feat: allow users with role Viewer and above to view resource quotas

master/internal/api_workspace.go

@@ -1558,8 +1558,8 @@ func (a *apiServer) GetKubernetesResourceQuotas(
 	if err != nil {
 		return nil, err
 	}
-	err = workspace.AuthZProvider.Get().CanGetWorkspaceID(
-		ctx, *curUser, req.Id,
+	err = workspace.AuthZProvider.Get().CanViewResourceQuotas(
+		ctx, *curUser,
 	)
 	if err != nil {
 		return nil, err

master/internal/workspace/authz_basic_impl.go

@@ -177,6 +177,12 @@ func (a *WorkspaceAuthZBasic) CanSetResourceQuotas(ctx context.Context, curUser
 	return nil
 }
 
+// CanViewResourceQuotas returns a nil error.
+func (a *WorkspaceAuthZBasic) CanViewResourceQuotas(ctx context.Context, curUser model.User,
+) error {
+	return nil
+}
+
 // CanSetWorkspacesDefaultPools returns a nil error.
 func (a *WorkspaceAuthZBasic) CanSetWorkspacesDefaultPools(
 	ctx context.Context, curUser model.User, workspace *workspacev1.Workspace,

master/internal/workspace/authz_iface.go

@@ -46,7 +46,7 @@ type WorkspaceAuthZ interface {
 	CanCreateWorkspaceWithCheckpointStorageConfig(ctx context.Context, curUser model.User) error
 	CanSetWorkspaceNamespaceBindings(ctx context.Context, curUser model.User) error
 	CanSetResourceQuotas(ctx context.Context, curUser model.User) error
-
+	CanViewResourceQuotas(ctx context.Context, curUser model.User) error
 	// PATCH /api/v1/workspaces/:workspace_id
 	CanSetWorkspacesName(
 		ctx context.Context, curUser model.User, workspace *workspacev1.Workspace,

master/internal/workspace/authz_permissive.go

@@ -171,6 +171,14 @@ func (p *WorkspaceAuthZPermissive) CanSetResourceQuotas(
 	return (&WorkspaceAuthZBasic{}).CanSetResourceQuotas(ctx, curUser)
 }
 
+// CanViewResourceQuotas calls RBAC authz but enforces basic authz.
+func (p *WorkspaceAuthZPermissive) CanViewResourceQuotas(
+	ctx context.Context, curUser model.User,
+) error {
+	_ = (&WorkspaceAuthZRBAC{}).CanViewResourceQuotas(ctx, curUser)
+	return (&WorkspaceAuthZBasic{}).CanViewResourceQuotas(ctx, curUser)
+}
+
 func init() {
 	AuthZProvider.Register("permissive", &WorkspaceAuthZPermissive{})
 }

master/internal/workspace/authz_rbac.go

@@ -397,6 +397,21 @@ func (r *WorkspaceAuthZRBAC) CanSetResourceQuotas(ctx context.Context,
 		rbacv1.PermissionType_PERMISSION_TYPE_SET_RESOURCE_QUOTAS)
 }
 
+// CanViewResourceQuotas determines whether a user can view resource quotas on a workspace.
+func (r *WorkspaceAuthZRBAC) CanViewResourceQuotas(ctx context.Context,
+	curUser model.User,
+) (err error) {
+	fields := audit.ExtractLogFields(ctx)
+	addInfoWithoutWorkspace(curUser, fields,
+		rbacv1.PermissionType_PERMISSION_TYPE_VIEW_RESOURCE_QUOTAS)
+	defer func() {
+		audit.LogFromErr(fields, err)
+	}()
+
+	return db.DoesPermissionMatch(ctx, curUser.ID, nil,
+		rbacv1.PermissionType_PERMISSION_TYPE_VIEW_RESOURCE_QUOTAS)
+}
+
 func hasPermissionOnWorkspace(ctx context.Context, uid model.UserID,
 	workspace *workspacev1.Workspace, permID rbacv1.PermissionType,
 ) error {

master/static/migrations/20240814123944_add-view-resource-quotas-permissions.tx.up.sql

