remove the robot update permission (#21028)

from the perspective of preventing privilege escalation, remove the robot update permission from the possilbe permission set

Signed-off-by: wang yan <[email protected]>

src/common/rbac/const.go

@@ -121,7 +121,6 @@ func (n *NolimitProvider) GetPermissions(s scope) []*types.Policy {
  return append(n.BaseProvider.GetPermissions(ScopeSystem),
  &types.Policy{Resource: ResourceRobot, Action: ActionCreate},
  &types.Policy{Resource: ResourceRobot, Action: ActionRead},
- &types.Policy{Resource: ResourceRobot, Action: ActionUpdate},
  &types.Policy{Resource: ResourceRobot, Action: ActionList},
  &types.Policy{Resource: ResourceRobot, Action: ActionDelete},
 
@@ -149,7 +148,6 @@ func (n *NolimitProvider) GetPermissions(s scope) []*types.Policy {
  return append(n.BaseProvider.GetPermissions(ScopeProject),
  &types.Policy{Resource: ResourceRobot, Action: ActionCreate},
  &types.Policy{Resource: ResourceRobot, Action: ActionRead},
- &types.Policy{Resource: ResourceRobot, Action: ActionUpdate},
  &types.Policy{Resource: ResourceRobot, Action: ActionList},
  &types.Policy{Resource: ResourceRobot, Action: ActionDelete},
 

src/server/v2.0/handler/robot.go

@@ -421,42 +421,6 @@ func (rAPI *robotAPI) updateV2Robot(ctx context.Context, params operation.Update
  }
  }
 
- creatorRobot, err := rAPI.robotCtl.Get(ctx, r.CreatorRef, &robot.Option{
- WithPermission: true,
- })
- if err != nil && !errors.IsErr(err, errors.NotFoundCode) {
- return err
- }
-
- // for nested robot only
- if creatorRobot != nil && r.CreatorType == "robot" {
- sc, err := rAPI.GetSecurityContext(ctx)
- if err != nil {
- return err
- }
- if _, ok := sc.(*robotSc.SecurityContext); ok {
- scRobots, err := rAPI.robotCtl.List(ctx, q.New(q.KeyWords{
- "name": strings.TrimPrefix(sc.GetUsername(), config.RobotPrefix(ctx)),
- "project_id": r.ProjectID,
- }), &robot.Option{
- WithPermission: true,
- })
- if err != nil {
- return err
- }
- if len(scRobots) == 0 {
- return errors.DeniedError(nil)
- }
- if scRobots[0].ID != creatorRobot.ID && scRobots[0].ID != r.ID {
- return errors.New(nil).WithMessage("as for a nested robot account, only person who has the right permission or the creator robot or nested robot itself has the permission to update").WithCode(errors.DENIED)
- }
- }
-
- if !isValidPermissionScope(params.Robot.Permissions, creatorRobot.Permissions) {
- return errors.New(nil).WithMessagef("permission scope is invalid. It must be equal to or more restrictive than the creator robot's permissions: %s", creatorRobot.Name).WithCode(errors.DENIED)
- }
- }
-
  if err := rAPI.robotCtl.Update(ctx, r, &robot.Option{
  WithPermission: true,
  }); err != nil {