feat: use config roles and add permissions for publish_notice and db_…

…dump
mbta · Feb 8, 2024 · bd1c055 · bd1c055
1 parent 4df9f91
commit bd1c055
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 1 deletion.
diff --git a/config/config.exs b/config/config.exs
@@ -28,7 +28,9 @@ config :arrow,
     update_disruption: ["admin"],
     delete_disruption: ["admin"],
     create_note: ["admin"],
-    view_change_feed: ["admin"]
+    view_change_feed: ["admin"],
+    publish_notice: ["admin"],
+    db_dump: ["admin"]
   },
   time_zone: "America/New_York",
   ex_aws_requester: {Fake.ExAws, :admin_group_request},

diff --git a/lib/arrow/permissions.ex b/lib/arrow/permissions.ex
@@ -12,6 +12,8 @@ defmodule Arrow.Permissions do
           | :update_disruption
           | :delete_disruption
           | :view_change_feed
+          | :publish_notice
+          | :db_dump
 
   @spec authorize(action(), User.t()) :: :ok | {:error, :unauthorized}
   def authorize(action, user) do

diff --git a/lib/arrow_web/controllers/api/db_dump_controller.ex b/lib/arrow_web/controllers/api/db_dump_controller.ex
@@ -1,6 +1,9 @@
 defmodule ArrowWeb.API.DBDumpController do
+  alias ArrowWeb.Plug.Authorize
   use ArrowWeb, :controller
 
+  plug(Authorize, :db_dump)
+
   @spec show(Plug.Conn.t(), map()) :: Plug.Conn.t()
   def show(conn, _params) do
     json(conn, Arrow.DBStructure.dump_data())

diff --git a/lib/arrow_web/controllers/api/notice_controller.ex b/lib/arrow_web/controllers/api/notice_controller.ex
@@ -1,7 +1,10 @@
 defmodule ArrowWeb.API.NoticeController do
+  alias ArrowWeb.Plug.Authorize
   use ArrowWeb, :controller
   require Logger
 
+  plug(Authorize, :publish_notice)
+
   @spec publish(Plug.Conn.t(), map()) :: Plug.Conn.t()
   def publish(conn, params) do
     revision_ids = params["revision_ids"] |> String.split(",") |> Enum.map(&String.to_integer/1)