Check user or admin/monitor for user-limits

Author: MarcialRosales

deps/rabbitmq_management/src/rabbit_mgmt_wm_user_limits.erl

@@ -24,7 +24,14 @@ allowed_methods(ReqData, Context) ->
     {[<<"GET">>, <<"OPTIONS">>], ReqData, Context}.
 
 is_authorized(ReqData, Context) ->
-    rabbit_mgmt_util:is_authorized_vhost_visible(ReqData, Context).
+    case user(ReqData) of
+        none ->
+            %% listing all users' limits is an administrator-only operation
+            rabbit_mgmt_util:is_authorized_admin(ReqData, Context);
+        Username ->
+            %% reading a specific user's limits: administrator/monitor or own account
+            rabbit_mgmt_util:is_authorized_user(ReqData, Context, [{user, Username}])
+    end.
 
 content_types_provided(ReqData, Context) ->
    {[{<<"application/json">>, to_json}], ReqData, Context}.

deps/rabbitmq_management/test/rabbit_mgmt_http_SUITE.erl

@@ -4125,7 +4125,17 @@ user_limits_list_test(Config) ->
     },
     rabbit_ct_broker_helpers:set_user_limits(Config, 0, NoVhostUser, maps:get(value, Limits4)),
 
-    ?assertEqual([Limits4], http_get(Config, "/user-limits/no_vhost_user", ?OK)).
+    ?assertEqual([Limits4], http_get(Config, "/user-limits/no_vhost_user", ?OK)),
+
+    %% A management-only user must not be able to enumerate other users' limits.
+    %% Reading own limits is allowed; reading another user's limits or the full
+    %% list must be refused.
+    http_get(Config, "/user-limits", User1, User1, ?NOT_AUTHORISED),
+    http_get(Config, "/user-limits", User2, User2, ?NOT_AUTHORISED),
+    Limits1 = http_get(Config, "/user-limits/" ++ binary_to_list(User1), User1, User1, ?OK),
+    http_get(Config, "/user-limits/" ++ binary_to_list(User2), User1, User1, ?NOT_AUTHORISED),
+    Limits2 = http_get(Config, "/user-limits/" ++ binary_to_list(User2), User2, User2, ?OK),
+    http_get(Config, "/user-limits/" ++ binary_to_list(User1), User2, User2, ?NOT_AUTHORISED).
 
 user_limit_set_test(Config) ->
     ?assertEqual([], http_get(Config, "/user-limits", ?OK)),