Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: infra view role #1507

Merged
merged 1 commit into from
Apr 7, 2022
Merged

feat: infra view role #1507

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion internal/access/access_key.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ func currentAccessKey(c *gin.Context) *models.AccessKey {
}

func ListAccessKeys(c *gin.Context, identityID uid.ID, name string) ([]models.AccessKey, error) {
db, err := RequireInfraRole(c, models.InfraAdminRole)
db, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraViewRole)
Copy link
Collaborator Author

@BruceMacD BruceMacD Apr 7, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't output the key secrets. Only key names, expires and who they were issued for.

if err != nil {
return nil, err
}
Expand Down
56 changes: 54 additions & 2 deletions internal/access/access_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package access

import (
"fmt"
"net/http/httptest"
"os"
"testing"
Expand Down Expand Up @@ -45,7 +46,7 @@ func setupAccessTestContext(t *testing.T) (*gin.Context, *gorm.DB, *models.Provi
adminGrant := &models.Grant{
Subject: admin.PolyID(),
Privilege: models.InfraAdminRole,
Resource: "infra",
Resource: ResourceInfraAPI,
}
err = data.CreateGrant(db, adminGrant)
assert.NilError(t, err)
Expand Down Expand Up @@ -101,7 +102,6 @@ func TestUsersGroupGrant(t *testing.T) {
c, _ := gin.CreateTestContext(httptest.NewRecorder())
c.Set("db", db)
c.Set("identity", tom)
c.Set("user", tom)

grant(t, db, tom, tomsGroup.PolyID(), models.InfraUserRole, "infra")

Expand All @@ -118,6 +118,58 @@ func TestUsersGroupGrant(t *testing.T) {
assert.Assert(t, authDB != nil)
}

func TestInfraRequireInfraRole(t *testing.T) {
db := setupDB(t)

setup := func(t *testing.T, infraRole string) *gin.Context {
testIdentity := &models.Identity{Name: fmt.Sprintf("infra-%s-%s", infraRole, time.Now()), Kind: models.MachineKind}

err := data.CreateIdentity(db, testIdentity)
assert.NilError(t, err)

err = data.CreateGrant(db, &models.Grant{Subject: testIdentity.PolyID(), Privilege: infraRole, Resource: ResourceInfraAPI})
assert.NilError(t, err)

c, _ := gin.CreateTestContext(httptest.NewRecorder())
c.Set("db", db)
c.Set("identity", testIdentity)

return c
}

t.Run("has specific required role", func(t *testing.T) {
c := setup(t, models.InfraAdminRole)

authDB, err := RequireInfraRole(c, models.InfraAdminRole)
assert.NilError(t, err)
assert.Assert(t, authDB != nil)
})

t.Run("does not have specific required role", func(t *testing.T) {
c := setup(t, models.InfraViewRole)

authDB, err := RequireInfraRole(c, models.InfraAdminRole)
assert.Error(t, err, "forbidden: requestor does not have required grant")
assert.Assert(t, authDB == nil)
})

t.Run("has required role in list", func(t *testing.T) {
c := setup(t, models.InfraViewRole)

authDB, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraViewRole)
assert.NilError(t, err)
assert.Assert(t, authDB != nil)
})

t.Run("does not have required role in list", func(t *testing.T) {
c := setup(t, models.InfraViewRole)

authDB, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraConnectorRole)
assert.Error(t, err, "forbidden: requestor does not have required grant")
assert.Assert(t, authDB == nil)
})
}

func grant(t *testing.T, db *gorm.DB, currentUser *models.Identity, subject uid.PolymorphicID, privilege, resource string) {
err := data.CreateGrant(db, &models.Grant{
Subject: subject,
Expand Down
4 changes: 2 additions & 2 deletions internal/access/destination.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ func SaveDestination(c *gin.Context, destination *models.Destination) error {
}

func GetDestination(c *gin.Context, id uid.ID) (*models.Destination, error) {
db, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraConnectorRole, models.InfraUserRole)
db, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraViewRole, models.InfraConnectorRole, models.InfraUserRole)
if err != nil {
return nil, err
}
Expand All @@ -36,7 +36,7 @@ func GetDestination(c *gin.Context, id uid.ID) (*models.Destination, error) {
}

