From 0ea543b2a2e2625c9efa7b8817ff10d196ccb4ba Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Wed, 26 Jan 2022 17:18:34 +0100 Subject: [PATCH] Migrate codegen for fed&automation, remove old def dir --- app/app.cue | 4 + automation/component.cue | 22 ++ automation/service/access_control.gen.go | 56 ++--- automation/types/rbac.gen.go | 11 +- automation/workflow.cue | 19 ++ def/README.md | 4 - def/automation.workflow.yaml | 23 -- def/automation.yaml | 21 -- def/federation.exposed-module.yaml | 9 - def/federation.node.yaml | 8 - def/federation.shared-module.yaml | 9 - def/federation.yaml | 19 -- federation/component.cue | 24 ++ federation/exposed-module.cue | 17 ++ federation/node.cue | 14 ++ federation/service/access_control.gen.go | 210 +++++++++--------- federation/shared-module.cue | 17 ++ federation/types/rbac.gen.go | 77 +++---- .../rbac_references_automation.gen.go | 4 - .../rbac_references_federation.gen.go | 56 +++++ pkg/envoy/resource/rbac_rules_parse.gen.go | 54 +++++ 21 files changed, 402 insertions(+), 276 deletions(-) create mode 100644 automation/component.cue create mode 100644 automation/workflow.cue delete mode 100644 def/README.md delete mode 100644 def/automation.workflow.yaml delete mode 100644 def/automation.yaml delete mode 100644 def/federation.exposed-module.yaml delete mode 100644 def/federation.node.yaml delete mode 100644 def/federation.shared-module.yaml delete mode 100644 def/federation.yaml create mode 100644 federation/component.cue create mode 100644 federation/exposed-module.cue create mode 100644 federation/node.cue create mode 100644 federation/shared-module.cue create mode 100644 pkg/envoy/resource/rbac_references_federation.gen.go diff --git a/app/app.cue b/app/app.cue index 37b1d1142..36765a6c9 100644 --- a/app/app.cue +++ b/app/app.cue @@ -4,6 +4,8 @@ import ( "github.com/cortezaproject/corteza-server/codegen/schema" "github.com/cortezaproject/corteza-server/system" "github.com/cortezaproject/corteza-server/compose" + "github.com/cortezaproject/corteza-server/automation" + "github.com/cortezaproject/corteza-server/federation" ) corteza: schema.#platform & { @@ -12,5 +14,7 @@ corteza: schema.#platform & { components: [ system.component, compose.component, + automation.component, + federation.component, ] } diff --git a/automation/component.cue b/automation/component.cue new file mode 100644 index 000000000..02f2eb66a --- /dev/null +++ b/automation/component.cue @@ -0,0 +1,22 @@ +package automation + +import ( + "github.com/cortezaproject/corteza-server/codegen/schema" +) + +component: schema.#component & { + handle: "automation" + + resources: { + "workflow": workflow + } + + rbac: operations: { + "grant": description: "Manage automation permissions" + "workflow.create": description: "Create workflows" + "triggers.search": description: "List, search or filter triggers" + "sessions.search": description: "List, search or filter sessions" + "workflows.search": description: "List, search or filter workflows" + "resource-translations.manage": description: "List, search, create, or update resource translations" + } +} diff --git a/automation/service/access_control.gen.go b/automation/service/access_control.gen.go index a44b281da..b7c8eb411 100644 --- a/automation/service/access_control.gen.go +++ b/automation/service/access_control.gen.go @@ -6,10 +6,6 @@ package service // the code is regenerated. // -// Definitions file that controls how this file is generated: -// - automation.workflow.yaml -// - automation.yaml - import ( "context" "fmt" @@ -249,42 +245,48 @@ func (svc accessControl) CanManageSessionsOnWorkflow(ctx context.Context, r *typ // // This function is auto-generated func (svc accessControl) CanGrant(ctx context.Context) bool { - return svc.can(ctx, "grant", &types.Component{}) + r := &types.Component{} + return svc.can(ctx, "grant", r) } // CanCreateWorkflow checks if current user can create workflows // // This function is auto-generated func (svc