Skip to content

Commit 58a376d

Browse files
lucas-koehlerlucas-koehler
authored
service: Add admin user concept and app def scaling endpoint (#400)
* service: Add admin user support via annotation - Introduce the `@AdminOnly` annotation to mark REST resources or methods as accessible only to admin users. - Implement AdminOnlyFilter that intercepts requests and aborts non-admin users with a 403 Forbidden response. - Update ApplicationProperties to include a configurable admin group name property ("theia.cloud.auth.admin.group") with a default value of "theia-cloud/admin". - Enhance TheiaCloudUser by adding an admin flag. - Modify TheiaCloudUserProducer to derive the admin status from the MicroProfile JWT's groups claim. - Add tests for the new admin-only filter, properties, and user producer functionality. - Extend service Dockerfile to allow configuring the admin group name via environment variable. * service: Add admin endpoint to update app def's min/max instances - Add new resource AdminAppDefinitionAdminResource for all admin endpoints regarding app definitions - Minor extensions in K8SUtil, AppDefinitionSpec to allow editing min/max instances - Add tests for AdminAppDefintionAdminResource - Add RootAdminResource with a ping endpoint that only returns if the user is an admin - Regenerate OpenAPI definition, docs and common code * terrafom: Add admin user group and outputs for Keycloak module Extend Keycloak terraform module: - Define an admin group with the default name - Export realm, admin group and test users via outputs Test setup: - Add test user foo to the admin group - Document how to get a Keycloak access token on the command line * fix: Update Keycloak URL in tasks.json to include realm path This is required for the Quarkus dev server to discover the OIDC config. Also see the official documentation: https://quarkus.io/guides/security-oidc-configuration-properties-reference#quarkus-oidc_quarkus-oidc-auth-server-url
1 parent 4920b92 commit 58a376d

File tree

36 files changed

+2544
-748
lines changed

36 files changed

+2544
-748
lines changed

‎.vscode/tasks.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@
6060
"-Dtheia.cloud.app.id=asdfghjkl",
6161
"-Dquarkus.http.port=8081",
6262
"-Dtheia.cloud.use.keycloak=true",
63-
"-Dquarkus.oidc.auth-server-url=${input:keycloakURL}",
63+
"-Dquarkus.oidc.auth-server-url=${input:keycloakURL}/realms/TheiaCloud",
6464
"-Dquarkus.oidc.client-id=theia-cloud",
6565
"-Dquarkus.oidc.credentials.secret=publicbutoauth2proxywantsasecret"
6666
],
@@ -101,7 +101,7 @@
101101
"type": "promptString",
102102
"id": "keycloakURL",
103103
"description": "Provide the keycloak url",
104-
"default": "https://192.168.59.101.nip.io/keycloak/"
104+
"default": "https://192.168.59.101.nip.io/keycloak"
105105
}
106106
]
107107
}

‎dockerfiles/service/Dockerfile

+2
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,11 @@ ENV KEYCLOAK_ENABLE true
2222
ENV KEYCLOAK_SERVERURL https://keycloak.url/auth/realms/TheiaCloud
2323
ENV KEYCLOAK_CLIENTID theia-cloud
2424
ENV KEYCLOAK_CLIENTSECRET publicbutoauth2proxywantsasecret
25+
ENV KEYCLOAK_ADMIN_GROUP theia-cloud/admin
2526

2627
ENTRYPOINT java -Dtheia.cloud.app.id=${APPID} \
2728
-Dquarkus.http.port=${SERVICE_PORT} \
29+
-Dtheia.cloud.auth.admin.group=${KEYCLOAK_ADMIN_GROUP} \
2830
-Dtheia.cloud.use.keycloak=${KEYCLOAK_ENABLE} \
2931
-Dquarkus.oidc.auth-server-url=${KEYCLOAK_SERVERURL} \
3032
-Dquarkus.oidc.client-id=${KEYCLOAK_CLIENTID} \

