What this does

The UI needs to ask the question, "Can this user create a template?". This question is now complicated withmulti-organizations, since the answer is true if the user can create the template in any org they are a member of.

The UI today would have to on every page:

• Fetch all organizations
• Loop over the organizations, create a/authcheck for each org for create template
  • Add create template at the site wide too for site admins

This feels like it could add to the number of db queries for a question that doesn't actually require the database. This question can be answered entirely by the policy in memory, since it has the roles and permissions.

So I added a field to an object calledany_org, that when specified makes the policy return "true" for theorg_allow section if any organization would return a truthy value.

This is a policy change, however we can rely on our extensive rbac testing to avoid regressions.

Closes#14003

Alternative

Rego supports, and we use, partial queries. This is possible with 0 modification of the original policy, meaning we do not need to input this as a first class feature.This was the original plan.

The problem with this plan, is the resulting query to inspect and determine if we should return true/false looks something like:

+---------+---------------------------------------------------------------------------------+| Query 1 | "5750d635-82e0-4681-bd44-815b18669d65" = input.object.org_owner                 |+---------+---------------------------------------------------------------------------------+| Query 2 | input.object.org_owner != ""                                                    ||         | input.object.org_owner in {"5750d635-82e0-4681-bd44-815b18669d65"}              ||         | "create" in input.object.acl_group_list["b617a647-b5d0-4cbe-9e40-26f89710bf18"] |+---------+---------------------------------------------------------------------------------+| Query 3 | input.object.org_owner != ""                                                    ||         | input.object.org_owner in {"5750d635-82e0-4681-bd44-815b18669d65"}              ||         | "*" in input.object.acl_group_list["b617a647-b5d0-4cbe-9e40-26f89710bf18"]      |+---------+---------------------------------------------------------------------------------+| Query 4 | input.object.org_owner != ""                                                    ||         | input.object.org_owner in {"5750d635-82e0-4681-bd44-815b18669d65"}              ||         | "create" in input.object.acl_group_list[input.object.org_owner]                 |+---------+---------------------------------------------------------------------------------+| Query 5 | input.object.org_owner != ""                                                    ||         | input.object.org_owner in {"5750d635-82e0-4681-bd44-815b18669d65"}              ||         | "*" in input.object.acl_group_list[input.object.org_owner]                      |+---------+---------------------------------------------------------------------------------+| Query 6 | "create" in input.object.acl_user_list["10d03e62-7703-4df5-a358-4f76577d4e2f"]  |+---------+---------------------------------------------------------------------------------+| Query 7 | "*" in input.object.acl_user_list["10d03e62-7703-4df5-a358-4f76577d4e2f"]       |+---------+---------------------------------------------------------------------------------+

There is two ways to take this output and make it useful.

Conduct some AST analysis and figure out if there exists andorg_id in which at least 1 query returns true. Thisfeels trivialas long as our output ASTs remain static. Any policy change could probably break any first draft AST analysis.FRAGILE

^--- That would be my choice given unlimited time

The second idea is to execute the queries with various inputs. We caneval() each query with a differentinput.object, and some weak ast analysis could probably pick out someuuids to throw back in. This would use proper rego evaluation, and bestrong and consistent against changes. This however would result in some loop of execution, becoming a O(n) problem.

In the end, if we are going to use regoeval() to conclude the result, it makes the most optimization sense just to bake this into the policy itself. Determine the result on the first eval(), rather than trying to rig up something externally.