accessControl) CanCreateWorkflow(ctx context.Context) bool { - return svc.can(ctx, "workflow.create", &types.Component{}) + r := &types.Component{} + return svc.can(ctx, "workflow.create", r) } // CanSearchTriggers checks if current user can list, search or filter triggers // // This function is auto-generated func (svc accessControl) CanSearchTriggers(ctx context.Context) bool { - return svc.can(ctx, "triggers.search", &types.Component{}) + r := &types.Component{} + return svc.can(ctx, "triggers.search", r) } // CanSearchSessions checks if current user can list, search or filter sessions // // This function is auto-generated func (svc accessControl) CanSearchSessions(ctx context.Context) bool { - return svc.can(ctx, "sessions.search", &types.Component{}) + r := &types.Component{} + return svc.can(ctx, "sessions.search", r) } // CanSearchWorkflows checks if current user can list, search or filter workflows // // This function is auto-generated func (svc accessControl) CanSearchWorkflows(ctx context.Context) bool { - return svc.can(ctx, "workflows.search", &types.Component{}) + r := &types.Component{} + return svc.can(ctx, "workflows.search", r) } // CanManageResourceTranslations checks if current user can list, search, create, or update resource translations // // This function is auto-generated func (svc accessControl) CanManageResourceTranslations(ctx context.Context) bool { - return svc.can(ctx, "resource-translations.manage", &types.Component{}) + r := &types.Component{} + return svc.can(ctx, "resource-translations.manage", r) } // rbacResourceValidator validates known component's resource by routing it to the appropriate validator @@ -330,24 +332,24 @@ func rbacResourceOperations(r string) map[string]bool { return nil } -// rbacWorkflowResourceValidator checks validity of rbac resource and operations +// rbacWorkflowResourceValidator checks validity of RBAC resource and operations // // Can be called without operations to check for validity of resource string only // // This function is auto-generated func rbacWorkflowResourceValidator(r string, oo ...string) error { - defOps := rbacResourceOperations(r) - for _, o := range oo { - if !defOps[o] { - return fmt.Errorf("invalid operation '%s' for automation Workflow resource", o) - } - } - if !strings.HasPrefix(r, types.WorkflowResourceType) { // expecting resource to always include path return fmt.Errorf("invalid resource type") } + defOps := rbacResourceOperations(r) + for _, o := range oo { + if !defOps[o] { + return fmt.Errorf("invalid operation '%s' for workflow resource", o) + } + } + const sep = "/" var ( pp = strings.Split(strings.Trim(r[len(types.WorkflowResourceType):], sep), sep) @@ -363,7 +365,7 @@ func rbacWorkflowResourceValidator(r string, oo ...string) error { for i := 0; i < len(pp); i++ { if pp[i] != "*" { if i > 0 && pp[i-1] == "*" { - return fmt.Errorf("invalid resource path wildcard level (%d) for Workflow", i) + return fmt.Errorf("invalid path wildcard level (%d) for workflow resource", i) } if _, err := cast.ToUint64E(pp[i]); err != nil { @@ -374,23 +376,23 @@ func rbacWorkflowResourceValidator(r string, oo ...string) error { return nil } -// rbacComponentResourceValidator checks validity of rbac resource and operations +// rbacComponentResourceValidator checks validity of RBAC resource and operations // // Can be called without operations to check for validity of resource string only // // This function is auto-generated func rbacComponentResourceValidator(r string, oo ...string) error { - defOps := rbacResourceOperations(r) - for _, o := range oo { - if !defOps[o] { - return fmt.Errorf("invalid operation '%s' for automation resource", o) - } - } - if !strings.HasPrefix(r, types.ComponentResourceType) { // expecting resource to always include path return fmt.Errorf("invalid resource type") } + defOps := rbacResourceOperations(r) + for _, o := range oo { + if !defOps[o] { + return fmt.Errorf("invalid operation '%s' for