‎documentation/api/Apis/AppDefinitionAdminResourceApi.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# AppDefinitionAdminResourceApi
2+
3+
All URIs are relative to *http://localhost*
4+
5+
| Method | HTTP request | Description |
6+
|------------- | ------------- | -------------|
7+
| [**serviceAdminAppdefinitionAppDefinitionNamePatch**](AppDefinitionAdminResourceApi.md#serviceAdminAppdefinitionAppDefinitionNamePatch) | **PATCH** /service/admin/appdefinition/{appDefinitionName} | Updates an app definition |
8+
9+
10+
<a name="serviceAdminAppdefinitionAppDefinitionNamePatch"></a>
11+
# **serviceAdminAppdefinitionAppDefinitionNamePatch**
12+
> AppDefinition serviceAdminAppdefinitionAppDefinitionNamePatch(appDefinitionName, AppDefinitionUpdateRequest)
13+
14+
Updates an app definition
15+
16+
Updates an app definition&#39;s properties. Allowed properties to update are defined by AppDefinitionUpdateRequest.
17+
18+
### Parameters
19+
20+
|Name | Type | Description | Notes |
21+
|------------- | ------------- | ------------- | -------------|
22+
| **appDefinitionName** | **String**| The K8S resource name of the app definition to update. | [default to null] |
23+
| **AppDefinitionUpdateRequest** | [**AppDefinitionUpdateRequest**](../Models/AppDefinitionUpdateRequest.md)| | |
24+
25+
### Return type
26+
27+
[**AppDefinition**](../Models/AppDefinition.md)
28+
29+
### Authorization
30+
31+
No authorization required
32+
33+
### HTTP request headers
34+
35+
- **Content-Type**: application/json
36+
- **Accept**: application/json
37+

‎documentation/api/Apis/RootAdminResourceApi.md

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# RootAdminResourceApi
2+
3+
All URIs are relative to *http://localhost*
4+
5+
| Method | HTTP request | Description |
6+
|------------- | ------------- | -------------|
7+
| [**serviceAdminAppIdGet**](RootAdminResourceApi.md#serviceAdminAppIdGet) | **GET** /service/admin/{appId} | Admin Ping |
8+
9+
10+
<a name="serviceAdminAppIdGet"></a>
11+
# **serviceAdminAppIdGet**
12+
> Boolean serviceAdminAppIdGet(appId)
13+
14+
Admin Ping
15+
16+
Replies with success if the service is available and the user an admin.
17+
18+
### Parameters
19+
20+
|Name | Type | Description | Notes |
21+
|------------- | ------------- | ------------- | -------------|
22+
| **appId** | **String**| | [default to null] |
23+
24+
### Return type
25+
26+
**Boolean**
27+
28+
### Authorization
29+
30+
No authorization required
31+
32+
### HTTP request headers
33+
34+
- **Content-Type**: Not defined
35+
- **Accept**: text/plain
36+

‎documentation/api/Apis/RootResourceApi.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ Launch Session
4747

4848
|Name | Type | Description | Notes |
4949
|------------- | ------------- | ------------- | -------------|
50-
| **LaunchRequest** | [**LaunchRequest**](../Models/LaunchRequest.md)| | [optional] |
50+
| **LaunchRequest** | [**LaunchRequest**](../Models/LaunchRequest.md)| | |
5151

5252
### Return type
5353

‎documentation/api/Apis/SessionResourceApi.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ Stop session
5151

5252
|Name | Type | Description | Notes |
5353
|------------- | ------------- | ------------- | -------------|
54-
| **SessionStopRequest** | [**SessionStopRequest**](../Models/SessionStopRequest.md)| | [optional] |
54+
| **SessionStopRequest** | [**SessionStopRequest**](../Models/SessionStopRequest.md)| | |
5555

5656
### Return type
5757

@@ -78,7 +78,7 @@ Report session activity
7878

7979
|Name | Type | Description | Notes |
8080
|------------- | ------------- | ------------- | -------------|
81-
| **SessionActivityRequest** | [**SessionActivityRequest**](../Models/SessionActivityRequest.md)| | [optional] |
81+
| **SessionActivityRequest** | [**SessionActivityRequest**](../Models/SessionActivityRequest.md)| | |
8282

8383
### Return type
8484

@@ -133,7 +133,7 @@ Start a new session
133133

134134
|Name | Type | Description | Notes |
135135
|------------- | ------------- | ------------- | -------------|
136-
| **SessionStartRequest** | [**SessionStartRequest**](../Models/SessionStartRequest.md)| | [optional] |
136+
| **SessionStartRequest** | [**SessionStartRequest**](../Models/SessionStartRequest.md)| | |
137137

138138
### Return type
139139

‎documentation/api/Apis/WorkspaceResourceApi.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ Delete workspace
4949

