Merge pull request #8712 from NuGet/agr-admin

Adding an option to disable admin panel

Author: agr

src/AccountDeleter/Configuration/GalleryConfiguration.cs

@@ -37,6 +37,7 @@ public string SiteRoot
         public string AzureStorage_Revalidation_ConnectionString { get => throw new NotImplementedException(); set => throw new NotImplementedException(); }
         public bool AzureStorageReadAccessGeoRedundant { get => throw new NotImplementedException(); set => throw new NotImplementedException(); }
         public TimeSpan FeatureFlagsRefreshInterval { get => throw new NotImplementedException(); set => throw new NotImplementedException(); }
+        public bool AdminPanelEnabled { get => throw new NotImplementedException(); set => throw new NotImplementedException(); }
         public bool AdminPanelDatabaseAccessEnabled { get => throw new NotImplementedException(); set => throw new NotImplementedException(); }
         public bool AsynchronousPackageValidationEnabled { get => throw new NotImplementedException(); set => throw new NotImplementedException(); }
         public bool BlockingAsynchronousPackageValidationEnabled { get => throw new NotImplementedException(); set => throw new NotImplementedException(); }

src/NuGetGallery.Services/Configuration/AppConfiguration.cs

@@ -76,6 +76,9 @@ public class AppConfiguration : IAppConfiguration
 
         public TimeSpan FeatureFlagsRefreshInterval { get; set; }
 
+        [DefaultValue(true)]
+        public bool AdminPanelEnabled { get; set; }
+
         public bool AdminPanelDatabaseAccessEnabled { get; set; }
 
         public bool AsynchronousPackageValidationEnabled { get; set; }

src/NuGetGallery.Services/Configuration/IAppConfiguration.cs

@@ -100,6 +100,11 @@ public interface IAppConfiguration : IMessageServiceConfiguration
         /// </summary>
         TimeSpan FeatureFlagsRefreshInterval { get; set; }
 
+        /// <summary>
+        /// Indicates whether Admin panel pages exist on this instance.
+        /// </summary>
+        bool AdminPanelEnabled { get; set; }
+
         /// <summary>
         /// Gets a boolean indicating whether DB admin through web UI should be accesible.
         /// </summary>

src/NuGetGallery.Services/Permissions/ActionRequiringEntityPermissions.cs

@@ -63,6 +63,25 @@ public PermissionsCheckResult CheckPermissionsOnBehalfOfAnyAccount(User currentU
             return CheckPermissionsOnBehalfOfAnyAccount(currentUser, entity, exitEarly: false, accountsAllowedOnBehalfOf: out accountsAllowedOnBehalfOf);
         }
 
+        public override bool Equals(object obj)
+        {
+            if (obj == null)
+            {
+                return false;
+            }
+            var other = obj as ActionRequiringEntityPermissions<TEntity>;
+            if (other == null)
+            {
+                return false;
+            }
+            return AccountOnBehalfOfPermissionsRequirement == other.AccountOnBehalfOfPermissionsRequirement;
+        }
+
+        public override int GetHashCode()
+        {
+            return AccountOnBehalfOfPermissionsRequirement.GetHashCode();
+        }
+
         private PermissionsCheckResult CheckPermissionsOnBehalfOfAnyAccount(User currentUser, TEntity entity, bool exitEarly, out IEnumerable<User> accountsAllowedOnBehalfOf)
         {
             accountsAllowedOnBehalfOf = new List<User>();

src/NuGetGallery.Services/Permissions/ActionRequiringPackagePermissions.cs

@@ -49,6 +49,25 @@ public PermissionsCheckResult CheckPermissionsOnBehalfOfAnyAccount(User currentU
             return CheckPermissionsOnBehalfOfAnyAccount(currentUser, GetPackageRegistration(package), out accountsAllowedOnBehalfOf);
         }
 
