Repository: StackStorm/st2

Issue:
Packs are not listed in WEBUI for users with observer role
Hi Team,

In stackstorm WebUI , page **does not render** on clicking packs tab by logged in user having **observer role**.

It highlighted the below error  when checked in debug logs of browser
 `{
    **"faultstring": "User \"arul\" doesn't have required permission \"pack_search\""**
}`

How can the permission `pack_search` be appended to observer role?

Is it possible to provide `pack_search` permission for all the packs as
`---
    name: "pack_search_role"
    description: "Role which grants pack_search permission to all packs"
    permission_grants:
        -
            resource_uid: "packs"
            permission_types:
               - "pack_search"
`

Is this a know issue?

**Please look into this and advice. Also find screenshot for the same**.
![pack_search_error](https://user-images.githubusercontent.com/9215832/38351375-c0a8e8f0-38cc-11e8-866c-581e6a23d2f8.png)



Thanks,
Suraj S


Discussion:
Thanks for reporting this.

This looks like an oversight on our side - it makes sense for "observer" role to also grant `PACK_SEARCH` permission.

Resolving patch:
diff --git a/st2common/st2common/rbac/resolvers.py b/st2common/st2common/rbac/resolvers.py
--- a/st2common/st2common/rbac/resolvers.py
+++ b/st2common/st2common/rbac/resolvers.py
@@ -60,7 +60,8 @@
 # "Read" permission names which are granted to observer role by default
 READ_PERMISSION_NAMES = [
     'view',
-    'list'
+    'list',
+    'search'
 ]
 
 


Test patch:
diff --git a/st2api/tests/unit/controllers/v1/test_packs_rbac.py b/st2api/tests/unit/controllers/v1/test_packs_rbac.py
--- a/st2api/tests/unit/controllers/v1/test_packs_rbac.py
+++ b/st2api/tests/unit/controllers/v1/test_packs_rbac.py
@@ -17,8 +17,10 @@
 import six
 
 from st2common.router import Response
+from st2common.services import packs as pack_service
 from st2api.controllers.v1.actionexecutions import ActionExecutionsControllerMixin
 from tests.base import APIControllerWithRBACTestCase
+from tests.unit.controllers.v1.test_packs import PACK_INDEX
 
 http_client = six.moves.http_client
 
@@ -90,3 +92,24 @@ def test_get_all_limit_minus_one(self):
 
         resp = self.app.get('/v1/packs?limit=-1')
         self.assertEqual(resp.status_code, http_client.OK)
+
+    @mock.patch.object(pack_service, 'fetch_pack_index',
+                       mock.MagicMock(return_value=(PACK_INDEX, {})))
+    def test_pack_search(self):
+        user_db = self.users['no_permissions']
+        self.use_user(user_db)
+
+        data = {'query': 'test'}
+        resp = self.app.post_json('/v1/packs/index/search', data, expect_errors=True)
+
+        expected_msg = 'User \"no_permissions\" doesn\'t have required permission \"pack_search\"'
+        self.assertEqual(resp.status_code, http_client.FORBIDDEN)
+        self.assertEqual(resp.json['faultstring'], expected_msg)
+
+        # Observer role also grants pack_search permission
+        user_db = self.users['observer']
+        self.use_user(user_db)
+
+        data = {'query': 'test'}
+        resp = self.app.post_json('/v1/packs/index/search', data)
+        self.assertEqual(resp.status_code, http_client.OK)