Merge branch 'opendatahub-io:main' into main

frontend/src/__mocks__/mockModelRegistryService.ts

@@ -0,0 +1,38 @@
+import { ServiceKind } from '~/k8sTypes';
+
+type MockServiceType = {
+  name?: string;
+  namespace?: string;
+};
+
+export const mockModelRegistryService = ({
+  name = 'modelregistry-sample',
+  namespace = 'odh-model-registries',
+}: MockServiceType): ServiceKind => ({
+  kind: 'Service',
+  apiVersion: 'v1',
+  metadata: {
+    name,
+    namespace,
+  },
+  spec: {
+    selector: {
+      app: name,
+      component: 'model-registry',
+    },
+    ports: [
+      {
+        name: 'grpc-api',
+        protocol: 'TCP',
+        port: 9090,
+        targetPort: 9090,
+      },
+      {
+        name: 'http-api',
+        protocol: 'TCP',
+        port: 8080,
+        targetPort: 8080,
+      },
+    ],
+  },
+});

frontend/src/__mocks__/mockRoleBindingK8sResource.ts

@@ -8,6 +8,7 @@ type MockResourceConfigType = {
   roleRefName?: string;
   uid?: string;
   modelRegistryName?: string;
+  isProjectSubject?: boolean;
 };
 
 export const mockRoleBindingK8sResource = ({
@@ -22,6 +23,7 @@ export const mockRoleBindingK8sResource = ({
   ],
   roleRefName = 'view',
   uid = genUID('rolebinding'),
+  isProjectSubject = false,
   modelRegistryName = '',
 }: MockResourceConfigType): RoleBindingKind => {
   let labels;
@@ -33,6 +35,7 @@ export const mockRoleBindingK8sResource = ({
       'app.kubernetes.io/part-of': 'model-registry',
       [KnownLabels.DASHBOARD_RESOURCE]: 'true',
       component: 'model-registry',
+      ...(isProjectSubject && { [KnownLabels.PROJECT_SUBJECT]: 'true' }),
     };
   } else {
     labels = {

