feat: allow users with role Viewer and above to view resource quotas

master/internal/api_workspace.go

@@ -1558,8 +1558,8 @@ func (a *apiServer) GetKubernetesResourceQuotas(
 	if err != nil {
 		return nil, err
 	}
-	err = workspace.AuthZProvider.Get().CanGetWorkspaceID(
-		ctx, *curUser, req.Id,
+	err = workspace.AuthZProvider.Get().CanViewResourceQuotas(
+		ctx, *curUser,
 	)
 	if err != nil {
 		return nil, err

master/internal/workspace/authz_basic_impl.go

@@ -177,6 +177,12 @@ func (a *WorkspaceAuthZBasic) CanSetResourceQuotas(ctx context.Context, curUser
 	return nil
 }
 
+// CanViewResourceQuotas returns a nil error.
+func (a *WorkspaceAuthZBasic) CanViewResourceQuotas(ctx context.Context, curUser model.User,
+) error {
+	return nil
+}
+
 // CanSetWorkspacesDefaultPools returns a nil error.
 func (a *WorkspaceAuthZBasic) CanSetWorkspacesDefaultPools(
 	ctx context.Context, curUser model.User, workspace *workspacev1.Workspace,

master/internal/workspace/authz_iface.go

@@ -46,7 +46,7 @@ type WorkspaceAuthZ interface {
 	CanCreateWorkspaceWithCheckpointStorageConfig(ctx context.Context, curUser model.User) error
 	CanSetWorkspaceNamespaceBindings(ctx context.Context, curUser model.User) error
 	CanSetResourceQuotas(ctx context.Context, curUser model.User) error
-
+	CanViewResourceQuotas(ctx context.Context, curUser model.User) error
 	// PATCH /api/v1/workspaces/:workspace_id
 	CanSetWorkspacesName(
 		ctx context.Context, curUser model.User, workspace *workspacev1.Workspace,

master/internal/workspace/authz_permissive.go

@@ -171,6 +171,14 @@ func (p *WorkspaceAuthZPermissive) CanSetResourceQuotas(
 	return (&WorkspaceAuthZBasic{}).CanSetResourceQuotas(ctx, curUser)
 }
 
+// CanViewResourceQuotas calls RBAC authz but enforces basic authz.
+func (p *WorkspaceAuthZPermissive) CanViewResourceQuotas(
+	ctx context.Context, curUser model.User,
+) error {
+	_ = (&WorkspaceAuthZRBAC{}).CanViewResourceQuotas(ctx, curUser)
+	return (&WorkspaceAuthZBasic{}).CanViewResourceQuotas(ctx, curUser)
+}
+
 func init() {
 	AuthZProvider.Register("permissive", &WorkspaceAuthZPermissive{})
 }

master/internal/workspace/authz_rbac.go

@@ -397,6 +397,21 @@ func (r *WorkspaceAuthZRBAC) CanSetResourceQuotas(ctx context.Context,
 		rbacv1.PermissionType_PERMISSION_TYPE_SET_RESOURCE_QUOTAS)
 }
 
+// CanViewResourceQuotas determines whether a user can view resource quotas on a workspace.
+func (r *WorkspaceAuthZRBAC) CanViewResourceQuotas(ctx context.Context,
+	curUser model.User,
+) (err error) {
+	fields := audit.ExtractLogFields(ctx)
+	addInfoWithoutWorkspace(curUser, fields,
+		rbacv1.PermissionType_PERMISSION_TYPE_VIEW_RESOURCE_QUOTAS)
+	defer func() {
+		audit.LogFromErr(fields, err)
+	}()
+
+	return db.DoesPermissionMatch(ctx, curUser.ID, nil,
+		rbacv1.PermissionType_PERMISSION_TYPE_VIEW_RESOURCE_QUOTAS)
+}
+
 func hasPermissionOnWorkspace(ctx context.Context, uid model.UserID,
 	workspace *workspacev1.Workspace, permID rbacv1.PermissionType,
 ) error {

master/static/migrations/20240814123944_add-view-resource-quotas-permissions.tx.up.sql

