Add WorkerOwnerAuthz, WorkerEndpointMatcher, RolesFromWorkerOwner.

[slydiman]

Summary

Add WorkerOwnerAuthz, WorkerEndpointMatcher, RolesFromWorkerOwner.

[slydiman]

Updated the error message, removed the required role name (LLVM group name).

Added match_BuildRequestEndpoint_cancel().

The build request can be cancelled if the user is an owner of at least one worker associated with the builder.
Note Cancel whole queue on the page /#/builders will call /api/v2/buildrequests/<buildrequestid> for each build request and will stop if you have no rights for some builder. Use Cancel whole queue from the page /#/builders/<builderid> to be sure.
Note there is no any error message if you have no rights for Cancel whole queue. Probably we must create an issue for buildbot.

[gkistanova]

Thanks, Dmitry!
LGTM.

buildbot/osuosl/master/config/auth.py

 from buildbot.plugins import util
 #from twisted.python import log
 
+from zorg.buildbot.util.workerowner import WorkerOwnerAuthz
+from zorg.buildbot.util.workerowner import WorkerEndpointMatcher
+from zorg.buildbot.util.workerowner import RolesFromWorkerOwner
+
 import config
 
 
 def getAuth():
     # For test local setup use NoAuth instead.
     auth = util.GitHubAuth(
         clientId=str(config.options.get('GitHub Auth', 'clientId')),
         clientSecret=str(config.options.get('GitHub Auth', 'clientSecret')),
         apiVersion=4,
         getTeamsMembership=True,
         debug=False,
     )
     return auth
 
 
 def getAuthz():
 
-    authz = util.Authz(
+    authz = WorkerOwnerAuthz(
         allowRules=[
             # Admins can do anything.
             # defaultDeny=False: if user does not have the admin role,
             # we continue parsing rules.
             util.AnyEndpointMatcher(role="LLVM Lab team", defaultDeny=False),
 
+            WorkerEndpointMatcher(role="worker-owner", defaultDeny=False),
+
             # Allow authors to stop, force or rebuild their own builds,
             util.StopBuildEndpointMatcher(role="owner", defaultDeny=False),
             # Allow bot owners to stop, force or rebuild on their own bots,
             util.StopBuildEndpointMatcher(role="worker-owner"),
 
             # allow devs to force or rebuild any build.
             util.RebuildBuildEndpointMatcher(role="owner", defaultDeny=False),
             util.RebuildBuildEndpointMatcher(role="worker-owner", defaultDeny=False),
             util.RebuildBuildEndpointMatcher(role="LLVM Committers"),
 
             util.ForceBuildEndpointMatcher(role="owner", defaultDeny=False),
             util.ForceBuildEndpointMatcher(role="worker-owner", defaultDeny=False),
             util.ForceBuildEndpointMatcher(role="LLVM Committers"),
 
             # Future-proof control endpoints. No parsing rules beyond this.
 
             # Allows anonymous to look at build results.
             util.AnyControlEndpointMatcher(role="LLVM Lab team"),
         ],
         roleMatchers=[
             util.RolesFromGroups(groupPrefix="llvm/"),
             # role owner is granted when property owner matches the email of the user
             util.RolesFromOwner(role="owner"),
+            RolesFromWorkerOwner(role="worker-owner"),
         ],
     )
 
     return authz

zorg/buildbot/util/workerowner.py

+import re
+
+from twisted.internet import defer
+
+from buildbot.util import unicode2bytes
+
+from buildbot.www.authz.endpointmatchers import Match
+from buildbot.www.authz.endpointmatchers import EndpointMatcherBase
+from buildbot.www.authz.roles import RolesFromBase
+from buildbot.www.authz.authz import Forbidden
+from buildbot.www.authz.authz import Authz
+
+
+class WorkerOwnerMatch(Match):
+
+    def __init__(self, master, workers, **kwargs):
+        super().__init__(master, **kwargs)
+        self.workerOwners = []
+        for worker in workers:
+            if 'workerinfo' in worker:
+                workerinfo = worker['workerinfo']
+                if 'admin' in workerinfo:
+                    email = re.search('.*<(.*)>.*', workerinfo['admin'])
+                    if email:
+                        self.workerOwners.append(email.group(1))
+
+    def getWorkerOwners(self):
+        return self.workerOwners
+
+
+class WorkerEndpointMatcher(EndpointMatcherBase):
+
+    def __init__(self, **kwargs):
+        super().__init__(**kwargs)
+
+    @defer.inlineCallbacks
+    def match_WorkerEndpoint(self, epobject, epdict, options):
+        worker = yield epobject.get({}, epdict)
+        return WorkerOwnerMatch(self.master, [worker])
+
+    @defer.inlineCallbacks
+    def match_BuildRequestEndpoint_cancel(self, epobject, epdict, options):
+        buildrequest = yield epobject.get({}, epdict)
+        if 'builderid' in buildrequest:
+            workers = yield self.master.db.workers.getWorkers(builderid=buildrequest['builderid'])
+            if workers:
+                return WorkerOwnerMatch(self.master, workers)
+        return None
+
+
+class RolesFromWorkerOwner(RolesFromBase):
+
+    def __init__(self, role):
+        super().__init__()
+        self.role = role
+
+    def getRolesFromUser(self, userDetails, workerOwners):
+        if 'email' in userDetails:
+            if workerOwners and userDetails['email'] in workerOwners:
+                return [self.role]
+        return []
+
+
+class WorkerOwnerAuthz(Authz):
+
+    def __init__(self, roleMatchers=None, **kwargs):
+        super().__init__(roleMatchers=roleMatchers, **kwargs)
+        self.workerOwnerRoleMatchers = [
+            r for r in roleMatchers if isinstance(r, RolesFromWorkerOwner)]
+        self.roleMatchers = [  # Remove workerOwnerRoleMatchers from roleMatchers
+            r for r in self.roleMatchers if r not in self.workerOwnerRoleMatchers]
+
+    def setMaster(self, master):
+        super().setMaster(master)
+        for r in self.workerOwnerRoleMatchers:
+            r.setAuthz(self)
+
+    @defer.inlineCallbacks
+    def assertUserAllowed(self, ep, action, options, userDetails):
+        IsWorkerOwnerMatch = False
+        roles = self.getRolesFromUser(userDetails)
+        for rule in self.allowRules:
+            match = yield rule.match(ep, action, options)
+            if match is not None:
+                # only try to get owner if there are owner Matchers
+                if self.ownerRoleMatchers:
+                    owner = yield match.getOwner()
+                    if owner:
+                        for r in self.ownerRoleMatchers:
+                            roles.update(set(r.getRolesFromUser(userDetails, owner)))
+
+                if self.workerOwnerRoleMatchers and isinstance(match, WorkerOwnerMatch):
+                    IsWorkerOwnerMatch = True
+                    workerOwners = match.getWorkerOwners()
+                    if workerOwners:
+                        for r in self.workerOwnerRoleMatchers:
+                            roles.update(set(r.getRolesFromUser(userDetails, workerOwners)))
+
+                for role in roles:
+                    if self.match(role, rule.role): # fnmatch or re.match
+                        return None
+
+                if not rule.defaultDeny:
+                    continue   # check next suitable rule if not denied
+
+                # f" You need to have role '{rule.role}'."
+                error_msg = unicode2bytes(" You must be the worker owner." if IsWorkerOwnerMatch else
+                                          " You must be an author of the commit triggered the build.")
+                raise Forbidden(error_msg)
+        return None