subscribe(apis = [this.api]) {
-    apis = apis.filter(api => !configStore.isClusterAdmin ? api.isNamespaced : true);
     return KubeApi.watchAll(...apis);
   }