@@ -0,0 +1,13 @@
+/* Add RBAC permissions for creating/updating/deleting namespace-workspace bindings and 
+resource quotas. */
+INSERT into permissions(id, name, global_only) VALUES 
+    (11003, 'view resource quotas', false);
+
+INSERT INTO permission_assignments(permission_id, role_id) VALUES
+    (11003, 1),
+    (11003, 2),
+    (11003, 4),
+    (11003, 5),
+    (11003, 7),
+    (11003, 8),
+    (11003, 9);

proto/src/determined/rbac/v1/rbac.proto

@@ -174,6 +174,9 @@ enum PermissionType {
 
   // Ability to set resource quotas on workspaces.
   PERMISSION_TYPE_SET_RESOURCE_QUOTAS = 11002;
+
+  // Ability to view resource quotas on workspaces.
+  PERMISSION_TYPE_VIEW_RESOURCE_QUOTAS = 11003;
 }
 
 // RoleAssignmentSummary is used to describe permissions a user has.

webui/react/src/components/WorkspaceCreateModal.tsx

@@ -63,6 +63,8 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
     canModifyWorkspaceCheckpointStorage,
     canSetWorkspaceNamespaceBindings,
     canSetResourceQuotas,
+    canViewResourceQuotas,
+    canModifyWorkspace,
   } = usePermissions();
   const info = useObservable(determinedStore.info);
   const [form] = Form.useForm<FormInputs>();
@@ -119,6 +121,8 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
     [resourceManagers, workspaceId],
   );
 
+  const loadedResourceQuotaList = Loadable.getOrElse({}, resourceQuotasList);
+
   const initFields = useCallback(
     (ws?: Workspace) => {
       if (ws) {
@@ -143,12 +147,12 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
         namespaceBindingsList.forEach((bindingsList) => {
           form.setFieldValue('bindings', { ...bindingsList });
         });
-        resourceQuotasList.forEach((quotasList) => {
-          form.setFieldValue('resourceQuotas', { ...quotasList });
-        });
+        for (const key in loadedResourceQuotaList) {
+          form.setFieldValue(['resourceQuotas', key], loadedResourceQuotaList[key]);
+        }
       }
     },
-    [form, namespaceBindingsList, resourceQuotasList],
+    [form, loadedResourceQuotaList, namespaceBindingsList],
   );
 
   const loadableWorkspace = useObservable(workspaceStore.getWorkspace(workspaceId || 0));
@@ -185,7 +189,10 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
               required: true,
             },
           ]}>
-          <Input maxLength={80} />
+          <Input
+            disabled={(workspace && !canModifyWorkspace({ workspace })) ?? false}
+            maxLength={80}
+          />
         </Form.Item>
         {canSetWorkspaceNamespaceBindings && resourceManagers.length > 0 && (
           <>
@@ -211,7 +218,12 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
                         name={['bindings', name, 'autoCreateNamespace']}
                         valuePropName="checked">
                         <Toggle
-                          onChange={() => form.setFieldValue(['resourceQuotas', name], undefined)}
+                          onChange={() => {
+                            form.setFieldValue(['resourceQuotas', name], undefined);
+                            if (loadedResourceQuotaList[name]) {
+                              delete loadedResourceQuotaList[name];
+                            }
+                          }}
                         />
                       </Form.Item>
                       {canSetResourceQuotas && (
@@ -238,6 +250,25 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
             </>
           </>
         )}
+        {!canSetWorkspaceNamespaceBindings &&
+          canViewResourceQuotas &&
+          workspaceId &&
+          info.branding === BrandingType.HPE &&
+          resourceManagers.length > 0 && (
+            <>
+              <Divider />
+              Resource Quotas
+              <>
+                {resourceManagers.map((name) => (
+                  <Fragment key={name}>
+                    <Form.Item label={`Cluster Name: ${name}`} name={['resourceQuotas', name]}>
+                      <Input disabled={true} />
+                    </Form.Item>
+                  </Fragment>
+                ))}
+              </>
+            </>
+          )}
         {canModifyAUG && (
           <>
             <Divider />
@@ -342,16 +373,20 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
     loadableWorkspace,
     form,
     idPrefix,
+    workspace,
+    canModifyWorkspace,
     canSetWorkspaceNamespaceBindings,
     resourceManagers,
+    canViewResourceQuotas,
+    info.branding,
     canModifyAUG,
     useAgentUser,
     useAgentGroup,
     canModifyCPS,
     useCheckpointStorage,
     watchBindings,
-    info.branding,
     canSetResourceQuotas,
+    loadedResourceQuotaList,
   ]);
 
   const handleSubmit = useCallback(async () => {
@@ -430,8 +465,22 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
           resourceQuotaBody['id'] = response.id;
         }
 