automation component resource", o) + } + } + return nil } diff --git a/automation/types/rbac.gen.go b/automation/types/rbac.gen.go index 67b46ebcd..9dabe3f2c 100644 --- a/automation/types/rbac.gen.go +++ b/automation/types/rbac.gen.go @@ -6,10 +6,6 @@ package types // the code is regenerated. // -// Definitions file that controls how this file is generated: -// - automation.workflow.yaml -// - automation.yaml - import ( "fmt" "strconv" @@ -22,6 +18,11 @@ type ( Component struct{} ) +var ( + _ = fmt.Printf + _ = strconv.FormatUint +) + const ( WorkflowResourceType = "corteza::automation:workflow" ComponentResourceType = "corteza::automation" @@ -53,7 +54,6 @@ func WorkflowRbacResource(id uint64) string { } -// @todo template func WorkflowRbacResourceTpl() string { return "%s/%s" } @@ -77,7 +77,6 @@ func ComponentRbacResource() string { } -// @todo template func ComponentRbacResourceTpl() string { return "%s" } diff --git a/automation/workflow.cue b/automation/workflow.cue new file mode 100644 index 000000000..b8dfd40cc --- /dev/null +++ b/automation/workflow.cue @@ -0,0 +1,19 @@ +package automation + +import ( + "github.com/cortezaproject/corteza-server/codegen/schema" +) + +workflow: schema.#resource & { + rbac: { + operations: { + "read": description: "Read workflow" + "update": description: "Update workflow" + "delete": description: "Delete workflow" + "undelete": description: "Undelete workflow" + "execute": description: "Execute workflow" + "triggers.manage": description: "Manage workflow triggers" + "sessions.manage": description: "Manage workflow sessions" + } + } +} diff --git a/def/README.md b/def/README.md deleted file mode 100644 index 6733bffa2..000000000 --- a/def/README.md +++ /dev/null @@ -1,4 +0,0 @@ -Obsolete and pending removal. - -All automation.* & federation.* yamls need to be converted -to cue and moved to automation/ diff --git a/def/automation.workflow.yaml b/def/automation.workflow.yaml deleted file mode 100644 index 83cb29328..000000000 --- a/def/automation.workflow.yaml +++ /dev/null @@ -1,23 +0,0 @@ -rbac: - operations: - read: - description: Read workflow - update: - description: Update workflow - delete: - description: Delete workflow - undelete: - description: Undelete workflow - execute: - description: Execute workflow - triggers.manage: - description: Manage workflow triggers - sessions.manage: - description: Manage workflow sessions - -# locale: -# resource: -# references: [ ID ] -# keys: -# - { path: name, field: "Meta.Name" } -# - { path: description, field: "Meta.Description" } diff --git a/def/automation.yaml b/def/automation.yaml deleted file mode 100644 index 94c8974b9..000000000 --- a/def/automation.yaml +++ /dev/null @@ -1,21 +0,0 @@ -rbac: - resource: { references: [] } - - operations: - grant: - description: Manage automation permissions - - workflow.create: - description: Create workflows - - triggers.search: - description: List, search or filter triggers - - sessions.search: - description: List, search or filter sessions - - workflows.search: - description: List, search or filter workflows - - resource-translations.manage: - description: List, search, create, or update resource translations diff --git a/def/federation.exposed-module.yaml b/def/federation.exposed-module.yaml deleted file mode 100644 index 7dff05e90..000000000 --- a/def/federation.exposed-module.yaml +++ /dev/null @@ -1,9 +0,0 @@ -rbac: - resource: - references: [ node, ID ] - - operations: - manage: - description: Manage shared module - -envoy: false diff --git a/def/federation.node.yaml b/def/federation.node.yaml deleted file mode 100644 index bf46d9edc..000000000 --- a/def/federation.node.yaml +++ /dev/null @@ -1,8 +0,0 @@ -rbac: - operations: - manage: - description: Manage federation node - module.create: - description: Create shared module - -envoy: false diff --git a/def/federation.shared-module.yaml b/def/federation.shared-module.yaml deleted file mode 100644 index 9ecb0ad40..000000000 --- a/def/federation.shared-module.yaml +++ /dev/null @@ -1,9 +0,0 @@ -rbac: - resource: - references: [ node, ID ] - - operations: - map: - description: Map shared module - -envoy: false diff --git a/def/federation.yaml b/def/federation.yaml deleted file mode 100644 index 5064f5a5b..000000000 --- a/def/federation.yaml +++ /dev/null @@ -1,19 +0,0 @@ -rbac: - resource: { references: [] } - operations: - grant: - description: Manage federation permissions - pair: - description: Pair federation nodes - - settings.read: - description: Read settings - settings.manage: - description: Manage settings - - node.create: - description: Create new federation node - nodes.search: - description: List, search or filter federation nodes - -envoy: false diff --git a/federation/component.cue b/federation/component.cue new file mode 100644 index 000000000..c148788da --- /dev/null +++ b/federation/component.cue @@ -0,0 +1,24 @@ +package federation + +import ( + "github.com/cortezaproject/corteza-server/codegen/schema" +) + +component: schema.#component & { + handle: "federation" + + resources: { + "node": node + "exposed-module": exposedModule + "shared-module": sharedModule + } + + rbac: operations: { + "grant": description: "Manage federation permissions" + "pair": description: "Pair federation nodes" + "settings.read": description: "Read settings" + "settings.manage": description: "Manage settings" + "node.create": description: "Create new federation node" + "nodes.search": description: "List, search or filter federation nodes" + } +} diff --git a/federation/exposed-module.cue b/federation/exposed-module.cue new file mode 100644 index 000000000..07d0d3626 --- /dev/null +++ b/federation/exposed-module.cue @@ -0,0 +1,17 @@ +package federation + +import ( + "github.com/cortezaproject/corteza-server/codegen/schema" +) + +exposedModule: schema.#resource & { + parents: [ + {handle: "node"}, + ] + + rbac: { + operations: { + "manage": description: "Manage exposed module module" + } + } +} diff --git a/federation/node.cue b/federation/node.cue new file mode 100644 index 000000000..f82269b61 --- /dev/null +++ b/federation/node.cue @@ -0,0 +1,14 @@ +package federation + +import ( + "github.com/cortezaproject/corteza-server/codegen/schema" +) + +node: schema.#resource & { + rbac: { + operations: { + "manage": description: "Manage federation node" + "module.create": description: "Create shared module" + } + } +} diff --git a/federation/service/access_control.gen.go b/federation/service/access_control.gen.go index 761b11367..5b268c8a3 100644 --- a/federation/service/access_control.gen.go +++ b/federation/service/access_control.gen.go @@ -6,12 +6,6 @@ package service // the code is regenerated. // -// Definitions file that controls how this file is generated: -// - federation.exposed-module.yaml -// - federation.node.yaml -// - federation.shared-module.yaml -// - federation.yaml - import ( "context" "fmt" @@ -60,11 +54,6 @@ func (svc accessControl) Effective(ctx context.Context, rr ...rbac.Resource) (ee func (svc accessControl) List() (out []map[string]string) { def := []map[string]string{ - { - "type": types.ExposedModuleResourceType, - "any": types.ExposedModuleRbacResource(0, 0), - "op": "manage", - }, { "type": types.NodeResourceType, "any": types.NodeRbacResource(0), @@ -75,6 +64,11 @@ func (svc accessControl) List() (out []map[string]string) { "any": types.NodeRbacResource(0), "op": "module.create", }, + { + "type": types.ExposedModuleResourceType, + "any": types.ExposedModuleRbacResource(0, 0), + "op": "manage", + }, { "type": types.SharedModuleResourceType, "any": types.SharedModuleRbacResource(0, 0), @@ -183,13 +177,6 @@ func (svc accessControl) CloneRulesByRoleID(ctx context.Context, fromRoleID uint return svc.rbac.CloneRulesByRoleID(ctx, fromRoleID, toRoleID...) } -// CanManageExposedModule checks if current user can manage shared module -// -// This function is auto-generated -func (svc accessControl) CanManageExposedModule(ctx