fix deprecated autocluster AppInst org check (#1373)

mc/orm/authz_cloudlet.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	fmt "fmt"
 	"net/http"
-	"strings"
 
 	"github.com/labstack/echo"
 	"github.com/mobiledgex/edge-cloud-infra/mc/ormapi"
@@ -208,17 +207,17 @@ func authzCreateAppInst(ctx context.Context, region, username string, obj *edgep
 	if authzOk, _ := authzCloudlet.Ok(&cloudlet); !authzOk {
 		return echo.ErrForbidden
 	}
-	// Developers can't create AppInsts on other developer's ClusterInsts,
-	// except for autoclusters where ClusterInst org is MobiledgeX.
-	autocluster := false
-	if strings.HasPrefix(obj.Key.ClusterInstKey.ClusterKey.Name, cloudcommon.AutoClusterPrefix) {
-		if obj.Key.ClusterInstKey.Organization != cloudcommon.OrganizationMobiledgeX {
-			return echo.NewHTTPError(http.StatusBadRequest, fmt.Errorf("Autocluster AppInst's ClusterInst organization must be %s", cloudcommon.OrganizationMobiledgeX))
+	// The autocluster organization checks are now dependent on the CRM version,
+	// so these checks are left to the Controller. The MC is only
+	// concerned about RBAC permissions, so only ensures that different
+	// organizations are not encroaching on each other.
+	if obj.Key.AppKey.Organization != obj.Key.ClusterInstKey.Organization && obj.Key.ClusterInstKey.Organization != "" {
+		// Sidecar apps may have MobiledgeX organization, or
+		// target ClusterInst may be MobiledgeX reservable/multitenant.
+		// So one of the orgs must be MobiledgeX to pass RBAC.
+		if obj.Key.AppKey.Organization != cloudcommon.OrganizationMobiledgeX && obj.Key.ClusterInstKey.Organization != cloudcommon.OrganizationMobiledgeX {
+			return echo.ErrForbidden
 		}
-		autocluster = true
-	}
-	if !authzCloudlet.admin && !autocluster && obj.Key.ClusterInstKey.Organization != "" && obj.Key.ClusterInstKey.Organization != obj.Key.AppKey.Organization {
-		return echo.NewHTTPError(http.StatusBadRequest, fmt.Errorf("AppInst organization must match ClusterInst organization"))
 	}
 	return nil
 }

mc/orm/ctrl_test.go

@@ -385,11 +385,25 @@ func TestController(t *testing.T) {
 		// developers can't create AppInsts on other developemar's ClusterInsts
 		appinst := edgeproto.AppInst{}
 		appinst.Key.AppKey.Organization = org1
-		appinst.Key.ClusterInstKey.Organization = cloudcommon.OrganizationMobiledgeX
+		appinst.Key.ClusterInstKey.Organization = org2
 		_, status, err := ormtestutil.TestCreateAppInst(mcClient, uri, tokenDev, ctrl.Region, &appinst)
 		require.NotNil(t, err)
-		require.Contains(t, err.Error(), "AppInst organization must match ClusterInst organization")
-		// but admin can
+		require.Contains(t, err.Error(), "Forbidden")
+		// developers can create against MobiledgeX ClusterInsts
+		// (reservable or multitenant).
+		appinst.Key.AppKey.Organization = org1
+		appinst.Key.ClusterInstKey.Organization = cloudcommon.OrganizationMobiledgeX
+		_, status, err = ormtestutil.TestCreateAppInst(mcClient, uri, tokenDev, ctrl.Region, &appinst)
+		require.Nil(t, err)
+		require.Equal(t, http.StatusOK, status)
+		_, status, err = ormtestutil.TestDeleteAppInst(mcClient, uri, tokenDev, ctrl.Region, &appinst)
+		require.Nil(t, err)
+		require.Equal(t, http.StatusOK, status)
+		// Only admin can create MobiledgeX sidecar apps, since other
+		// developers won't have App rbac perms for org MobiledgeX.
+		testCreateOrg(t, mcClient, uri, tokenAd, OrgTypeDeveloper, cloudcommon.OrganizationMobiledgeX)
+		appinst.Key.AppKey.Organization = cloudcommon.OrganizationMobiledgeX
+		appinst.Key.ClusterInstKey.Organization = org2
 		_, status, err = ormtestutil.TestCreateAppInst(mcClient, uri, tokenAd, ctrl.Region, &appinst)
 		require.Nil(t, err)
 		require.Equal(t, http.StatusOK, status)