allow domain admins to enable/disable domains

[havetisyan]

Description

addresses feature request #3232

Contribution Checklist:

• The pull request does not introduce any breaking changes
• I have read the contribution guidelines.
• Create an issue and link to the pull request.

Attach Screenshots (Optional)

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a significant enhancement to domain management by empowering domain administrators with the ability to enable and disable their respective domains. This change improves operational flexibility and reduces reliance on system administrators for routine domain status changes. The underlying authorization mechanism for system metadata updates has been refined to support this new capability, ensuring secure and controlled access.

Highlights

• Domain Admin Authorization: Enabled domain administrators to enable or disable their own domains, a capability previously restricted to system administrators.
• Centralized Authorization Logic: Refactored the authorization logic for system metadata updates to be handled server-side within the ZMS implementation, allowing for more granular and attribute-specific access control.
• Updated API Schema and Client: Modified the RDL schema and generated Go and Java client code to reflect the new server-side authorization approach for PutDomainSystemMeta.

Changelog

• clients/go/zms/zms_schema.go
  • Updated the PutDomainSystemMeta resource definition to remove explicit authorization, delegating it to the server-side implementation.
• clients/java/msd/src/main/java/com/yahoo/athenz/msd/MSDRDLGeneratedClient.java
  • Removed matchingTag and headers parameters from the getTransportPolicySnapshot method signature and its implementation, along with related ETag handling. This change appears unrelated to the primary goal of the PR.
• core/zms/src/main/java/com/yahoo/athenz/zms/ZMSSchema.java
  • Modified the PutDomainSystemMeta resource definition to remove explicit authorization, delegating it to the server-side implementation.
• core/zms/src/main/rdl/Domain.rdli
  • Updated the comment for PutDomainSystemMeta to detail the new authorization rules for system admins and domain admins (specifically for the 'enabled' attribute).
  • Replaced explicit authorize directive with authenticate for PutDomainSystemMeta, indicating server-side authorization.
• servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSImpl.java
  • Introduced a new method verifyAuthorizedSystemMetaOperation to centralize and implement the authorization logic for system metadata updates, distinguishing between system admin and domain admin permissions for the 'enabled' attribute.
  • Updated putDomainSystemMeta to call the new verifyAuthorizedSystemMetaOperation for authorization.
• servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSResources.java
  • Changed the putDomainSystemMeta endpoint to use context.authenticate() instead of explicit authorization, aligning with the new server-side authorization model.
• servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSDeleteDomainTest.java
  • Added a call to ZMSTestUtils.setupSystemMetaAuthorization to ensure proper test setup for system meta authorization.
• servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSMetaAttributeTest.java
  • Added multiple calls to ZMSTestUtils.setupSystemMetaAuthorization in existing tests to correctly simulate system meta authorization.
  • Introduced new test cases testPutDomainSystemMetaForbidden and testPutDomainSystemMetaEnabledDomainAdmin to verify the new authorization logic for system and domain administrators.
• servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSObjectReviewTest.java
  • Added a call to ZMSTestUtils.setupSystemMetaAuthorization in a test method.
• servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSServiceIdentityTest.java
  • Added a call to ZMSTestUtils.setupSystemMetaAuthorization in a test method.
• servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSTestUtils.java
  • Added a new utility method setupSystemMetaAuthorization to simplify the setup of system meta authorization in test environments.

Activity

• Addresses feature request allow domain admins to enable/disable domains #3232, which likely requested the ability for domain admins to manage domain status.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request correctly implements the requested feature to allow domain administrators to enable or disable their domains. The changes to the authorization logic are clear, and the new functionality is well-supported by new unit tests. I've pointed out a minor issue with an unused import in a test file.