5050
|Name | Type | Description | Notes |
5151
|------------- | ------------- | ------------- | -------------|
52-
| **WorkspaceDeletionRequest** | [**WorkspaceDeletionRequest**](../Models/WorkspaceDeletionRequest.md)| | [optional] |
52+
| **WorkspaceDeletionRequest** | [**WorkspaceDeletionRequest**](../Models/WorkspaceDeletionRequest.md)| | |
5353

5454
### Return type
5555

@@ -76,7 +76,7 @@ Create workspace
7676

7777
|Name | Type | Description | Notes |
7878
|------------- | ------------- | ------------- | -------------|
79-
| **WorkspaceCreationRequest** | [**WorkspaceCreationRequest**](../Models/WorkspaceCreationRequest.md)| | [optional] |
79+
| **WorkspaceCreationRequest** | [**WorkspaceCreationRequest**](../Models/WorkspaceCreationRequest.md)| | |
8080

8181
### Return type
8282

‎documentation/api/Models/AppDefinition.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# AppDefinition
2+
## Properties
3+
4+
| Name | Type | Description | Notes |
5+
|------------ | ------------- | ------------- | -------------|
6+
| **apiVersion** | **String** | | [optional] [default to null] |
7+
| **kind** | **String** | | [optional] [default to null] |
8+
| **metadata** | [**ObjectMeta**](ObjectMeta.md) | | [optional] [default to null] |
9+
| **spec** | [**AppDefinitionSpec**](AppDefinitionSpec.md) | | [optional] [default to null] |
10+
| **status** | [**AppDefinitionStatus**](AppDefinitionStatus.md) | | [optional] [default to null] |
11+
| **singular** | **String** | | [optional] [default to null] |
12+
| **crdName** | **String** | | [optional] [default to null] |
13+
| **scope** | **String** | | [optional] [default to null] |
14+
| **plural** | **String** | | [optional] [default to null] |
15+
| **served** | **Boolean** | | [optional] [default to null] |
16+
| **storage** | **Boolean** | | [optional] [default to null] |
17+
| **deprecated** | **Boolean** | | [optional] [default to null] |
18+
| **deprecationWarning** | **String** | | [optional] [default to null] |
19+
20+
[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
21+

‎documentation/api/Models/AppDefinitionStatus.md

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# AppDefinitionStatus
2+
## Properties
3+
4+
| Name | Type | Description | Notes |
5+
|------------ | ------------- | ------------- | -------------|
6+
| **operatorStatus** | **String** | | [optional] [default to null] |
7+
| **operatorMessage** | **String** | | [optional] [default to null] |
8+
9+
[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
10+

‎documentation/api/Models/AppDefinitionUpdateRequest.md

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# AppDefinitionUpdateRequest
2+
## Properties
3+
4+
| Name | Type | Description | Notes |
5+
|------------ | ------------- | ------------- | -------------|
6+
| **appId** | **String** | The App Id of this Theia Cloud instance. Request without a matching Id will be denied. | [default to null] |
7+
| **minInstances** | **Integer** | The minimum number of instances to run. | [optional] [default to null] |
8+
| **maxInstances** | **Integer** | The maximum number of instances to run. | [optional] [default to null] |
9+
10+
[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
11+

‎documentation/api/Models/ManagedFieldsEntry.md

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# ManagedFieldsEntry
2+
## Properties
3+
4+
| Name | Type | Description | Notes |
5+
|------------ | ------------- | ------------- | -------------|
6+
| **apiVersion** | **String** | | [optional] [default to null] |
7+
| **fieldsType** | **String** | | [optional] [default to null] |
8+
| **fieldsV1** | [**Object**](.md) | | [optional] [default to null] |
9+
| **manager** | **String** | | [optional] [default to null] |
10+
| **operation** | **String** | | [optional] [default to null] |
11+
| **subresource** | **String** | | [optional] [default to null] |
12+
| **time** | **String** | | [optional] [default to null] |
13+
14+
[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
15+