context.Context, r *types.ExposedModule) bool { - return svc.can(ctx, "manage", r) -} - // CanManageNode checks if current user can manage federation node // // This function is auto-generated @@ -204,6 +191,13 @@ func (svc accessControl) CanCreateModuleOnNode(ctx context.Context, r *types.Nod return svc.can(ctx, "module.create", r) } +// CanManageExposedModule checks if current user can manage exposed module module +// +// This function is auto-generated +func (svc accessControl) CanManageExposedModule(ctx context.Context, r *types.ExposedModule) bool { + return svc.can(ctx, "manage", r) +} + // CanMapSharedModule checks if current user can map shared module // // This function is auto-generated @@ -215,42 +209,48 @@ func (svc accessControl) CanMapSharedModule(ctx context.Context, r *types.Shared // // This function is auto-generated func (svc accessControl) CanGrant(ctx context.Context) bool { - return svc.can(ctx, "grant", &types.Component{}) + r := &types.Component{} + return svc.can(ctx, "grant", r) } // CanPair checks if current user can pair federation nodes // // This function is auto-generated func (svc accessControl) CanPair(ctx context.Context) bool { - return svc.can(ctx, "pair", &types.Component{}) + r := &types.Component{} + return svc.can(ctx, "pair", r) } // CanReadSettings checks if current user can read settings // // This function is auto-generated func (svc accessControl) CanReadSettings(ctx context.Context) bool { - return svc.can(ctx, "settings.read", &types.Component{}) + r := &types.Component{} + return svc.can(ctx, "settings.read", r) } // CanManageSettings checks if current user can manage settings // // This function is auto-generated func (svc accessControl) CanManageSettings(ctx context.Context) bool { - return svc.can(ctx, "settings.manage", &types.Component{}) + r := &types.Component{} + return svc.can(ctx, "settings.manage", r) } // CanCreateNode checks if current user can create new federation node // // This function is auto-generated func (svc accessControl) CanCreateNode(ctx context.Context) bool { - return svc.can(ctx, "node.create", &types.Component{}) + r := &types.Component{} + return svc.can(ctx, "node.create", r) } // CanSearchNodes checks if current user can list, search or filter federation nodes // // This function is auto-generated func (svc accessControl) CanSearchNodes(ctx context.Context) bool { - return svc.can(ctx, "nodes.search", &types.Component{}) + r := &types.Component{} + return svc.can(ctx, "nodes.search", r) } // rbacResourceValidator validates known component's resource by routing it to the appropriate validator @@ -258,10 +258,10 @@ func (svc accessControl) CanSearchNodes(ctx context.Context) bool { // This function is auto-generated func rbacResourceValidator(r string, oo ...string) error { switch rbac.ResourceType(r) { - case types.ExposedModuleResourceType: - return rbacExposedModuleResourceValidator(r, oo...) case types.NodeResourceType: return rbacNodeResourceValidator(r, oo...) + case types.ExposedModuleResourceType: + return rbacExposedModuleResourceValidator(r, oo...) case types.SharedModuleResourceType: return rbacSharedModuleResourceValidator(r, oo...) case types.ComponentResourceType: @@ -276,15 +276,15 @@ func rbacResourceValidator(r string, oo ...string) error { // This function is auto-generated func rbacResourceOperations(r string) map[string]bool { switch rbac.ResourceType(r) { - case types.ExposedModuleResourceType: - return map[string]bool{ - "manage": true, - } case types.NodeResourceType: return map[string]bool{ "manage": true, "module.create": true, } + case types.ExposedModuleResourceType: + return map[string]bool{ + "manage": true, + } case types.SharedModuleResourceType: return map[string]bool{ "map": true, @@ -303,69 +303,24 @@ func rbacResourceOperations(r string) map[string]bool { return nil } -// rbacExposedModuleResourceValidator checks validity of rbac resource and operations -// -// Can