fix: apps and jobs permission (#5110)

* issue has been on code level

* added the changes

* changes made to fix the bug is done

* Delete go.sum

* Delete go.mod

* fix: grpc error handling for TemplateChart req (#4980)

* grpc error handling

* fix

* fix: terminate sync if in progress  (#4946)

* terminate operation before sync

* using method for checking manual sync

* terminating only in case of error

* handling termination error

* updating sync function

* fix: Kubelink Requests getting Failed for gRPC method GetAppDetails (#5012)

* fixed

* code review comments

* fix: deleted api token can be reused if created again with same name (#4978)

* introuddced api token versioning

* fix

* reverted wire_gen

* migration udpated and minor refactor

* refactor

* moved const from apiToken pkg to user

* reverted wire_gen

* refactor

* reverted wire_gen

* concurrency case handled

* fix

* commented wherever necessary

* refactor

* fix

* refactor

* refactor

* wip

* refactor

* added comments and minor refactor

* refactor

* refactoring

* fix

* added comments around cyclic import

* added few more comments

* sql script no updated

* feat: Introduction to feasibility in Deployment (#4862)

* introduction to feasibility

* moved feasibility in trigger/devtronApps

* feasibility refactorings

* refactoring and feasibility manager

* removing vulnerability changes

* vulnerability checks retract

* dry run removed

* dry run checks removed

* refactoring

* removing unnecessary code

* comments

* trigger request

* doc: Changes made in the doc according to the newer version (#5024)

* Changes made in the doc according to the newer version

* Revert "Changes made in the doc according to the newer version"

This reverts commit 1f4d806.

* created a doc for the newer version of the plugin

* added the pass/fail condition

* corrected mistakes

* added failed workflow in ISLastReleaseStopType method (#5005)

* fix: Dockerfile ubuntu version (#5022)

* Update DockerfileEA

* Update Dockerfile

* doc: Added new doc in the index (#5029)

* Changes made in the doc according to the newer version

* Revert "Changes made in the doc according to the newer version"

This reverts commit 1f4d806.

* created a doc for the newer version of the plugin

* added the pass/fail condition

* corrected mistakes

* added the new doc in the index file

* fix: handle for wrong format of k8s version in semvercompare func in cronjob template charts (#5016)

* handle for wrong format of k8s version in semvercompare func in cronjob template charts

* TestStripPrereleaseFromK8sVersion UT's added

* constants added

* incorporated code review changes

* merge main

* feat: CD Trigger Plugin (#4810)

* Add files via upload

CD plugin

* Update 238_devtron_CD_trigger_v1.0.0.up.sql

* Rename 231_devtron_CD_trigger_v1.0.0.down.sql to 238_devtron_CD_trigger_v1.0.0.down.sql

* Rename 231_devtron_CD_trigger_v1.0.0.up.sql to 238_devtron_CD_trigger_v1.0.0.up.sql

* Update 238_devtron_CD_trigger_v1.0.0.up.sql

* Update 238_devtron_CD_trigger_v1.0.0.up.sql

* Update 238_devtron_CD_trigger_v1.0.0.up.sql

* Rename 238_devtron_CD_trigger_v1.0.0.down.sql to 240_devtron_CD_trigger_v1.0.0.down.sql

* Rename 238_devtron_CD_trigger_v1.0.0.up.sql to 240_devtron_CD_trigger_v1.0.0.up.sql

---------

Co-authored-by: Prakarsh <71125043+prakarsh-dt@users.noreply.github.com>

* fix: terminal stuck in connecting state (#4989)

* closing channel after write operation

* removing close

* using buffered channel

* wip: making done channel bufferred

* terminal racecondition and deadlock fix

* wire run

* removing done send call

* updating bound channel send function

* panic handled (#5036)

* fix: git material saved in transaction (#5040)

* git material flow added in transaction

* wire refactored

* code review comments incorporated

* code review comments incorporated

* code review comments incorporated

* fix: App create api validations (#5019)

* wip

* error handling done

* fix

---------

Co-authored-by: ayushmaheshwari <ayush@devtron.ai>

* gitops update updated (#5055)

