From d0904bd72c2f4f413cc810fd9441ce4fde8618b1 Mon Sep 17 00:00:00 2001
From: Georgy Karataev <georgkarat@gmail.com>
Date: Wed, 30 Aug 2023 12:03:42 +0200
Subject: [PATCH] fix(ESSNTL-5253): Change required permissions for tabs
 (#2003)

Fixes https://issues.redhat.com/browse/ESSNTL-5253.
---
 package-lock.json     |  8 ++++----
 package.json          |  2 +-
 src/App.js            |  5 ++++-
 src/ApplicationTab.js |  8 +++++---
 src/constants.js      | 10 ++++------
 5 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 12e88a1d7..4d0de8458 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14,7 +14,7 @@
         "@patternfly/react-core": "^4.276.11",
         "@patternfly/react-icons": "^4.93.7",
         "@patternfly/react-table": "^4.113.3",
-        "@redhat-cloud-services/frontend-components": "^3.11.3",
+        "@redhat-cloud-services/frontend-components": "^3.11.6",
         "@redhat-cloud-services/frontend-components-notifications": "^3.2.16",
         "@redhat-cloud-services/frontend-components-utilities": "^3.7.6",
         "@redhat-cloud-services/host-inventory-client": "1.2.3",
@@ -4684,9 +4684,9 @@
       }
     },
     "node_modules/@redhat-cloud-services/frontend-components": {
-      "version": "3.11.3",
-      "resolved": "https://registry.npmjs.org/@redhat-cloud-services/frontend-components/-/frontend-components-3.11.3.tgz",
-      "integrity": "sha512-KP8B8ggHVxoxKiLGHcWct7gnbXKL1oqket02qDrm+asSAfMKjABxif/gm9DOGj8lub6lRoRLM2/XW2cKRxSFzA==",
+      "version": "3.11.7",
+      "resolved": "https://registry.npmjs.org/@redhat-cloud-services/frontend-components/-/frontend-components-3.11.7.tgz",
+      "integrity": "sha512-duFjBf8kTnJ6gYdQpGwTG2GPkye3WHpsUkqn0vsPJi/xccey4/m0wVWmCTD2U08wbOBNzqsymCcMGrnZaRumRg==",
       "dependencies": {
         "@redhat-cloud-services/frontend-components-utilities": "^3.2.25",
         "@redhat-cloud-services/types": "^0.0.24",
diff --git a/package.json b/package.json
index 542de520b..d3b4b0812 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "@patternfly/react-table": "^4.113.3",
     "@patternfly/react-core": "^4.276.11",
     "@patternfly/react-icons": "^4.93.7",
-    "@redhat-cloud-services/frontend-components": "^3.11.3",
+    "@redhat-cloud-services/frontend-components": "^3.11.6",
     "@redhat-cloud-services/frontend-components-notifications": "^3.2.16",
     "@redhat-cloud-services/frontend-components-utilities": "^3.7.6",
     "@redhat-cloud-services/host-inventory-client": "1.2.3",
diff --git a/src/App.js b/src/App.js
index 1f300d311..830570610 100644
--- a/src/App.js
+++ b/src/App.js
@@ -9,7 +9,10 @@ const App = () => {
   return (
     <div className="inventory">
       <NotificationsPortal />
-      <RBACProvider appName="inventory" checkResourceDefinitions>
+      <RBACProvider
+        appName={null /* fetch permissions from all scopes */}
+        checkResourceDefinitions
+      >
         <Routes />
       </RBACProvider>
     </div>
diff --git a/src/ApplicationTab.js b/src/ApplicationTab.js
index 7d3f2b9e2..d91570a68 100644
--- a/src/ApplicationTab.js
+++ b/src/ApplicationTab.js
@@ -12,8 +12,10 @@ import {
 import { TAB_REQUIRED_PERMISSIONS } from './constants';
 
 const ApplicationTab = ({ appName, title, ...props }) => {
-  const { hasAccess } = usePermissionsWithContext(
-    TAB_REQUIRED_PERMISSIONS[appName]
+  const { hasAccess, isOrgAdmin } = usePermissionsWithContext(
+    TAB_REQUIRED_PERMISSIONS[appName],
+    true,
+    false
   );
 
   const tabs = {
@@ -26,7 +28,7 @@ const ApplicationTab = ({ appName, title, ...props }) => {
 
   const Tab = tabs[appName];
 
-  return hasAccess ? (
+  return hasAccess || isOrgAdmin ? (
     <Tab {...props} />
   ) : (
     <AccessDenied
diff --git a/src/constants.js b/src/constants.js
index 8d4e3d452..2379f0526 100644
--- a/src/constants.js
+++ b/src/constants.js
@@ -249,24 +249,22 @@ export const USER_ACCESS_ADMIN_PERMISSIONS = ['rbac:*:*'];
 export const TAB_REQUIRED_PERMISSIONS = {
   /**
    * Should be up to date with
-   * https://github.com/RedHatInsights/rbac-config/tree/88ab3a3adb9526d3dcdb0e1e26c30cc98f51f76e/configs/prod/roles
+   * https://github.com/RedHatInsights/rbac-config/tree/master/configs/stage/roles
    * viewer roles.
    */
-  advisor: ['advisor:*:*', 'inventory:*:read'],
+  advisor: [],
   vulnerability: [
     'vulnerability:vulnerability_results:read',
     'vulnerability:system.opt_out:read',
     'vulnerability:report_and_export:read',
-    'inventory:*:read',
     'vulnerability:advanced_report:read',
   ],
   compliance: [
     'compliance:policy:read',
     'compliance:report:read',
     'compliance:system:read',
-    'inventory:*:read',
     'remediations:remediation:read',
   ],
-  patch: ['patch:*:read', 'inventory:*:read'],
-  ros: ['ros:*:read', 'inventory:*:read'],
+  patch: ['patch:*:read'],
+  ros: ['ros:*:read'],
 };