func ListDestinations(c *gin.Context, uniqueID, name string) ([]models.Destination, error) {
db, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraConnectorRole, models.InfraUserRole)
db, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraViewRole, models.InfraConnectorRole, models.InfraUserRole)
if err != nil {
return nil, err
}
Expand Down
6 changes: 3 additions & 3 deletions internal/access/grant.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ func GetGrant(c *gin.Context, id uid.ID) (*models.Grant, error) {
}

func ListGrants(c *gin.Context, subject uid.PolymorphicID, resource string, privilege string) ([]models.Grant, error) {
db, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraConnectorRole)
db, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraViewRole, models.InfraConnectorRole)
if err != nil {
return nil, err
}
Expand All @@ -27,7 +27,7 @@ func ListGrants(c *gin.Context, subject uid.PolymorphicID, resource string, priv
}

func ListIdentityGrants(c *gin.Context, identityID uid.ID) ([]models.Grant, error) {
db, err := hasAuthorization(c, identityID, isIdentitySelf, models.InfraAdminRole)
db, err := hasAuthorization(c, identityID, isIdentitySelf, models.InfraAdminRole, models.InfraViewRole)
if err != nil {
return nil, err
}
Expand All @@ -36,7 +36,7 @@ func ListIdentityGrants(c *gin.Context, identityID uid.ID) ([]models.Grant, erro
}

func ListGroupGrants(c *gin.Context, groupID uid.ID) ([]models.Grant, error) {
db, err := hasAuthorization(c, groupID, isUserInGroup, models.InfraAdminRole)
db, err := hasAuthorization(c, groupID, isUserInGroup, models.InfraAdminRole, models.InfraViewRole)
if err != nil {
return nil, err
}
Expand Down
6 changes: 3 additions & 3 deletions internal/access/group.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ func isUserInGroup(c *gin.Context, requestedResourceID uid.ID) (bool, error) {
}

func ListGroups(c *gin.Context, name string, providerID uid.ID) ([]models.Group, error) {
db, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraConnectorRole)
db, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraViewRole, models.InfraConnectorRole)
if err != nil {
return nil, err
}
Expand All @@ -49,7 +49,7 @@ func CreateGroup(c *gin.Context, group *models.Group) error {
}

func GetGroup(c *gin.Context, id uid.ID) (*models.Group, error) {
db, err := hasAuthorization(c, id, isUserInGroup, models.InfraAdminRole, models.InfraConnectorRole)
db, err := hasAuthorization(c, id, isUserInGroup, models.InfraAdminRole, models.InfraViewRole, models.InfraConnectorRole)
if err != nil {
return nil, err
}
Expand All @@ -58,7 +58,7 @@ func GetGroup(c *gin.Context, id uid.ID) (*models.Group, error) {
}

func ListIdentityGroups(c *gin.Context, userID uid.ID) ([]models.Group, error) {
db, err := hasAuthorization(c, userID, isIdentitySelf, models.InfraAdminRole)
db, err := hasAuthorization(c, userID, isIdentitySelf, models.InfraAdminRole, models.InfraViewRole)
if err != nil {
return nil, err
}
Expand Down
4 changes: 2 additions & 2 deletions internal/access/identity.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ func CurrentIdentity(c *gin.Context) *models.Identity {
}

func GetIdentity(c *gin.Context, id uid.ID) (*models.Identity, error) {
db, err := hasAuthorization(c, id, isIdentitySelf, models.InfraAdminRole, models.InfraConnectorRole)
db, err := hasAuthorization(c, id, isIdentitySelf, models.InfraAdminRole, models.InfraViewRole, models.InfraConnectorRole)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -78,7 +78,7 @@ func DeleteIdentity(c *gin.Context, id uid.ID) error {
}

func ListIdentities(c *gin.Context, email string, providerID uid.ID) ([]models.Identity, error) {
db, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraConnectorRole)
db, err := RequireInfraRole(c, models.InfraAdminRole, models.InfraViewRole, models.InfraConnectorRole)
if err != nil {
return nil, err
}
Expand Down
1 change: 1 addition & 0 deletions internal/server/models/grant.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (

const (
InfraAdminRole = "admin"
InfraViewRole = "view"
InfraUserRole = "user"
InfraConnectorRole = "connector"
)
Expand Down