* feat: Plugin to trigger Devtron Job (#5053)

* feat: Plugin to trigger Devtron Job (#5052)

* Update 241_devtronJobTrigger.up.sql

* fix: handle 5xx in fetch resource tree api and cd-trigger (#5050)

* handle context cancelled and deadline exceeded in fetch resource tree api

* handle context cancelled and deadline exceeded error for resource tree fetch api for acd deployment

* handle context cancelled and deadline exceeded error sync argo app with normal refresh

* revert TIMEOUT_IN_SECONDS

* revert bean TimeoutSlow param

* fix

* feat: resource scan  (#4977)

* cherry-pick

* incorporating feedbacks

* sync with main

* misc: uniform GitHub action (#5069)

* Update azure-devops-issue-sync.yml

* Update chart-sync.yaml

* Update create-release.yml

* Update enterprise-repo-sync.yaml

* Update pager-duty-issue-escalate.yaml

* Update update-release-notes.yml

* Update chart-sync.yaml

* Update create-release.yml

* Update enterprise-repo-sync.yaml

* Update update-release-notes.yml

* Update enterprise-repo-sync.yaml

---------

Co-authored-by: Prakarsh <71125043+prakarsh-dt@users.noreply.github.com>

* fix (#5074)

* gitops validation in api (#5082)

* condition fix (#5088)

* handled namespace case if deleted by kubectl (#5081)

Co-authored-by: Shivam Nagar <124123645+Shivam-nagar23@users.noreply.github.com>

* resolved PR review comments also remove check for virtual cluster (#5095)

* feat: added sql for release and release channels (#4898)

* added sql for relese feat

* updated sql script no

* renamed sql files

* updated schema for release & release track

* fixes in schema

* updated schema

* made changes in old schemas

* enum correction

* minor change in script

* sql script update

* updated script

* updated sql script no

* exposed release resource

* updated sql script no

* updated release catalog data

* added rescind status change policy handling

* renaming policy json field

* updated schema ordering

* updated global policy version

* updated policy json

* prod bug fix

* updated policy lock status

* added action check policy release

* wip

* updated policy for release status

* updated down sql

* updated sql script no.

* fixed autocorrect issues

* added first released on key for release

* updated task run migration

* Added task run down migration

* sql script change

* updated policy for action check - instruction patch

* fixed schema merge conflict

---------

Co-authored-by: Shivam-nagar23 <shivam@devtron.ai>

* sync with main

* final fixes done

* final code ready fo the pr

* changes suggested are incorporated

* missed changes in a file from above commit are added and committing now

* changes done for adding a if condition for apps

---------

Co-authored-by: ashishdevtron <141303172+ashishdevtron@users.noreply.github.com>
Co-authored-by: iamayushm <32041961+iamayushm@users.noreply.github.com>
Co-authored-by: Shashwat Dadhich <92629050+ShashwatDadhich@users.noreply.github.com>
Co-authored-by: Shivam Nagar <124123645+Shivam-nagar23@users.noreply.github.com>
Co-authored-by: satya_prakash <155617493+SATYAsasini@users.noreply.github.com>
Co-authored-by: jatin-jangir-0220 <122791251+jatin-jangir-0220@users.noreply.github.com>
Co-authored-by: Prakash <prakash.kumar@devtron.ai>
Co-authored-by: shaileshmehta16 <159411935+shaileshmehta16@users.noreply.github.com>
Co-authored-by: Prakarsh <71125043+prakarsh-dt@users.noreply.github.com>
Co-authored-by: ayushmaheshwari <ayush@devtron.ai>
Co-authored-by: Kiran <155609672+kirandevtn@users.noreply.github.com>
Co-authored-by: subhashish-devtron <129164905+subhashish-devtron@users.noreply.github.com>
Co-authored-by: Laeeq Ahmad <155711991+Laeeqdev@users.noreply.github.com>
Co-authored-by: kartik-579 <84493919+kartik-579@users.noreply.github.com>
Co-authored-by: Shivam-nagar23 <shivam@devtron.ai>
Co-authored-by: ShashwatDadhich <dadhichshashwat1808@gmail.com>