‎documentation/api/Models/ObjectMeta.md

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# ObjectMeta
2+
## Properties
3+
4+
| Name | Type | Description | Notes |
5+
|------------ | ------------- | ------------- | -------------|
6+
| **annotations** | **Map** | | [optional] [default to null] |
7+
| **creationTimestamp** | **String** | | [optional] [default to null] |
8+
| **deletionGracePeriodSeconds** | **Long** | | [optional] [default to null] |
9+
| **deletionTimestamp** | **String** | | [optional] [default to null] |
10+
| **finalizers** | **List** | | [optional] [default to null] |
11+
| **generateName** | **String** | | [optional] [default to null] |
12+
| **generation** | **Long** | | [optional] [default to null] |
13+
| **labels** | **Map** | | [optional] [default to null] |
14+
| **managedFields** | [**List**](ManagedFieldsEntry.md) | | [optional] [default to null] |
15+
| **name** | **String** | | [optional] [default to null] |
16+
| **namespace** | **String** | | [optional] [default to null] |
17+
| **ownerReferences** | [**List**](OwnerReference.md) | | [optional] [default to null] |
18+
| **resourceVersion** | **String** | | [optional] [default to null] |
19+
| **selfLink** | **String** | | [optional] [default to null] |
20+
| **uid** | **String** | | [optional] [default to null] |
21+
22+
[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
23+

‎documentation/api/Models/OwnerReference.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# OwnerReference
2+
## Properties
3+
4+
| Name | Type | Description | Notes |
5+
|------------ | ------------- | ------------- | -------------|
6+
| **apiVersion** | **String** | | [optional] [default to null] |
7+
| **kind** | **String** | | [optional] [default to null] |
8+
| **blockOwnerDeletion** | **Boolean** | | [optional] [default to null] |
9+
| **controller** | **Boolean** | | [optional] [default to null] |
10+
| **name** | **String** | | [optional] [default to null] |
11+
| **uid** | **String** | | [optional] [default to null] |
12+
13+
[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
14+

‎documentation/api/README.md

+8
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@ All URIs are relative to *http://localhost*
77

88
| Class | Method | HTTP request | Description |
99
|------------ | ------------- | ------------- | -------------|
10+
| *AppDefinitionAdminResourceApi* | [**serviceAdminAppdefinitionAppDefinitionNamePatch**](Apis/AppDefinitionAdminResourceApi.md#serviceadminappdefinitionappdefinitionnamepatch) | **PATCH** /service/admin/appdefinition/{appDefinitionName} | Updates an app definition |
1011
| *AppDefinitionResourceApi* | [**serviceAppdefinitionAppIdGet**](Apis/AppDefinitionResourceApi.md#serviceappdefinitionappidget) | **GET** /service/appdefinition/{appId} | List app definitions |
12+
| *RootAdminResourceApi* | [**serviceAdminAppIdGet**](Apis/RootAdminResourceApi.md#serviceadminappidget) | **GET** /service/admin/{appId} | Admin Ping |
1113
| *RootResourceApi* | [**serviceAppIdGet**](Apis/RootResourceApi.md#serviceappidget) | **GET** /service/{appId} | Ping |
1214
*RootResourceApi* | [**servicePost**](Apis/RootResourceApi.md#servicepost) | **POST** /service | Launch Session |
1315
| *SessionResourceApi* | [**serviceSessionAppIdUserGet**](Apis/SessionResourceApi.md#servicesessionappiduserget) | **GET** /service/session/{appId}/{user} | List sessions |
@@ -24,11 +26,17 @@ All URIs are relative to *http://localhost*
2426
## Documentation for Models
2527

2628
- [ActivityTracker](./Models/ActivityTracker.md)
29+
- [AppDefinition](./Models/AppDefinition.md)
2730
- [AppDefinitionListRequest](./Models/AppDefinitionListRequest.md)
2831
- [AppDefinitionSpec](./Models/AppDefinitionSpec.md)
32+
- [AppDefinitionStatus](./Models/AppDefinitionStatus.md)
33+
- [AppDefinitionUpdateRequest](./Models/AppDefinitionUpdateRequest.md)
2934
- [EnvironmentVars](./Models/EnvironmentVars.md)
3035
- [LaunchRequest](./Models/LaunchRequest.md)
36+
- [ManagedFieldsEntry](./Models/ManagedFieldsEntry.md)
3137
- [Monitor](./Models/Monitor.md)
38+
- [ObjectMeta](./Models/ObjectMeta.md)
39+
- [OwnerReference](./Models/OwnerReference.md)
3240
- [PingRequest](./Models/PingRequest.md)
3341
- [SessionActivityRequest](./Models/SessionActivityRequest.md)
3442
- [SessionListRequest](./Models/SessionListRequest.md)

0 commit comments

Comments
 (0)