+        public override bool Equals(object obj)
+        {
+            if (!base.Equals(obj))
+            {
+                return false;
+            }
+            var other = obj as ActionRequiringPackagePermissions;
+            if (other == null)
+            {
+                return false;
+            }
+            return PackageRegistrationPermissionsRequirement == other.PackageRegistrationPermissionsRequirement;
+        }
+
+        public override int GetHashCode()
+        {
+            return base.GetHashCode() ^ PackageRegistrationPermissionsRequirement.GetHashCode();
+        }
+
         protected override IEnumerable<User> GetOwners(PackageRegistration packageRegistration)
         {
             return packageRegistration != null ? packageRegistration.Owners : Enumerable.Empty<User>();

src/NuGetGallery.Services/Permissions/ActionRequiringReservedNamespacePermissions.cs

@@ -50,6 +50,25 @@ public PermissionsCheckResult CheckPermissions(IPrincipal currentPrincipal, User
             return CheckPermissions(currentPrincipal, account, GetReservedNamespaces(reservedNamespace));
         }
 
+        public override bool Equals(object obj)
+        {
+            if (!base.Equals(obj))
+            {
+                return false;
+            }
+            var other = obj as ActionRequiringReservedNamespacePermissions;
+            if (other == null)
+            {
+                return false;
+            }
+            return ReservedNamespacePermissionsRequirement == other.ReservedNamespacePermissionsRequirement;
+        }
+
+        public override int GetHashCode()
+        {
+            return base.GetHashCode() ^ ReservedNamespacePermissionsRequirement.GetHashCode();
+        }
+
         protected override PermissionsCheckResult CheckPermissionsForEntity(User account, IReadOnlyCollection<ReservedNamespace> reservedNamespaces)
         {
             if (!reservedNamespaces.Any())

src/NuGetGallery.Services/Permissions/ActionsRequiringPermissions.cs

@@ -8,163 +8,168 @@ namespace NuGetGallery
     /// </summary>
     public static class ActionsRequiringPermissions
     {
-        private const PermissionsRequirement RequireOwnerOrSiteAdmin = 
-            PermissionsRequirement.Owner | PermissionsRequirement.SiteAdmin;
-        private const PermissionsRequirement RequireOwnerOrSiteAdminOrOrganizationAdmin =
-            PermissionsRequirement.Owner | PermissionsRequirement.SiteAdmin | PermissionsRequirement.OrganizationAdmin;
-        private const PermissionsRequirement RequireOwnerOrOrganizationAdmin = 
+        public static bool AdminAccessEnabled { get; set; } = true;
+
+        private static PermissionsRequirement AdminRequirement =>
+            AdminAccessEnabled ? PermissionsRequirement.SiteAdmin : PermissionsRequirement.Unsatisfiable;
+
+        private static PermissionsRequirement RequireOwnerOrSiteAdmin =>
+            PermissionsRequirement.Owner | AdminRequirement;
+        private static PermissionsRequirement RequireOwnerOrSiteAdminOrOrganizationAdmin =>
+            PermissionsRequirement.Owner | AdminRequirement | PermissionsRequirement.OrganizationAdmin;
+        private static PermissionsRequirement RequireOwnerOrOrganizationAdmin =>
             PermissionsRequirement.Owner | PermissionsRequirement.OrganizationAdmin;
-        private const PermissionsRequirement RequireOwnerOrOrganizationMember =
+        private static PermissionsRequirement RequireOwnerOrOrganizationMember =>
             PermissionsRequirement.Owner | PermissionsRequirement.OrganizationAdmin | PermissionsRequirement.OrganizationCollaborator;
-        private const PermissionsRequirement RequireOwnerOrSiteAdminOrOrganizationMember =
-            PermissionsRequirement.Owner | PermissionsRequirement.SiteAdmin | PermissionsRequirement.OrganizationAdmin | PermissionsRequirement.OrganizationCollaborator;
+        private static PermissionsRequirement RequireOwnerOrSiteAdminOrOrganizationMember =>
+            PermissionsRequirement.Owner | AdminRequirement | PermissionsRequirement.OrganizationAdmin | PermissionsRequirement.OrganizationCollaborator;
 
         /// <summary>
         /// The action of seeing private metadata about a package.
         /// For example, if a package is validating, only users who can perform this action can see the metadata of the package.
         /// </summary>
-        public static ActionRequiringPackagePermissions DisplayPrivatePackageMetadata =
+        public static ActionRequiringPackagePermissions DisplayPrivatePackageMetadata =>
             new ActionRequiringPackagePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationMember,
                 packageRegistrationPermissionsRequirement: RequireOwnerOrSiteAdmin);
 