@@ -0,0 +1,13 @@
+/* Add RBAC permissions for creating/updating/deleting namespace-workspace bindings and 
+resource quotas. */
+INSERT into permissions(id, name, global_only) VALUES 
+    (11003, 'view resource quotas', false);
+
+INSERT INTO permission_assignments(permission_id, role_id) VALUES
+    (11003, 1),
+    (11003, 2),
+    (11003, 4),
+    (11003, 5),
+    (11003, 7),
+    (11003, 8),
+    (11003, 9);

proto/src/determined/rbac/v1/rbac.proto

@@ -174,6 +174,9 @@ enum PermissionType {
 
   // Ability to set resource quotas on workspaces.
   PERMISSION_TYPE_SET_RESOURCE_QUOTAS = 11002;
+
+  // Ability to view resource quotas on workspaces.
+  PERMISSION_TYPE_VIEW_RESOURCE_QUOTAS = 11003;
 }
 
 // RoleAssignmentSummary is used to describe permissions a user has.

webui/react/src/components/WorkspaceCreateModal.tsx

@@ -63,6 +63,8 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
     canModifyWorkspaceCheckpointStorage,
     canSetWorkspaceNamespaceBindings,
     canSetResourceQuotas,
+    canViewResourceQuotas,
+    canModifyWorkspace,
   } = usePermissions();
   const info = useObservable(determinedStore.info);
   const [form] = Form.useForm<FormInputs>();
@@ -153,6 +155,8 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
 
   const loadableWorkspace = useObservable(workspaceStore.getWorkspace(workspaceId || 0));
   const workspace = Loadable.getOrElse(undefined, loadableWorkspace);
+  const isViewing = !!workspace && !canModifyWorkspace({ workspace });
+  const isEditing = workspaceId !== undefined;
 
   useEffect(() => {
     initFields(workspace || undefined);
@@ -167,7 +171,7 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
   }, [canModifyWorkspaceAgentUserGroup, canModifyWorkspaceCheckpointStorage, workspaceId]);
 
   const modalContent = useMemo(() => {
-    if (workspaceId && loadableWorkspace === NotLoaded) return <Spinner spinning />;
+    if (isEditing && loadableWorkspace === NotLoaded) return <Spinner spinning />;
     return (
       <Form
         autoComplete="off"
@@ -185,7 +189,7 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
               required: true,
             },
           ]}>
-          <Input maxLength={80} />
+          <Input disabled={isViewing} maxLength={80} />
         </Form.Item>
         {canSetWorkspaceNamespaceBindings && resourceManagers.length > 0 && (
           <>
@@ -238,6 +242,23 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
             </>
           </>
         )}
+        {!canSetWorkspaceNamespaceBindings &&
+          canViewResourceQuotas &&
+          isEditing &&
+          info.branding === BrandingType.HPE &&
+          resourceManagers.length > 0 && (
+            <>
+              <Divider />
+              Resource Quotas
+              <>
+                {resourceManagers.map((name) => (
+                  <Fragment key={name}>
+                    <Form.Item label={`Cluster Name: ${name}`} name={['resourceQuotas', name]} />
+                  </Fragment>
+                ))}
+              </>
+            </>
+          )}
         {canModifyAUG && (
           <>
             <Divider />
@@ -338,19 +359,21 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
       </Form>
     );
   }, [
-    workspaceId,
     loadableWorkspace,
     form,
     idPrefix,
+    isEditing,
+    isViewing,
     canSetWorkspaceNamespaceBindings,
     resourceManagers,
+    canViewResourceQuotas,
+    info.branding,
     canModifyAUG,
     useAgentUser,
     useAgentGroup,
     canModifyCPS,
     useCheckpointStorage,
     watchBindings,
-    info.branding,
     canSetResourceQuotas,
   ]);
 
@@ -420,7 +443,7 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
           }
         }
 
