Merge pull request #1488 from habitat-sh/eeyun/rbac_fix

Alters minimum requirement for listing user role to member

components/builder-api/src/server/resources/origins.rs

@@ -1180,7 +1180,7 @@ fn get_origin_member_role(req: HttpRequest,
                           -> HttpResponse {
     let (origin, username) = path.into_inner();
 
-    if let Err(err) = authorize_session(&req, Some(&origin), None) {
+    if let Err(err) = authorize_session(&req, Some(&origin), Some(OriginMemberRole::Member)) {
         return err.into();
     }
 

test/builder-api/src/roles.js

@@ -142,6 +142,18 @@ describe("Origin Roles API", function () {
           done(err);
         });
     });
+    it("user with readonly_member role not authorized to query role of other origin members", function (done) {
+      request
+        .get("/depot/origins/rcpd/users/bobo/role")
+        .type("application/json")
+        .accept("application/json")
+        .set("Authorization", global.lkennedyBearer)
+        .expect(403)
+        .end(function (err, res) {
+          expect(res.text).to.be.empty;
+          done(err);
+        });
+    });
     it("user not authorized to query role of members in other origins", function (done) {
       request
         .get("/depot/origins/rcpd/users/lkennedy/role")
@@ -830,6 +842,18 @@ describe("Origin Roles API", function () {
           done(err);
         });
     });
+    it("user with member role authorized to query role of other origin members", function (done) {
+      request
+        .get("/depot/origins/rcpd/users/bobo/role")
+        .type("application/json")
+        .accept("application/json")
+        .set("Authorization", global.lkennedyBearer)
+        .expect(200)
+        .end(function (err, res) {
+          expect(res.text).to.equal('{"role":"owner"}');
+          done(err);
+        });
+    });
   });
   describe("Package visibility and non origin member searches", function () {
     it("non origin member cannot see latest release of a package when its private", function (done) {