feat(manualjudgment): Select roles that can execute manual judgement …

app/scripts/modules/core/src/application/service/ApplicationReader.ts

@@ -41,6 +41,17 @@ export class ApplicationReader {
       });
   }
 
+  public static getApplicationPermissions(applicationName: string): IPromise < any > {
+        return API.one('applications', applicationName)
+            .withParams({
+                expand: false
+            })
+            .get()
+            .then((fromServer: Application) => {
+                return fromServer.attributes.permissions;
+            });
+    }
+
   public static getApplication(name: string, expand = true): IPromise<Application> {
     return API.one('applications', name)
       .withParams({ expand: expand })

app/scripts/modules/core/src/pipeline/config/stages/manualJudgment/ManualJudgmentApproval.tsx

@@ -5,6 +5,8 @@ import { IExecution, IExecutionStage } from 'core/domain';
 import { Application } from 'core/application/application.model';
 import { Markdown } from 'core/presentation/Markdown';
 import { NgReact, ReactInjector } from 'core/reactShims';
+import { ApplicationReader } from 'core/application/service/ApplicationReader';
+import { AuthenticationService } from 'core/authentication';
 
 export interface IManualJudgmentApprovalProps {
   execution: IExecution;
@@ -16,6 +18,10 @@ export interface IManualJudgmentApprovalState {
   submitting: boolean;
   judgmentDecision: string;
   judgmentInput: { value?: string };
+  applicationRoles: { READ?: string[], WRITE?: string[], EXECUTE?: string[] };
+  appRoles: string[];
+  runOnce: boolean;
+  userRoles: string[];
   error: boolean;
 }
 
@@ -29,10 +35,37 @@ export class ManualJudgmentApproval extends React.Component<
       submitting: false,
       judgmentDecision: null,
       judgmentInput: {},
+      applicationRoles: {},
+      appRoles: [],
+      runOnce: true,
+      userRoles: [],
       error: false,
     };
   }
 
+  public componentDidMount() {
+      if (this.state.runOnce) {
+          const applicationName = this.props.execution.application;
+          ApplicationReader.getApplicationPermissions(applicationName)
+              .then(result => {
+                  if (typeof result !== 'undefined') {
+                      this.setState({
+                          applicationRoles: result,
+                          runOnce: false,
+                      })
+                      this.populateApplicationRoles();
+                      this.isStageAuthorized();
+                  }
+              })
+              .catch(error => this.setState({
+                  error,
+              }));
+          this.setState({
+              userRoles: AuthenticationService.getAuthenticatedUser().roles
+          });
+      }
+  }
+
   private provideJudgment(judgmentDecision: string): void {
     const { application, execution, stage } = this.props;
     const judgmentInput: string = this.state.judgmentInput ? this.state.judgmentInput.value : null;
@@ -47,6 +80,36 @@ export class ManualJudgmentApproval extends React.Component<
     );
   }
 
+  private populateApplicationRoles(): void {
+      const readArray = this.state.applicationRoles['READ'] || [];
+      const writeArray = this.state.applicationRoles['WRITE'] || [];
+      const executeArray = this.state.applicationRoles['EXECUTE'] || [];
+      const roles = readArray.concat(writeArray, executeArray);
+      this.setState({
+          appRoles: Array.from(new Set(roles))
+      });
+  }
+
+  private isStageAuthorized(): boolean {
+
+      let disableBtn = true;
+      let usrRole;
+      const stageRoles = this.props.stage.context.selectedStageRoles || [];
+      const appRoles = this.state.appRoles;
+      const usrRoles = this.state.userRoles;
+      if (appRoles.length === 0 || stageRoles.length === 0) {
+          disableBtn = false;
+          return disableBtn;
+      }
+      for (usrRole of usrRoles) {
+          if ((stageRoles.indexOf(usrRole) > -1) && (appRoles.indexOf(usrRole) > -1)) {
+              disableBtn = false;
+              break;
+          }
+      }
+      return disableBtn;
+  }
+
   private handleJudgementChanged = (option: Option): void => {
     this.setState({ judgmentInput: { value: option.value as string } });
   };
@@ -103,7 +166,7 @@ export class ManualJudgmentApproval extends React.Component<
                 className="btn btn-danger"
                 onClick={this.handleStopClick}
                 disabled={
-                  this.state.submitting ||
+                  this.isStageAuthorized() || this.state.submitting ||
                   stage.context.judgmentStatus ||
                   (options.length && !this.state.judgmentInput.value)
                 }
@@ -114,7 +177,7 @@ export class ManualJudgmentApproval extends React.Component<
               <button
                 className="btn btn-primary"
                 disabled={
-                  this.state.submitting ||
+                  this.isStageAuthorized() || this.state.submitting ||
                   stage.context.judgmentStatus ||
                   (options.length && !this.state.judgmentInput.value)
                 }