be called without operations to check for validity of resource string only -// -// This function is auto-generated -func rbacExposedModuleResourceValidator(r string, oo ...string) error { - defOps := rbacResourceOperations(r) - for _, o := range oo { - if !defOps[o] { - return fmt.Errorf("invalid operation '%s' for federation ExposedModule resource", o) - } - } - - if !strings.HasPrefix(r, types.ExposedModuleResourceType) { - // expecting resource to always include path - return fmt.Errorf("invalid resource type") - } - - const sep = "/" - var ( - pp = strings.Split(strings.Trim(r[len(types.ExposedModuleResourceType):], sep), sep) - prc = []string{ - "nodeID", - "ID", - } - ) - - if len(pp) != len(prc) { - return fmt.Errorf("invalid resource path structure") - } - - for i := 0; i < len(pp); i++ { - if pp[i] != "*" { - if i > 0 && pp[i-1] == "*" { - return fmt.Errorf("invalid resource path wildcard level (%d) for ExposedModule", i) - } - - if _, err := cast.ToUint64E(pp[i]); err != nil { - return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i]) - } - } - } - return nil -} - -// rbacNodeResourceValidator checks validity of rbac resource and operations +// rbacNodeResourceValidator checks validity of RBAC resource and operations // // Can be called without operations to check for validity of resource string only // // This function is auto-generated func rbacNodeResourceValidator(r string, oo ...string) error { - defOps := rbacResourceOperations(r) - for _, o := range oo { - if !defOps[o] { - return fmt.Errorf("invalid operation '%s' for federation Node resource", o) - } - } - if !strings.HasPrefix(r, types.NodeResourceType) { // expecting resource to always include path return fmt.Errorf("invalid resource type") } + defOps := rbacResourceOperations(r) + for _, o := range oo { + if !defOps[o] { + return fmt.Errorf("invalid operation '%s' for node resource", o) + } + } + const sep = "/" var ( pp = strings.Split(strings.Trim(r[len(types.NodeResourceType):], sep), sep) @@ -381,7 +336,7 @@ func rbacNodeResourceValidator(r string, oo ...string) error { for i := 0; i < len(pp); i++ { if pp[i] != "*" { if i > 0 && pp[i-1] == "*" { - return fmt.Errorf("invalid resource path wildcard level (%d) for Node", i) + return fmt.Errorf("invalid path wildcard level (%d) for node resource", i) } if _, err := cast.ToUint64E(pp[i]); err != nil { @@ -392,29 +347,29 @@ func rbacNodeResourceValidator(r string, oo ...string) error { return nil } -// rbacSharedModuleResourceValidator checks validity of rbac resource and operations +// rbacExposedModuleResourceValidator checks validity of RBAC resource and operations // // Can be called without operations to check for validity of resource string only // // This function is auto-generated -func rbacSharedModuleResourceValidator(r string, oo ...string) error { - defOps := rbacResourceOperations(r) - for _, o := range oo { - if !defOps[o] { - return fmt.Errorf("invalid operation '%s' for federation SharedModule resource", o) - } - } - - if !strings.HasPrefix(r, types.SharedModuleResourceType) { +func rbacExposedModuleResourceValidator(r string, oo ...string) error { + if !strings.HasPrefix(r, types.ExposedModuleResourceType) { // expecting resource to always include path return fmt.Errorf("invalid resource type") } + defOps := rbacResourceOperations(r) + for _, o := range oo { + if !defOps[o] { + return fmt.Errorf("invalid operation '%s' for exposedModule resource", o) + } + } + const sep = "/" var ( - pp = strings.Split(strings.Trim(r[len(types.SharedModuleResourceType):], sep), sep) + pp = strings.Split(strings.Trim(r[len(types.ExposedModuleResourceType):], sep), sep) prc = []string{ - "nodeID", + "NodeID", "ID", } ) @@ -426,7 +381,7 @@ func rbacSharedModuleResourceValidator(r string, oo ...string) error { for i := 0; i < len(pp); i++ { if pp[i] != "*" { if i > 0 && pp[i-1] == "*" { - return fmt.Errorf("invalid resource path wildcard level (%d) for SharedModule", i) + return