Move messages is not visible for users with management tag

[ruben-janssens]

Describe the bug

The Move messages is not visible form is not usable for users with the management tag, only administrator can do this.

Reproduction steps

Have a cluster with the shovel and the management plugin.
Create a user with the management tag and .* on a vhost with a queue.
The user does not have the option to Move messages.

Expected behavior

A user with the management tag should be able to use the Move messages functionality in the vhost with .* permissions within that vhost.

Additional context

No response

[michaelklishin]

@ruben-janssens it's a philosophical question, whether users with the management tag should be allowed to use Shovels and thus the Move Messages feature.

On one hand, one alternative is to use CLI tools, which requires the highest privileges possible.
On the other, a client library can consume and re-publish as long as it has access to both the source and the destination.

However, the UI code cannot know where you are going to move messages so it can either display a form you won't be able to use, or hide it.

As you can see, it is not nearly as clear cut as you claim it to be. This is the first time I see this topic mentioned in my close to 15 years around RabbitMQ.

[ruben-janssens]

My interpretation of the management tag is that it's only used to give an user access to the management interface. It is the permissions one has on the vhost that allows one to create/use a shovel.

Just like only the vhosts you have access to are shown could it also not be determined if the Move messages feature is enabled/usable as this is to move messages within the same vhost (I think) ?

[michaelklishin]

Like I said, the UI code cannot predict where the messages will be moved, and it is not permissions aware beyond the list of virtual hosts. It depends on the server for filtering of response data.

It's difficult to justify spending time on something like this for our small team.

[ruben-janssens]

Would it be an acceptable change to always display the Move messages form and let the backend decide if it's allowed further.
We now have to give users the administrator tag to let them use the functionality.

[michaelklishin]

@ruben-janssens showing a form that does not actually work due to the limited permissions sounds like an equally (potentially) frustrating solution.

We'll do this instead rabbitmq/rabbitmqadmin-ng#46. This command
will always be "visible" and we can add some documentation to its --help message.

[ruben-janssens]

As long as a proper error is returned to the user I don't think this would be frustrating. In my opinion it's more frustrating that the option is not available to regular users and only to administrators.

[lukebakken]

@ruben-janssens you can use the HTTP API if the users who need to create shovels have the policymaker tag -

https://www.rabbitmq.com/docs/shovel-dynamic#using-http-api

In your case, you would have to write your own application to create the necessary policy to start the shovel.

[michaelklishin]

More like a script that'd be a few lines long.

This reminds me, we need to add Shovel operations support to rabbitmqadmin v2.

[michaelklishin]

rabbitmq/rabbitmqadmin-ng#46

[ruben-janssens]

Sadly scripts are not an option because the users are determined to use the web UI