Create DB from backup should check for restore permissions (#648)

Signed-off-by: Mayank Shah <[email protected]>

api/database_cluster.go

@@ -380,3 +380,16 @@ func (e *EverestServer) canTakeBackups(user string, object string) (bool, error)
 	}
 	return ok, nil
 }
+
+// canRestore checks if a given user is allowed to restore.
+func (e *EverestServer) canRestore(user string, object string) (bool, error) {
+	ok, err := e.rbacEnforcer.Enforce(
+		user, rbac.ResourceDatabaseClusterRestores,
+		rbac.ActionCreate,
+		object,
+	)
+	if err != nil {
+		return false, fmt.Errorf("failed to Enforce: %w", err)
+	}
+	return ok, nil
+}

api/validation.go

@@ -626,6 +626,16 @@ func (e *EverestServer) validateDatabaseClusterOnCreate(
 			return errors.Join(errInsufficientPermissions, errors.New("missing permission to take backups"))
 		}
 	}
+	// To be able to create a cluster from a backup (restore backup to new cluster), the user needs to explicitly
+	// have permissions to take restores.
+	sourceBackup := pointer.Get(pointer.Get(pointer.Get(databaseCluster.Spec).DataSource).DbClusterBackupName)
+	if sourceBackup != "" {
+		if can, err := e.canRestore(user, namespace+"/"+sourceBackup); err != nil {
+			return err
+		} else if !can {
+			return errors.Join(errInsufficientPermissions, errors.New("missing permission to restore"))
+		}
+	}
 	return nil
 }