-        if (values.resourceQuotas) {
-          resourceQuotaBody['clusterQuotaPairs'] = pick(values.resourceQuotas, resourceManagers);
+        let submittedRQ = values.resourceQuotas;
+        if (loadedResourceQuotaList) {
+          submittedRQ = Object.keys(values.resourceQuotas ?? {}).reduce(
+            (memo: Record<string, number>, name) => {
+              if (values.resourceQuotas) {
+                if (values.resourceQuotas[name] !== loadedResourceQuotaList[name]) {
+                  memo[name] = values.resourceQuotas[name];
+                }
+              }
+              return memo;
+            },
+            {},
+          );
+        }
+        if (submittedRQ && Object.keys(submittedRQ).length !== 0) {
+          resourceQuotaBody['clusterQuotaPairs'] = pick(submittedRQ, resourceManagers);
           await setResourceQuotas(resourceQuotaBody);
         }
         form.resetFields();
@@ -455,26 +504,40 @@ const WorkspaceCreateModalComponent: React.FC<Props> = ({ onClose, workspaceId }
         });
       }
     }
-  }, [form, workspaceId, canModifyAUG, canModifyCPS, resourceManagers]);
+  }, [form, canModifyAUG, canModifyCPS, workspaceId, loadedResourceQuotaList, resourceManagers]);
 
-  return (
-    <Modal
-      cancel
-      size="medium"
-      submit={{
-        form: idPrefix + FORM_ID,
-        handleError,
-        handler: handleSubmit,
-        text: 'Save Workspace',
-      }}
-      title={`${workspaceId ? 'Edit' : 'New'} Workspace`}
-      onClose={() => {
-        initFields(undefined);
-        onClose?.();
-      }}>
-      {modalContent}
-    </Modal>
-  );
+  if ((workspace && !canModifyWorkspace({ workspace })) ?? false) {
+    return (
+      <Modal
+        size="medium"
+        title="Workspace Config"
+        onClose={() => {
+          initFields(undefined);
+          onClose?.();
+        }}>
+        {modalContent}
+      </Modal>
+    );
+  } else {
+    return (
+      <Modal
+        cancel
+        size="medium"
+        submit={{
+          form: idPrefix + FORM_ID,
+          handleError,
+          handler: handleSubmit,
+          text: 'Save Workspace',
+        }}
+        title={`${workspaceId ? 'Edit' : 'New'} Workspace`}
+        onClose={() => {
+          initFields(undefined);
+          onClose?.();
+        }}>
+        {modalContent}
+      </Modal>
+    );
+  }
 };
 
 export default WorkspaceCreateModalComponent;

webui/react/src/hooks/usePermissions.ts

@@ -106,6 +106,7 @@ export interface PermissionsHook {
   canViewModelRegistry: (arg0: WorkspacePermissionsArgs) => boolean;
   canViewWorkspace: (arg0: WorkspacePermissionsArgs) => boolean;
   canViewWorkspaces: boolean;
+  canViewResourceQuotas: boolean;
   loading: boolean;
 }
 
@@ -208,6 +209,7 @@ const usePermissions = (): PermissionsHook => {
       canViewGroups: canViewGroups(rbacOpts),
       canViewModelRegistry: (args: WorkspacePermissionsArgs) =>
         canViewModelRegistry(rbacOpts, args.workspace),
+      canViewResourceQuotas: canViewResourceQuotas(rbacOpts),
       canViewWorkspace: (args: WorkspacePermissionsArgs) =>
         canViewWorkspace(rbacOpts, args.workspace),
       canViewWorkspaces: canViewWorkspaces(rbacOpts),
@@ -626,6 +628,16 @@ const canSetResourceQuotas = ({
   );
 };
 
+const canViewResourceQuotas = ({
+  currentUser,
+  rbacEnabled,
+  userAssignments,
+  userRoles,
+}: RbacOptsProps): boolean => {
+  const permitted = relevantPermissions(userAssignments, userRoles);
+  return !!currentUser && (!rbacEnabled || permitted.has(V1PermissionType.VIEWRESOURCEQUOTAS));
+};
+
 const canViewWorkspace = (
   { rbacEnabled, userAssignments, userRoles }: RbacOptsProps,
   workspace?: PermissionWorkspace,