fix(auth,appstore): eliminate redundant query branches and optimize batch role lookups

pkg/auth/user/UserCommonService.go

@@ -550,35 +550,20 @@ func (impl UserCommonServiceImpl) RemoveRolesAndReturnEliminatedPoliciesForGroup
 }
 
 func (impl UserCommonServiceImpl) checkRbacForARole(role *repository.RoleModel, token string, managerAuth func(resource string, token string, object string) bool) bool {
-	isAuthorised := true
 	switch {
 	case role.Action == bean2.SUPER_ADMIN || role.AccessType == bean2.APP_ACCESS_TYPE_HELM ||
 		role.AccessType == bean2.APP_ACCESS_TYPE_ARGO || role.AccessType == bean2.APP_ACCESS_TYPE_FLUX ||
 		role.Entity == bean2.EntityJobs:
-		isValidAuth := managerAuth(casbin.ResourceGlobal, token, "*")
-		if !isValidAuth {
-			isAuthorised = false
-		}
-
+		return managerAuth(casbin.ResourceGlobal, token, "*")
 	case len(role.Team) > 0:
-		// this is case of devtron app
-		rbacObject := fmt.Sprintf("%s", role.Team)
-		isValidAuth := managerAuth(casbin.ResourceUser, token, rbacObject)
-		if !isValidAuth {
-			isAuthorised = false
-		}
-
+		return managerAuth(casbin.ResourceUser, token, role.Team)
 	case role.Entity == bean2.CLUSTER_ENTITIY:
-		isValidAuth := impl.CheckRbacForClusterEntity(role.Cluster, role.Namespace, role.Group, role.Kind, role.Resource, token, managerAuth)
-		if !isValidAuth {
-			isAuthorised = false
-		}
+		return impl.CheckRbacForClusterEntity(role.Cluster, role.Namespace, role.Group, role.Kind, role.Resource, token, managerAuth)
 	case role.Entity == bean2.CHART_GROUP_ENTITY:
-		isAuthorised = true
+		return true
 	default:
-		isAuthorised = false
+		return false
 	}
-	return isAuthorised
 }
 
 func containsArr(s []string, e string) bool {

pkg/auth/user/UserCommonService_test.go

@@ -0,0 +1,63 @@
+package user
+
+import (
+	bean2 "github.com/devtron-labs/devtron/pkg/auth/user/bean"
+	"github.com/devtron-labs/devtron/pkg/auth/user/repository"
+	"testing"
+)
+
+func TestCheckRbacForARole(t *testing.T) {
+	impl := UserCommonServiceImpl{}
+
+	t.Run("super admin role authorized", func(t *testing.T) {
+		role := &repository.RoleModel{
+			Action: bean2.SUPER_ADMIN,
+		}
+		managerAuth := func(resource, token, object string) bool {
+			return true
+		}
+		authorized := impl.checkRbacForARole(role, "test-token", managerAuth)
+		if !authorized {
+			t.Errorf("expected role to be authorized, got false")
+		}
+	})
+
+	t.Run("chart group entity authorized unconditionally", func(t *testing.T) {
+		role := &repository.RoleModel{
+			Entity: bean2.CHART_GROUP_ENTITY,
+		}
+		managerAuth := func(resource, token, object string) bool {
+			return false
+		}
+		authorized := impl.checkRbacForARole(role, "test-token", managerAuth)
+		if !authorized {
+			t.Errorf("expected chart group entity to be authorized, got false")
+		}
+	})
+
+	t.Run("team role authorization check", func(t *testing.T) {
+		role := &repository.RoleModel{
+			Team: "devtron-team",
+		}
+		managerAuth := func(resource, token, object string) bool {
+			return object == "devtron-team"
+		}
+		authorized := impl.checkRbacForARole(role, "test-token", managerAuth)
+		if !authorized {
+			t.Errorf("expected team role to be authorized for matching team")
+		}
+	})
+
+	t.Run("default entity unauthorized", func(t *testing.T) {
+		role := &repository.RoleModel{
+			Entity: "unknown-entity",
+		}
+		managerAuth := func(resource, token, object string) bool {
+			return true
+		}
+		authorized := impl.checkRbacForARole(role, "test-token", managerAuth)
+		if authorized {
+			t.Errorf("expected unknown entity to be unauthorized, got true")
+		}
+	})
+}