update #3203

swami134 · 2025-09-05T04:49:48Z

Description

(insert summary)

Type of change

Please delete options that are not relevant.

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

My code follows the style guidelines of this project
I have performed a self-review of my own code
I have made corresponding changes to the documentation
I have added tests that prove my fix is effective or that my feature works

Copilot

Pull Request Overview

This PR adds comprehensive Role-Based Access Control (RBAC) functionality to the Caldera platform through multiple new plugins and middleware enhancements.

Implements an RBAC plugin with GUI for managing user permissions and ability assignments
Adds a testing plugin that demonstrates RBAC integration and provides utility interfaces
Introduces logging middleware for request filtering and access control enforcement

Reviewed Changes

Copilot reviewed 42 out of 57 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
server.py	Adds logging middleware integration to main application and v2 API routes
plugins/rbac/*	Complete RBAC plugin implementation with GUI, state management, and API endpoints
plugins/testing/*	Testing plugin with RBAC demonstrations and utility interfaces
app/api/v2/logging_middleware.py	Middleware for enforcing RBAC policies and request filtering
plugins/helloworld/*	Basic example plugin with authentication features
plugins/accesscontrol/*	React-based access control plugin with user management
plugins/studentlab/*	Plugin for student-specific ability assignments and operations

Files not reviewed (1)

caldera/package-lock.json: Language not supported

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-29T23:24:55Z

server.py

 from app.utility.base_world import BaseWorld
 from app.utility.config_generator import ensure_local_config
-
+from app.api.v2.logging_middleware import log_all_requests


The import name 'log_all_requests' is misleading as this middleware actually performs RBAC enforcement and filtering rather than just logging. Consider renaming to 'rbac_enforcement_middleware' or similar to better reflect its purpose.

Copilot · 2025-09-29T23:24:55Z

server.py

+    # app_svc.register_subapp("/api/v2", app.api.v2.make_app(app_svc.get_services()))    # converted into two liner below
+    v2_app = app.api.v2.make_app(app_svc.get_services())
+    v2_app.middlewares.append(log_all_requests)  # <-- add this line


The comment and inline comment create redundancy. The commented-out line should be removed as it serves no purpose, and the inline comment is unnecessary given the clear variable names.

Suggested change

# app_svc.register_subapp("/api/v2", app.api.v2.make_app(app_svc.get_services())) # converted into two liner below

v2_app = app.api.v2.make_app(app_svc.get_services())

v2_app.middlewares.append(log_all_requests) # <-- add this line

v2_app = app.api.v2.make_app(app_svc.get_services())

v2_app.middlewares.append(log_all_requests)

Copilot · 2025-09-29T23:24:56Z

plugins/testing/hook.py

+from aiohttp_jinja2 import template
+from app.service.auth_svc import check_authorization


Duplicate imports detected. Lines 2-3 and 7-8 import the same modules. Remove the duplicate imports on lines 7-8.

Suggested change

from aiohttp_jinja2 import template

from app.service.auth_svc import check_authorization

Copilot · 2025-09-29T23:24:56Z

plugins/testing/hook.py

+    static_dir = Path(__file__).parent / 'static'
+    app.router.add_static('/plugin/testing/static', path=str(static_dir), append_version=True)


Duplicate static directory setup. Lines 23-25 and 41-42 both set up the same static directory route. Remove the duplicate setup on lines 41-42.

Suggested change

static_dir = Path(__file__).parent / 'static'

app.router.add_static('/plugin/testing/static', path=str(static_dir), append_version=True)

Copilot · 2025-09-29T23:24:56Z

plugins/helloworld/static/index.html

+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>hello word Plugin</title>


Typo in the title: 'hello word' should be 'hello world'.

Suggested change

<title>hello word Plugin</title>

<title>hello world Plugin</title>

Copilot · 2025-09-29T23:24:56Z

plugins/helloworld/static/index.html

+    <title>hello word Plugin</title>
+</head>
+<body>
+    <h1>This is my first hello world plugin ui for <p style="color: red;">Calder</p></h1>


Incorrect product name: 'Calder' should be 'Caldera'.

Suggested change

<h1>This is my first hello world plugin ui for <p style="color: red;">Calder</p></h1>

<h1>This is my first hello world plugin ui for <p style="color: red;">Caldera</p></h1>

Copilot · 2025-09-29T23:24:57Z

plugins/accesscontrol/hook.py

+    from .app.api.accesscontrol_api import add_routes, add_gui_routes
+    await add_routes(app_svc.application, services)


Duplicate import and function calls. Lines 16-17 already import and call add_routes, making lines 19-21 redundant. Remove the duplicate code.