frontend/src/__mocks__/mockSelfSubjectRulesReview.ts

@@ -0,0 +1,238 @@
+import { SelfSubjectRulesReviewKind } from '~/k8sTypes';
+
+export const mockSelfSubjectRulesReview = (): SelfSubjectRulesReviewKind => ({
+  kind: 'SelfSubjectRulesReview',
+  apiVersion: 'authorization.k8s.io/v1',
+  spec: {
+    namespace: 'odh-model-registries',
+  },
+  status: {
+    resourceRules: [
+      {
+        verbs: ['create'],
+        apiGroups: ['', 'project.openshift.io'],
+        resources: ['projectrequests'],
+      },
+      {
+        verbs: ['impersonate'],
+        apiGroups: ['authentication.k8s.io'],
+        resources: ['userextras/scopes.authorization.openshift.io'],
+      },
+      {
+        verbs: ['get', 'list', 'watch'],
+        apiGroups: ['helm.openshift.io'],
+        resources: ['helmchartrepositories'],
+      },
+      {
+        verbs: ['create'],
+        apiGroups: ['authorization.k8s.io'],
+        resources: ['selfsubjectaccessreviews', 'selfsubjectrulesreviews'],
+      },
+      {
+        verbs: ['create'],
+        apiGroups: ['authentication.k8s.io'],
+        resources: ['selfsubjectreviews'],
+      },
+      {
+        verbs: ['create'],
+        apiGroups: ['', 'project.openshift.io'],
+        resources: ['projectrequests'],
+      },
+      {
+        verbs: ['get', 'list', 'watch', 'delete'],
+        apiGroups: ['oauth.openshift.io'],
+        resources: ['useroauthaccesstokens'],
+      },
+      {
+        verbs: ['get', 'list', 'watch'],
+        apiGroups: ['snapshot.storage.k8s.io'],
+        resources: ['volumesnapshotclasses'],
+      },
+      {
+        verbs: ['get'],
+        apiGroups: ['', 'user.openshift.io'],
+        resources: ['users'],
+        resourceNames: ['~'],
+      },
+      {
+        verbs: ['list'],
+        apiGroups: ['', 'project.openshift.io'],
+        resources: ['projectrequests'],
+      },
+      {
+        verbs: ['get', 'list'],
+        apiGroups: ['', 'authorization.openshift.io'],
+        resources: ['clusterroles'],
+      },
+      {
+        verbs: ['get', 'list', 'watch'],
+        apiGroups: ['rbac.authorization.k8s.io'],
+        resources: ['clusterroles'],
+      },
+      {
+        verbs: ['get', 'list'],
+        apiGroups: ['storage.k8s.io'],
+        resources: ['storageclasses'],
+      },
+      {
+        verbs: ['list', 'watch'],
+        apiGroups: ['', 'project.openshift.io'],
+        resources: ['projects'],
+      },
+      {
+        verbs: ['create'],
+        apiGroups: ['', 'authorization.openshift.io'],
+        resources: ['selfsubjectrulesreviews'],
+      },
+      {
+        verbs: ['create'],
+        apiGroups: ['authorization.k8s.io'],
+        resources: ['selfsubjectaccessreviews'],
+      },
+      {
+        verbs: ['delete'],
+        apiGroups: ['', 'oauth.openshift.io'],
+        resources: ['oauthaccesstokens', 'oauthauthorizetokens'],
+      },
+      {
+        verbs: ['create'],
+        apiGroups: ['', 'build.openshift.io'],
+        resources: ['builds/source'],
+      },
+      {
+        verbs: ['create'],
+        apiGroups: ['', 'authorization.openshift.io'],
+        resources: ['selfsubjectrulesreviews'],
+      },
+      {
+        verbs: ['create'],
+        apiGroups: ['authorization.k8s.io'],
+        resources: ['selfsubjectaccessreviews'],
+      },
+      {
+        verbs: ['create', 'get'],
+        apiGroups: ['', 'build.openshift.io'],
+        resources: ['buildconfigs/webhooks'],
+      },
+      {
+        verbs: ['create'],
+        apiGroups: ['', 'build.openshift.io'],
+        resources: ['builds/jenkinspipeline'],
+      },
+      {
+        verbs: ['use'],
+        apiGroups: ['security.openshift.io'],
+        resources: ['securitycontextconstraints'],
+        resourceNames: ['restricted-v2'],
+      },
+      {
+        verbs: ['get', 'list', 'watch'],
+        apiGroups: ['console.openshift.io'],
+        resources: [
+          'consoleclidownloads',
+          'consoleexternalloglinks',
+          'consolelinks',
+          'consolenotifications',
+          'consoleplugins',
+          'consolequickstarts',
+          'consolesamples',
+          'consoleyamlsamples',
+        ],
+      },
+      {
+        verbs: ['create'],
+        apiGroups: ['', 'build.openshift.io'],
+        resources: ['builds/docker', 'builds/optimizeddocker'],
+      },
+      {
+        verbs: ['get'],
+        apiGroups: [''],
+        resources: ['services'],
+        resourceNames: ['modelregistry-sample'],
+      },
+      {
+        verbs: ['get'],
+        apiGroups: [''],
+        resources: ['services'],
+        resourceNames: ['dallas-mr'],
+      },
+    ],
+    nonResourceRules: [
+      {
+        verbs: ['get'],
+        nonResourceURLs: ['/healthz', '/healthz/'],
+      },
+      {
+        verbs: ['get'],
+        nonResourceURLs: [
+          '/version',
+          '/version/*',
+          '/api',
+          '/api/*',
+          '/apis',
+          '/apis/*',
+          '/oapi',
+          '/oapi/*',
+          '/openapi/v2',
+          '/swaggerapi',
+          '/swaggerapi/*',
+          '/swagger.json',
+          '/swagger-2.0.0.pb-v1',
+          '/osapi',
+          '/osapi/',
+          '/.well-known',
+          '/.well-known/oauth-authorization-server',
+          '/',
+        ],
+      },
+      {
+        verbs: ['get'],
+        nonResourceURLs: [
+          '/version',
+          '/version/*',
+          '/api',
+          '/api/*',
+          '/apis',
+          '/apis/*',
+          '/oapi',
+          '/oapi/*',
+          '/openapi/v2',
+          '/swaggerapi',
+          '/swaggerapi/*',
+          '/swagger.json',
+          '/swagger-2.0.0.pb-v1',
+          '/osapi',
+          '/osapi/',
+          '/.well-known',
+          '/.well-known/oauth-authorization-server',
+          '/',
+        ],
+      },
+      {
+        verbs: ['get'],
+        nonResourceURLs: [
+          '/api',
+          '/api/*',
+          '/apis',
+          '/apis/*',
+          '/healthz',
+          '/livez',
+          '/openapi',
+          '/openapi/*',
+          '/readyz',
+          '/version',
+          '/version/',
+        ],
+      },
+      {
+        verbs: ['get'],
+        nonResourceURLs: ['/.well-known', '/.well-known/*'],
+      },
+      {
+        verbs: ['get'],
+        nonResourceURLs: ['/healthz', '/livez', '/readyz', '/version', '/version/'],
+      },
+    ],
+    incomplete: false,
+  },
+});