app/scripts/modules/core/src/pipeline/config/stages/stage.html

@@ -64,6 +64,26 @@ <h4 ng-bind="stage.name || '[new stage]'"></h4>
           </ui-select-choices>
         </ui-select>
       </stage-config-field>
+      <stage-config-field label="Authorized Groups" help-key="pipeline.config.trigger.runAsUser" ng-if="stage.type === 'manualJudgment'" style="margin-bottom: 10px">
+        <ui-select
+          ng-model="stage.selectedStageRoles"
+          multiple
+          class="form-control input-sm"
+          on-select="updateAvailableStageRoles()"
+          on-remove="updateAvailableStageRoles()"
+        >
+          <ui-select-match>{{$item.name}}</ui-select-match>
+          <ui-select-choices
+            repeat="option.roleId as option in options.stageRoles | anyFieldFilter: {name: $select.search}"
+            ui-disable-choice="!option.available"
+          >
+            <span
+              ng-if="!stage.selectedStageRoles.includes(option.roleId)"
+              ng-bind-html="option.name | highlight: $select.search"
+            ></span>
+          </ui-select-choices>
+        </ui-select>
+      </stage-config-field>
     </div>
     <div class="col-md-2 text-right">
       <button

app/scripts/modules/core/src/pipeline/config/stages/stage.module.js

@@ -19,6 +19,7 @@ import { ReactModal } from 'core/presentation';
 import { PRODUCES_ARTIFACTS_REACT } from './producesArtifacts/ProducesArtifacts';
 import { OVERRRIDE_FAILURE } from './overrideFailure/overrideFailure.module';
 import { OVERRIDE_TIMEOUT_COMPONENT } from './overrideTimeout/overrideTimeout.module';
+import { ApplicationReader } from 'core/application/service/ApplicationReader';
 
 module.exports = angular
   .module('spinnaker.core.pipeline.config.stage', [
@@ -57,10 +58,13 @@ module.exports = angular
     '$templateCache',
     function($scope, $element, $compile, $controller, $templateCache) {
       var lastStageScope, reactComponentMounted;
+      var appPermissions = {};
+      var appRoles = [];
 
       $scope.options = {
         stageTypes: [],
         selectedStageType: null,
+        stageRoles: [],
       };
 
       AccountService.applicationAccounts($scope.application).then(accounts => {
@@ -130,6 +134,33 @@ module.exports = angular
         });
       };
 
+      $scope.getApplicationPermissions = function() {
+
+          ApplicationReader.getApplicationPermissions($scope.application.name)
+              .then(result => {
+                  appPermissions = result;
+                  if (appPermissions) {
+                      const readArray = appPermissions.READ || [];
+                      const writeArray = appPermissions.WRITE || [];
+                      const executeArray = appPermissions.EXECUTE || [];
+                      appRoles = readArray.concat(writeArray, executeArray);
+                      appRoles = Array.from(new Set(appRoles));
+                      $scope.updateAvailableStageRoles();
+                  }
+              });
+      }
+
+      $scope.updateAvailableStageRoles = function() {
+          $scope.options.stageRoles = appRoles.map(function(value, index) {
+              return {
+                  name: value,
+                  roleId: value,
+                  id: index,
+                  available: true,
+              };
+          });
+      };
+
       this.checkFeatureFlag = flag => !!SETTINGS.feature[flag];
 
       this.editStageJson = () => {
@@ -170,11 +201,13 @@ module.exports = angular
 
         if (!$scope.stage.type) {
           $scope.options.selectedStageType = null;
+	        $scope.options.selectedStageRoles = null;
         } else {
           $scope.options.selectedStageType = $scope.stage.type;
         }
 
         $scope.updateAvailableDependencyStages();
+        $scope.updateAvailableStageRoles();
         var type = $scope.stage.type,
           stageScope = $scope.$new();
 
@@ -303,6 +336,7 @@ module.exports = angular
         });
       };
 
+      $scope.getApplicationPermissions();
       $scope.$on('pipeline-reverted', this.selectStage);
       $scope.$on('pipeline-json-edited', this.selectStage);
       $scope.$watch('stage.type', this.selectStage);