Incorrect roles required in deliveryservices/id/ documentation

[ericholguin]

I'm submitting a ...

• bug report
• new feature / enhancement request
• improvement request (usability, performance, tech debt, etc.)
• other

Traffic Control components affected ...

• CDN in a Box
• Documentation
• Grove
• Traffic Control Client
• Traffic Monitor
• Traffic Ops
• Traffic Ops ORT
• Traffic Portal
• Traffic Router
• Traffic Stats
• Traffic Vault
• unknown

Current behavior:

In the documentation of the following endpoints, there is an incorrect description. A request to these endpoints can be made by a user with a "readonly" role, however the documentation has the following written:

Roles Required: “admin” or “operations”

Issue was found with these pages:

deliveryservices/{{ID}}/servers/eligible
deliveryservices/{{ID}}/servers
deliveryservices/{{ID}}/safe
deliveryservices/{{ID}}/routing
deliveryservices/{{ID}}/health
deliveryservices/{{ID}}/capacity

All these endpoints only allow for a GET request to be made, except for deliveryservices/{{ID}}/safe which only allows for a PUT request to be made. If a user with a readonly role should be allowed to make this request, the documentation should be updated, otherwise a readonly user should be blocked from making the request.

Expected / new behavior:

Should be changed to:

Roles Required: None

OR return:

HTTP/1.1 403 Forbidden
{
    "alerts": [
        {
            "text": "Forbidden.",
            "level": "error"
        }
    ]
}

Minimal reproduction of the problem with instructions:

Anything else:

[ocket8888]

deliveryservices/{{ID}}/routing is a special case; it allows the user to bypass tenancy restrictions if they have the "operator" or "admin" Role. Which is interesting. I've made note of it in a PR I'm working on to address this issue.

[ocket8888]

err, actually that's not true. deliveryservices/{{ID}}/routing, deliveryservices/{{ID}}/health, and deliveryservices/{{ID}}/capacity all allow you to bypass Delivery Service-to-user assignments with >= operator permissions. Not tenancy restrictions.