feat: [UIE-9144] - IAM RBAC: perm check nodebalancer settings tab

[aaleksee-akamai]

Description 📝

This PR implements IAM RBAC permissions for NodeBalancer settings tab

Changes 🔄

List any change(s) relevant to the reviewer.

• Implement permissions in the /nodebalancers/${nodebalancersId}/settings flow
• Update unit tests
• Filter the available firewalls in the /linodes/${linodeID}/networking Add Firewall flow

Scope 🚢

Upon production release, changes in this PR will be visible to:

• All customers
• Some customers (e.g. in Beta or Limited Availability)
• No customers / Not applicable

Target release date 🗓️

09/23

Preview 📷

Before	After
	📷
	📷

How to test 🧪

Prerequisites

(How to setup test environment)

• MSW or iam (restricted) + regular account to compare

To test the create_firewall_device, delete_firewall_device permissions, use the account_firewall_admin or firewall_admin roles.
To test the update_nodebalancer, delete_nodebalancer permissions, use the nodebalancer_admin and/or nodebalancer_viewer roles.

Verification steps

(How to verify changes)

• Confirm the buttons/inputs are disabled according the grant model with IAM is off, and according to the RBAC model when IAM is on.
• Confirm the list of firewalls is filtered based on permissions for assigning to nodebalancer/linode entity

Author Checklists

As an Author, to speed up the review process, I considered 🤔

👀 Doing a self review
❔ Our contribution guidelines
🤏 Splitting feature into small PRs
➕ Adding a changeset
🧪 Providing/improving test coverage
🔐 Removing all sensitive information from the code and PR description
🚩 Using a feature flag to protect the release
👣 Providing comprehensive reproduction steps
📑 Providing or updating our documentation
🕛 Scheduling a pair reviewing session
📱 Providing mobile support
♿ Providing accessibility support

• I have read and considered all applicable items listed above.

As an Author, before moving this PR from Draft to Open, I confirmed ✅

• All tests and CI checks are passing
• TypeScript compilation succeeded without errors
• Code passes all linting rules

[abailly-akamai]

I find it odd I am able to add a firewall device to a nodebalancer I only have viewer permissions for. I assume it's ok since it appears API seems to allow it, but wanted to point it out

[abailly-akamai]

Should this be

!firewallPermissions.delete_firewall_device || !nodeBalancerPermissions.update_nodebalancer

here?

[aaleksee-akamai]

we need to check both permissions for unassigning a firewall, if user doesn't have a update permission for nodebalancer, he will have an unauthorized error (however, he can assign a firewall)

[aaleksee-akamai]

and my previous condition didn't work, updated it to
!(firewallPermissions.delete_firewall_device && nodeBalancerPermissions.update_nodebalancer)

[linode-gh-bot]

Cloud Manager UI test results

🔺 1 failing test on test run #3 ↗︎

❌ Failing	✅ Passing	↪️ Skipped	🕐 Duration
1 Failing	744 Passing	6 Skipped	39m 11s

Details

Failing Tests
	Spec	Test
❌	object-storage-objects-multicluster.spec.ts	Cloud Manager Cypress Tests→Object Storage Multicluster objects » "before all" hook for "can upload, access, and delete objects"

Troubleshooting

Use this command to re-run the failing tests:

pnpm cy:run -s "cypress/e2e/core/objectStorageMulticluster/object-storage-objects-multicluster.spec.ts"