         /// <summary>
         /// The action of uploading a new package ID.
         /// </summary>
-        public static ActionRequiringReservedNamespacePermissions UploadNewPackageId =
+        public static ActionRequiringReservedNamespacePermissions UploadNewPackageId =>
             new ActionRequiringReservedNamespacePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationMember,
                 reservedNamespacePermissionsRequirement: PermissionsRequirement.Owner);
 
         /// <summary>
         /// The action of uploading a new version of an existing package ID.
         /// </summary>
-        public static ActionRequiringPackagePermissions UploadNewPackageVersion =
+        public static ActionRequiringPackagePermissions UploadNewPackageVersion =>
             new ActionRequiringPackagePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationMember,
                 packageRegistrationPermissionsRequirement: PermissionsRequirement.Owner);
 
         /// <summary>
         /// The action of uploading a symbols package for an existing package.
         /// </summary>
-        public static ActionRequiringPackagePermissions UploadSymbolPackage =
+        public static ActionRequiringPackagePermissions UploadSymbolPackage =>
             new ActionRequiringPackagePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationMember,
                 packageRegistrationPermissionsRequirement: PermissionsRequirement.Owner);
 
         /// <summary>
         /// The action of deleting a symbols package for an existing package.
         /// </summary>
-        public static ActionRequiringPackagePermissions DeleteSymbolPackage =
+        public static ActionRequiringPackagePermissions DeleteSymbolPackage =>
             new ActionRequiringPackagePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationMember,
                 packageRegistrationPermissionsRequirement: RequireOwnerOrSiteAdmin);
 
         /// <summary>
         /// The action of verify a package verification key.
         /// </summary>
-        public static ActionRequiringPackagePermissions VerifyPackage =
+        public static ActionRequiringPackagePermissions VerifyPackage =>
             new ActionRequiringPackagePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationMember,
                 packageRegistrationPermissionsRequirement: PermissionsRequirement.Owner);
 
         /// <summary>
         /// The action of editing an existing version of an existing package ID.
         /// </summary>
-        public static ActionRequiringPackagePermissions EditPackage =
+        public static ActionRequiringPackagePermissions EditPackage =>
             new ActionRequiringPackagePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationMember,
                 packageRegistrationPermissionsRequirement: RequireOwnerOrSiteAdmin);
 
         /// <summary>
         /// The action of unlisting or relisting an existing version of an existing package ID.
         /// </summary>
-        public static ActionRequiringPackagePermissions UnlistOrRelistPackage =
+        public static ActionRequiringPackagePermissions UnlistOrRelistPackage =>
             new ActionRequiringPackagePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationMember,
                 packageRegistrationPermissionsRequirement: RequireOwnerOrSiteAdmin);
 
         /// <summary>
         /// The action of deprecating an existing version of an existing package ID.
         /// </summary>
-        public static ActionRequiringPackagePermissions DeprecatePackage =
+        public static ActionRequiringPackagePermissions DeprecatePackage =>
             new ActionRequiringPackagePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationMember,
                 packageRegistrationPermissionsRequirement: RequireOwnerOrSiteAdmin);
 
         /// <summary>
         /// The action of managing the ownership of an existing package ID.
         /// </summary>
-        public static ActionRequiringPackagePermissions ManagePackageOwnership =
+        public static ActionRequiringPackagePermissions ManagePackageOwnership =>
             new ActionRequiringPackagePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationAdmin,
                 packageRegistrationPermissionsRequirement: RequireOwnerOrSiteAdmin);
 
         /// <summary>
         /// The action of reporting an existing package ID as the owner of the package.
         /// </summary>
-        public static ActionRequiringPackagePermissions ReportPackageAsOwner =
+        public static ActionRequiringPackagePermissions ReportPackageAsOwner =>
             new ActionRequiringPackagePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationMember,
                 packageRegistrationPermissionsRequirement: PermissionsRequirement.Owner);
 