api/restHandler/ConfigMapRestHandler.go

@@ -111,8 +111,8 @@ func (handler ConfigMapRestHandlerImpl) CMGlobalAddUpdate(w http.ResponseWriter,
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(configMapRequest.AppId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionCreate)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(configMapRequest.AppId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionCreate, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
 		return
@@ -147,8 +147,8 @@ func (handler ConfigMapRestHandlerImpl) CMEnvironmentAddUpdate(w http.ResponseWr
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(configMapRequest.AppId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionCreate)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(configMapRequest.AppId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionCreate, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
 		return
@@ -188,8 +188,8 @@ func (handler ConfigMapRestHandlerImpl) CMGlobalFetch(w http.ResponseWriter, r *
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
 		return
@@ -225,8 +225,8 @@ func (handler ConfigMapRestHandlerImpl) CMGlobalFetchForEdit(w http.ResponseWrit
 		return
 	}
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
 		return
@@ -268,8 +268,8 @@ func (handler ConfigMapRestHandlerImpl) CMEnvironmentFetchForEdit(w http.Respons
 		return
 	}
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
 		return
@@ -315,8 +315,8 @@ func (handler ConfigMapRestHandlerImpl) CMEnvironmentFetch(w http.ResponseWriter
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
 		return
@@ -352,8 +352,8 @@ func (handler ConfigMapRestHandlerImpl) CSGlobalAddUpdate(w http.ResponseWriter,
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(configMapRequest.AppId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionCreate)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(configMapRequest.AppId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionCreate, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
 		return
@@ -389,8 +389,8 @@ func (handler ConfigMapRestHandlerImpl) CSEnvironmentAddUpdate(w http.ResponseWr
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(configMapRequest.AppId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionCreate)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(configMapRequest.AppId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionCreate, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
 		return
@@ -430,8 +430,8 @@ func (handler ConfigMapRestHandlerImpl) CSGlobalFetch(w http.ResponseWriter, r *
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), nil, http.StatusForbidden)
 		return
@@ -469,8 +469,8 @@ func (handler ConfigMapRestHandlerImpl) CSEnvironmentFetch(w http.ResponseWriter
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), nil, http.StatusForbidden)
 		return
@@ -510,8 +510,8 @@ func (handler ConfigMapRestHandlerImpl) CMGlobalDelete(w http.ResponseWriter, r
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionDelete)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionDelete, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), nil, http.StatusForbidden)
 		return
@@ -557,8 +557,8 @@ func (handler ConfigMapRestHandlerImpl) CMEnvironmentDelete(w http.ResponseWrite
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionDelete)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionDelete, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), nil, http.StatusForbidden)
 		return
@@ -606,8 +606,8 @@ func (handler ConfigMapRestHandlerImpl) CSGlobalDelete(w http.ResponseWriter, r
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionDelete)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionDelete, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), nil, http.StatusForbidden)
 		return
@@ -653,8 +653,8 @@ func (handler ConfigMapRestHandlerImpl) CSEnvironmentDelete(w http.ResponseWrite
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionDelete)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionDelete, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), nil, http.StatusForbidden)
 		return
@@ -702,8 +702,8 @@ func (handler ConfigMapRestHandlerImpl) CSGlobalFetchForEdit(w http.ResponseWrit
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), nil, http.StatusForbidden)
 		return
@@ -749,8 +749,8 @@ func (handler ConfigMapRestHandlerImpl) CSEnvironmentFetchForEdit(w http.Respons
 
