feat(app/sources): UAC on sources (#2997)

Co-authored-by: Chaim Lev-Ari <chaim.lev-ari@portainer.io>
Co-authored-by: andres-portainer <91705312+andres-portainer@users.noreply.github.com>

api/http/handler/gitops/sources/create_git.go

@@ -7,8 +7,9 @@ import (
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/dataservices/source"
 	gittypes "github.com/portainer/portainer/api/git/types"
-	"github.com/portainer/portainer/api/gitops/workflows"
+	"github.com/portainer/portainer/api/http/security"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
@@ -21,8 +22,16 @@ type GitAuthenticationPayload struct {
 	Password string `json:"password"`
 }
 
+type SourceAccessControlPayload struct {
+	Public             bool               `json:"public" example:"true"`
+	AdministratorsOnly bool               `json:"administratorsOnly" example:"true"`
+	UserAccesses       []portainer.UserID `json:"userAccesses"`
+	TeamAccesses       []portainer.TeamID `json:"teamAccesses"`
+}
+
 // GitSourceCreatePayload holds the parameters for creating a git-backed source
 type GitSourceCreatePayload struct {
+	SourceAccessControlPayload
 	Name           string                    `json:"name"`
 	URL            string                    `json:"url" validate:"required"`
 	TLSSkipVerify  bool                      `json:"tlsSkipVerify"`
@@ -41,7 +50,7 @@ func (payload *GitSourceCreatePayload) Validate(_ *http.Request) error {
 // @id GitOpsSourcesCreateGit
 // @summary Create a Git source
 // @description Creates a new GitOps source backed by a Git repository.
-// @description **Access policy**: administrator
+// @description **Access policy**: authenticated
 // @tags gitops
 // @security ApiKeyAuth
 // @security jwt
@@ -61,26 +70,20 @@ func (h *Handler) gitSourceCreate(w http.ResponseWriter, r *http.Request) *httpe
 		return httperror.BadRequest("Invalid request payload", err)
 	}
 
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+
 	src, err := BuildGitSource(payload)
 	if err != nil {
 		return httperror.BadRequest("Invalid request payload", err)
 	}
 
-	username, password := "", ""
-	if payload.Authentication != nil {
-		username = payload.Authentication.Username
-		password = payload.Authentication.Password
-	}
-
 	if err := h.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		if isUnique, err := workflows.ValidateUniqueSource(tx, payload.URL, username, password, 0); err != nil {
-			return err
-		} else if !isUnique {
-			return ErrDuplicateSource
-		}
-
-		return tx.Source().Create(src)
-	}); errors.Is(err, ErrDuplicateSource) {
+		userContext := source.NewUserContext(securityContext.User, securityContext.UserMemberships)
+		return tx.Source().Create(userContext, src)
+	}); errors.Is(err, source.ErrDuplicateSource) {
 		return httperror.Conflict("A source with this URL and credentials already exists", err)
 	} else if err != nil {
 		return httperror.InternalServerError("Unable to create source", err)
@@ -99,8 +102,7 @@ func BuildGitSource(payload GitSourceCreatePayload) (*portainer.Source, error) {
 	return src, nil
 }
 
-// BuildBaseGitSource constructs the source skeleton (name, URL, TLS) without
-// authentication.
+// BuildBaseGitSource constructs the source skeleton (name, URL, TLS, accesses) without authentication.
 func BuildBaseGitSource(payload GitSourceCreatePayload) *portainer.Source {
 	name := payload.Name
 	if strings.TrimSpace(name) == "" {
@@ -114,6 +116,10 @@ func BuildBaseGitSource(payload GitSourceCreatePayload) *portainer.Source {
 			URL:           payload.URL,
 			TLSSkipVerify: payload.TLSSkipVerify,
 		},
+		UserAccesses:       payload.UserAccesses,
+		TeamAccesses:       payload.TeamAccesses,
+		Public:             payload.Public,
+		AdministratorsOnly: payload.AdministratorsOnly,
 	}
 }