         /// <summary>
         /// The action of seeing a breadcrumb linking the user back to their profile when performing actions on a package.
         /// </summary>
-        public static ActionRequiringPackagePermissions ShowProfileBreadcrumb =
+        public static ActionRequiringPackagePermissions ShowProfileBreadcrumb =>
             new ActionRequiringPackagePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationMember,
                 packageRegistrationPermissionsRequirement: PermissionsRequirement.Owner);
 
         /// <summary>
         /// The action of handling package ownership requests for a user to become an owner of a package.
         /// </summary>
-        public static ActionRequiringAccountPermissions HandlePackageOwnershipRequest = 
+        public static ActionRequiringAccountPermissions HandlePackageOwnershipRequest =>
             new ActionRequiringAccountPermissions(
                 accountPermissionsRequirement: RequireOwnerOrOrganizationAdmin);
 
         /// <summary>
         /// The action of viewing (read-only) a user or organization account.
         /// </summary>
-        public static ActionRequiringAccountPermissions ViewAccount =
+        public static ActionRequiringAccountPermissions ViewAccount =>
             new ActionRequiringAccountPermissions(
                 accountPermissionsRequirement: RequireOwnerOrSiteAdminOrOrganizationMember);
 
         /// <summary>
         /// The action of managing a user or organization account. This includes confirming an account,
         /// changing the email address, changing email subscriptions, modifying sign-in credentials, etc.
         /// </summary>
-        public static ActionRequiringAccountPermissions ManageAccount =
+        public static ActionRequiringAccountPermissions ManageAccount =>
             new ActionRequiringAccountPermissions(
                 accountPermissionsRequirement: RequireOwnerOrOrganizationAdmin);
 
         /// <summary>
         /// The action of managing an organization's memberships.
         /// </summary>
-        public static ActionRequiringAccountPermissions ManageMembership =
+        public static ActionRequiringAccountPermissions ManageMembership =>
             new ActionRequiringAccountPermissions(
                 accountPermissionsRequirement: RequireOwnerOrSiteAdminOrOrganizationAdmin);
 
         /// <summary>
         /// The action of changing a package's required signer.
         /// </summary>
-        public static ActionRequiringPackagePermissions ManagePackageRequiredSigner =
+        public static ActionRequiringPackagePermissions ManagePackageRequiredSigner =>
              new ActionRequiringPackagePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrOrganizationAdmin,
                 packageRegistrationPermissionsRequirement: RequireOwnerOrOrganizationAdmin);
 
         /// <summary>
         /// The action of adding a package to a reserved namespace that the package is in.
         /// </summary>
-        public static ActionRequiringReservedNamespacePermissions AddPackageToReservedNamespace =
+        public static ActionRequiringReservedNamespacePermissions AddPackageToReservedNamespace =>
             new ActionRequiringReservedNamespacePermissions(
                 accountOnBehalfOfPermissionsRequirement: PermissionsRequirement.Owner,
                 reservedNamespacePermissionsRequirement: PermissionsRequirement.Owner);
 
         /// <summary>
         /// The action of removing a package from a reserved namespace that the package is in.
         /// </summary>
-        public static ActionRequiringReservedNamespacePermissions RemovePackageFromReservedNamespace =
+        public static ActionRequiringReservedNamespacePermissions RemovePackageFromReservedNamespace =>
             new ActionRequiringReservedNamespacePermissions(
                 accountOnBehalfOfPermissionsRequirement: RequireOwnerOrSiteAdminOrOrganizationAdmin,
                 reservedNamespacePermissionsRequirement: RequireOwnerOrOrganizationAdmin);

src/NuGetGallery/App_Start/DefaultDependenciesModule.cs

@@ -110,6 +110,8 @@ protected override void Load(ContainerBuilder builder)
                 loggerConfiguration,
                 telemetryConfiguration: applicationInsightsConfiguration.TelemetryConfiguration);
 
+            ActionsRequiringPermissions.AdminAccessEnabled = configuration.Current.AdminPanelEnabled;
+
             builder.RegisterInstance(applicationInsightsConfiguration.TelemetryConfiguration)
                 .AsSelf()
                 .SingleInstance();