Suggested change

from .app.api.accesscontrol_api import add_routes, add_gui_routes

await add_routes(app_svc.application, services)

from .app.api.accesscontrol_api import add_gui_routes

Copilot · 2025-09-29T23:24:57Z

app/api/v2/logging_middleware.py

+            parts = path.split('/')
+            plugin_name = parts[2] if len(parts) > 2 else ''
+            blocked = _get_blocked_plugins_for_user(request, user)
+            if plugin_name and plugin_name in blocked:
+                if path.startswith('/plugin/') or path.startswith('/plugins/'):
+                    return web.Response(text=f"Plugin '{plugin_name}' is not available for your role.", status=403, content_type='text/html')
+                return web.json_response({"error": "Forbidden for your role"}, status=403)


Duplicate plugin blocking logic. This code block (lines 170-176) duplicates the same logic from lines 159-169. The duplicate block should be removed as it's unreachable and creates confusion.

Suggested change

parts = path.split('/')

plugin_name = parts[2] if len(parts) > 2 else ''

blocked = _get_blocked_plugins_for_user(request, user)

if plugin_name and plugin_name in blocked:

if path.startswith('/plugin/') or path.startswith('/plugins/'):

return web.Response(text=f"Plugin '{plugin_name}' is not available for your role.", status=403, content_type='text/html')

return web.json_response({"error": "Forbidden for your role"}, status=403)

deacon-mp · 2025-10-06T22:30:41Z

Can you Address the comments above and resubmit for approval

sonarqubecloud · 2025-10-06T22:44:28Z

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

swaminathan33 and others added 25 commits September 5, 2025 04:48

update

f163802

testing

d0b0b41

rbac.html css testing

2d4e888

dropdown user selection

96a1f61

update issue solved

9a40022

issue updated

7f8a6bb

sdfas

179637f

dfasfd

ce6ae4c

sdfasdf

6a4ba12

Assigning ability per user final code

15e1049

plugin blocking based on role starting code

4d7baaa

plugin blocking based on role starting code

5574a37

updated code for plugin blocking

75c12ff

updated plugin blocking

60b44f7

updated plugin blocking

4eaebee

updated plugin blocking

a31bbf3

creating new users

b706430

rbac tabs

68fc38b

updates rbac tabs

b03b22f

updated tabs

72e1db4

updated tabls 2

2050afd

updated after testing

6190e9b

updated

10add3d

new one

8c46487

RBAC FINAL UPDATED 8/9/25

1b2af19

deacon-mp requested a review from Copilot September 29, 2025 23:23

Copilot AI reviewed Sep 29, 2025

View reviewed changes

Merge branch 'master' into rbac

1739139

Merge branch 'master' into rbac

b016c66

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

update #3203

update #3203

swami134 commented Sep 5, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Sep 29, 2025

Uh oh!

Copilot AI Sep 29, 2025

Uh oh!

Copilot AI Sep 29, 2025

Uh oh!

Copilot AI Sep 29, 2025

Uh oh!

Copilot AI Sep 29, 2025

Uh oh!

Copilot AI Sep 29, 2025

Uh oh!

Copilot AI Sep 29, 2025

Uh oh!

Copilot AI Sep 29, 2025

Uh oh!

deacon-mp commented Oct 6, 2025

Uh oh!

sonarqubecloud bot commented Oct 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		from aiohttp_jinja2 import template
		from app.service.auth_svc import check_authorization

		static_dir = Path(__file__).parent / 'static'
		app.router.add_static('/plugin/testing/static', path=str(static_dir), append_version=True)

	<title>hello word Plugin</title>
	<title>hello world Plugin</title>

	<h1>This is my first hello world plugin ui for <p style="color: red;">Calder</p></h1>
	<h1>This is my first hello world plugin ui for <p style="color: red;">Caldera</p></h1>

		from .app.api.accesscontrol_api import add_routes, add_gui_routes
		await add_routes(app_svc.application, services)

Uh oh!

update #3203

Are you sure you want to change the base?

update #3203

Conversation

swami134 commented Sep 5, 2025

Description

Type of change

How Has This Been Tested?

Checklist:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

deacon-mp commented Oct 6, 2025

Uh oh!

sonarqubecloud bot commented Oct 6, 2025

Quality Gate failed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants