fix(console): hide domains settings for unauthorized users (#6602)

fix: hide domains settings for unauthorized users

Co-authored-by: Max Peintner <[email protected]>

console/src/app/pages/org-settings/org-settings.component.ts

@@ -1,10 +1,11 @@
-import { Component } from '@angular/core';
+import { Component, OnInit } from '@angular/core';
 import { ActivatedRoute, Params } from '@angular/router';
-import { take } from 'rxjs';
+import { forkJoin, of, take } from 'rxjs';
 import { PolicyComponentServiceType } from 'src/app/modules/policies/policy-component-types.enum';
 import { SidenavSetting } from 'src/app/modules/sidenav/sidenav.component';
 import { Breadcrumb, BreadcrumbService, BreadcrumbType } from 'src/app/services/breadcrumb.service';
 
+import { GrpcAuthService } from 'src/app/services/grpc-auth.service';
 import {
   BRANDING,
   COMPLEXITY,
@@ -23,10 +24,11 @@ import {
   templateUrl: './org-settings.component.html',
   styleUrls: ['./org-settings.component.scss'],
 })
-export class OrgSettingsComponent {
+export class OrgSettingsComponent implements OnInit {
   public id: string = '';
   public PolicyComponentServiceType: any = PolicyComponentServiceType;
-  public settingsList: SidenavSetting[] = [
+
+  private defaultSettingsList: SidenavSetting[] = [
     LOGIN,
     IDP,
     COMPLEXITY,
@@ -39,7 +41,9 @@ export class OrgSettingsComponent {
     PRIVACYPOLICY,
   ];
 
-  constructor(breadcrumbService: BreadcrumbService, activatedRoute: ActivatedRoute) {
+  public settingsList: SidenavSetting[] = [];
+
+  constructor(breadcrumbService: BreadcrumbService, activatedRoute: ActivatedRoute, public authService: GrpcAuthService) {
     const breadcrumbs = [
       new Breadcrumb({
         type: BreadcrumbType.ORG,
@@ -55,4 +59,42 @@ export class OrgSettingsComponent {
       }
     });
   }
+
+  ngOnInit(): void {
+    checkSettingsPermissions(this.defaultSettingsList, PolicyComponentServiceType.MGMT, this.authService).subscribe(
+      (allowed) => {
+        this.settingsList = this.defaultSettingsList.filter((setting, index) => {
+          return allowed[index];
+        });
+      },
+    );
+  }
+}
+
+// Return a Observables<boolean>[] that will wait till all service calls are finished to then check if user is allowed to see a setting
+export function checkSettingsPermissions(settings: SidenavSetting[], serviceType: string, authService: GrpcAuthService) {
+  return forkJoin(
+    settings
+      .filter((setting) => {
+        if (serviceType === PolicyComponentServiceType.ADMIN) {
+          return setting.requiredRoles && setting.requiredRoles.admin;
+        } else {
+          return setting.requiredRoles && setting.requiredRoles.mgmt;
+        }
+      })
+      .map((setting) => {
+        if (!setting.requiredRoles) {
+          return of(true);
+        }
+
+        if (!setting.requiredRoles.mgmt) {
+          return of(true);
+        }
+
+        if (setting.requiredRoles.mgmt) {
+          return authService.isAllowed(setting.requiredRoles.mgmt).pipe(take(1));
+        }
+        return of(false);
+      }),
+  );
 }