frontend/src/__tests__/cypress/cypress/pages/modelRegistryPermissions.ts

@@ -3,7 +3,35 @@ import { TableRow } from './components/table';
 
 class PermissionsTableRow extends TableRow {}
 
-class UsersTab {
+class UsersTab extends Contextual<HTMLElement> {
+  findAddUserButton() {
+    return this.find().findByTestId('add-button user');
+  }
+
+  findAddGroupButton() {
+    return this.find().findByTestId('add-button group');
+  }
+
+  getUserTable() {
+    return new PermissionTable(() => this.find().findByTestId('role-binding-table User'));
+  }
+
+  getGroupTable() {
+    return new PermissionTable(() => this.find().findByTestId('role-binding-table Group'));
+  }
+}
+
+class ProjectsTab extends Contextual<HTMLElement> {
+  findAddProjectButton() {
+    return this.find().findByTestId('add-button project');
+  }
+
+  getProjectTable() {
+    return new PermissionTable(() => this.find().findByTestId('role-binding-table Group'));
+  }
+}
+
+class MRPermissions {
   visit(mrName: string, wait = true) {
     cy.visitWithLogin(`/modelRegistrySettings/permissions/${mrName}`);
     if (wait) {
@@ -16,20 +44,16 @@ class UsersTab {
     cy.testA11y();
   }
 
-  findAddUserButton() {
-    return cy.findByTestId('add-button User');
-  }
-
-  findAddGroupButton() {
-    return cy.findByTestId('add-button Group');
+  findProjectTab() {
+    return cy.findByTestId('projects-tab');
   }
 
-  getUserTable() {
-    return new PermissionTable(() => cy.findByTestId('role-binding-table User'));
+  getUsersContent() {
+    return new UsersTab(() => cy.findByTestId('users-tab-content'));
   }
 
-  getGroupTable() {
-    return new PermissionTable(() => cy.findByTestId('role-binding-table Group'));
+  getProjectsContent() {
+    return new ProjectsTab(() => cy.findByTestId('projects-tab-content'));
   }
 }
 
@@ -46,7 +70,7 @@ class PermissionTable extends Contextual<HTMLElement> {
     return this.find().findByTestId(['role-binding-name-input', id]);
   }
 
-  findGroupSelect() {
+  findNameSelect() {
     return this.find().get(`[aria-label="Name selection"]`);
   }
 
@@ -69,4 +93,4 @@ class PermissionTable extends Contextual<HTMLElement> {
   }
 }
 
-export const usersTab = new UsersTab();
+export const modelRegistryPermissions = new MRPermissions();

frontend/src/__tests__/cypress/cypress/pages/permissions.ts

@@ -15,11 +15,11 @@ class PermissionsTab {
   }
 
   findAddUserButton() {
-    return cy.findByTestId('add-button User');
+    return cy.findByTestId('add-button user');
   }
 
   findAddGroupButton() {
-    return cy.findByTestId('add-button Group');
+    return cy.findByTestId('add-button group');
   }
 
   getUserTable() {