-        if (workspaceId) {
+        if (isEditing) {
           await patchWorkspace({ id: workspaceId, ...body });
           workspaceStore.fetch(undefined, true);
           resourceQuotaBody['id'] = workspaceId;
@@ -430,7 +453,11 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
           resourceQuotaBody['id'] = response.id;
         }
 
-        if (values.resourceQuotas) {
+        if (
+          canSetResourceQuotas &&
+          values.resourceQuotas &&
+          Object.keys(values.resourceQuotas).length !== 0
+        ) {
           resourceQuotaBody['clusterQuotaPairs'] = pick(values.resourceQuotas, resourceManagers);
           await setResourceQuotas(resourceQuotaBody);
         }
@@ -455,19 +482,31 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
         });
       }
     }
-  }, [form, workspaceId, canModifyAUG, canModifyCPS, resourceManagers]);
+  }, [
+    form,
+    canModifyAUG,
+    canModifyCPS,
+    canSetResourceQuotas,
+    isEditing,
+    workspaceId,
+    resourceManagers,
+  ]);
 
   return (
     <Modal
       cancel
       size="medium"
-      submit={{
-        form: idPrefix + FORM_ID,
-        handleError,
-        handler: handleSubmit,
-        text: 'Save Workspace',
-      }}
-      title={`${workspaceId ? 'Edit' : 'New'} Workspace`}
+      submit={
+        isViewing
+          ? undefined
+          : {
+              form: idPrefix + FORM_ID,
+              handleError,
+              handler: handleSubmit,
+              text: 'Save Workspace',
+            }
+      }
+      title={isViewing ? 'Workspace Config' : `${isEditing ? 'Edit' : 'New'} Workspace`}
       onClose={() => {
         initFields(undefined);
         onClose?.();

webui/react/src/hooks/usePermissions.ts

@@ -106,6 +106,7 @@ export interface PermissionsHook {
   canViewModelRegistry: (arg0: WorkspacePermissionsArgs) => boolean;
   canViewWorkspace: (arg0: WorkspacePermissionsArgs) => boolean;
   canViewWorkspaces: boolean;
+  canViewResourceQuotas: boolean;
   loading: boolean;
 }
 
@@ -208,6 +209,7 @@ const usePermissions = (): PermissionsHook => {
       canViewGroups: canViewGroups(rbacOpts),
       canViewModelRegistry: (args: WorkspacePermissionsArgs) =>
         canViewModelRegistry(rbacOpts, args.workspace),
+      canViewResourceQuotas: canViewResourceQuotas(rbacOpts),
       canViewWorkspace: (args: WorkspacePermissionsArgs) =>
         canViewWorkspace(rbacOpts, args.workspace),
       canViewWorkspaces: canViewWorkspaces(rbacOpts),
@@ -626,6 +628,16 @@ const canSetResourceQuotas = ({
   );
 };
 
+const canViewResourceQuotas = ({
+  currentUser,
+  rbacEnabled,
+  userAssignments,
+  userRoles,
+}: RbacOptsProps): boolean => {
+  const permitted = relevantPermissions(userAssignments, userRoles);
+  return !!currentUser && (!rbacEnabled || permitted.has(V1PermissionType.VIEWRESOURCEQUOTAS));
+};
+
 const canViewWorkspace = (
   { rbacEnabled, userAssignments, userRoles }: RbacOptsProps,
   workspace?: PermissionWorkspace,

webui/react/src/pages/WorkspaceList/WorkspaceActionDropdown.tsx

@@ -153,6 +153,10 @@ export const useWorkspaceActionMenu: (props: WorkspaceMenuPropsIn) => WorkspaceM
         key: MenuKey.SwitchArchived,
         label: workspace.archived ? 'Unarchive' : 'Archive',
       });
+    } else {
+      if (!workspace.archived) {
+        menuItems.push({ key: MenuKey.Edit, label: 'Config' });
+      }
     }
     if (canDeleteWorkspace({ workspace }) && workspace.numExperiments === 0) {
       menuItems.push({ type: 'divider' });