 	//RBAC START
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate, appType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), nil, http.StatusForbidden)
 		return

api/restHandler/GlobalPluginRestHandler.go

@@ -166,7 +166,7 @@ func (handler *GlobalPluginRestHandlerImpl) GetAllGlobalVariables(w http.Respons
 	//on atleast one app & we can't check this without iterating through every app
 	//TODO: update plugin as a resource in casbin and make rbac independent of appId
 	resourceName := handler.enforcerUtil.GetAppRBACName(app.AppName)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, resourceName, casbin.ActionCreate)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, resourceName, casbin.ActionCreate, app.AppType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
 		return
@@ -199,7 +199,7 @@ func (handler *GlobalPluginRestHandlerImpl) ListAllPlugins(w http.ResponseWriter
 	//on atleast one app & we can't check this without iterating through every app
 	//TODO: update plugin as a resource in casbin and make rbac independent of appId
 	resourceName := handler.enforcerUtil.GetAppRBACName(app.AppName)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, resourceName, casbin.ActionCreate)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, resourceName, casbin.ActionCreate, app.AppType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
 		return
@@ -233,7 +233,7 @@ func (handler *GlobalPluginRestHandlerImpl) GetPluginDetailById(w http.ResponseW
 	//on atleast one app & we can't check this without iterating through every app
 	//TODO: update plugin as a resource in casbin and make rbac independent of appId
 	resourceName := handler.enforcerUtil.GetAppRBACName(app.AppName)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, resourceName, casbin.ActionCreate)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, resourceName, casbin.ActionCreate, app.AppType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
 		return

api/restHandler/app/appInfo/AppInfoRestHandler.go

@@ -117,8 +117,8 @@ func (handler AppInfoRestHandlerImpl) GetAppMetaInfo(w http.ResponseWriter, r *h
 
 	//rback implementation starts here
 	token := r.Header.Get("token")
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet, appType)
 	if !ok {
 		common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
 		return
@@ -209,15 +209,15 @@ func (handler AppInfoRestHandlerImpl) UpdateApp(w http.ResponseWriter, r *http.R
 
 	// check for existing project/app permission
 	object := handler.enforcerUtil.GetAppRBACNameByAppId(request.Id)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate, request.AppType)
 	if !ok {
 		common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
 		return
 	}
 
 	// check for request project/app permission
 	object = handler.enforcerUtil.GetAppRBACNameByTeamIdAndAppId(request.TeamId, request.Id)
-	ok = handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate)
+	ok = handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate, request.AppType)
 	if !ok {
 		common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
 		return
@@ -370,8 +370,8 @@ func (handler AppInfoRestHandlerImpl) UpdateAppNote(w http.ResponseWriter, r *ht
 	//rbac implementation starts here
 
 	// check for existing project/app permission
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(bean.Identifier)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(bean.Identifier)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionUpdate, appType)
 	if !ok {
 		common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
 		return

api/restHandler/app/appList/AppListingRestHandler.go

@@ -695,7 +695,7 @@ func (handler AppListingRestHandlerImpl) FetchAppStageStatus(w http.ResponseWrit
 
 	// RBAC enforcer applying
 	object := handler.enforcerUtil.GetAppRBACName(app.AppName)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet, app.AppType)
 	if !ok {
 		common.WriteJsonResp(w, fmt.Errorf("unauthorized user"), "Unauthorized User", http.StatusForbidden)
 		return
@@ -769,7 +769,7 @@ func (handler AppListingRestHandlerImpl) FetchMinDetailOtherEnvironment(w http.R
 
 	// RBAC enforcer applying
 	object := handler.enforcerUtil.GetAppRBACName(app.AppName)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet, app.AppType)
 	if !ok {
 		common.WriteJsonResp(w, err, "unauthorized user", http.StatusForbidden)
 		return

api/restHandler/app/pipeline/AutoCompleteRestHandler.go

@@ -203,8 +203,8 @@ func (handler DevtronAppAutoCompleteRestHandlerImpl) GitListAutocomplete(w http.
 	}
 	handler.Logger.Infow("request payload, GitListAutocomplete", "appId", appId)
 	//RBAC
-	object := handler.enforcerUtil.GetAppRBACNameByAppId(appId)
-	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet)
+	object, appType := handler.enforcerUtil.GetAppRBACNameAndAppTypeByAppId(appId)
+	ok := handler.enforcerUtil.CheckAppRbacForAppOrJob(token, object, casbin.ActionGet, appType)
 	if !ok {
 		common.WriteJsonResp(w, err, "Unauthorized User", http.StatusForbidden)
 		return