fmt.Errorf("invalid path wildcard level (%d) for exposedModule resource", i) } if _, err := cast.ToUint64E(pp[i]); err != nil { @@ -437,23 +392,68 @@ func rbacSharedModuleResourceValidator(r string, oo ...string) error { return nil } -// rbacComponentResourceValidator checks validity of rbac resource and operations +// rbacSharedModuleResourceValidator checks validity of RBAC resource and operations +// +// Can be called without operations to check for validity of resource string only +// +// This function is auto-generated +func rbacSharedModuleResourceValidator(r string, oo ...string) error { + if !strings.HasPrefix(r, types.SharedModuleResourceType) { + // expecting resource to always include path + return fmt.Errorf("invalid resource type") + } + + defOps := rbacResourceOperations(r) + for _, o := range oo { + if !defOps[o] { + return fmt.Errorf("invalid operation '%s' for sharedModule resource", o) + } + } + + const sep = "/" + var ( + pp = strings.Split(strings.Trim(r[len(types.SharedModuleResourceType):], sep), sep) + prc = []string{ + "NodeID", + "ID", + } + ) + + if len(pp) != len(prc) { + return fmt.Errorf("invalid resource path structure") + } + + for i := 0; i < len(pp); i++ { + if pp[i] != "*" { + if i > 0 && pp[i-1] == "*" { + return fmt.Errorf("invalid path wildcard level (%d) for sharedModule resource", i) + } + + if _, err := cast.ToUint64E(pp[i]); err != nil { + return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i]) + } + } + } + return nil +} + +// rbacComponentResourceValidator checks validity of RBAC resource and operations // // Can be called without operations to check for validity of resource string only // // This function is auto-generated func rbacComponentResourceValidator(r string, oo ...string) error { - defOps := rbacResourceOperations(r) - for _, o := range oo { - if !defOps[o] { - return fmt.Errorf("invalid operation '%s' for federation resource", o) - } - } - if !strings.HasPrefix(r, types.ComponentResourceType) { // expecting resource to always include path return fmt.Errorf("invalid resource type") } + defOps := rbacResourceOperations(r) + for _, o := range oo { + if !defOps[o] { + return fmt.Errorf("invalid operation '%s' for federation component resource", o) + } + } + return nil } diff --git a/federation/shared-module.cue b/federation/shared-module.cue new file mode 100644 index 000000000..9509315b0 --- /dev/null +++ b/federation/shared-module.cue @@ -0,0 +1,17 @@ +package federation + +import ( + "github.com/cortezaproject/corteza-server/codegen/schema" +) + +sharedModule: schema.#resource & { + parents: [ + {handle: "node"}, + ] + + rbac: { + operations: { + "map": description: "Map shared module" + } + } +} diff --git a/federation/types/rbac.gen.go b/federation/types/rbac.gen.go index 7c59affe9..9e677c77c 100644 --- a/federation/types/rbac.gen.go +++ b/federation/types/rbac.gen.go @@ -6,12 +6,6 @@ package types // the code is regenerated. // -// Definitions file that controls how this file is generated: -// - federation.exposed-module.yaml -// - federation.node.yaml -// - federation.shared-module.yaml -// - federation.yaml - import ( "fmt" "strconv" @@ -24,13 +18,48 @@ type ( Component struct{} ) +var ( + _ = fmt.Printf + _ = strconv.FormatUint +) + const ( - ExposedModuleResourceType = "corteza::federation:exposed-module" NodeResourceType = "corteza::federation:node" + ExposedModuleResourceType = "corteza::federation:exposed-module" SharedModuleResourceType = "corteza::federation:shared-module" ComponentResourceType = "corteza::federation" ) +// RbacResource returns string representation of RBAC resource for Node by calling NodeRbacResource fn +// +// RBAC resource is in the corteza::federation:node/... format +// +// This function is auto-generated +func (r Node) RbacResource() string { + return NodeRbacResource(r.ID) +} + +// NodeRbacResource returns string representation of RBAC resource for Node +// +// RBAC resource is in the corteza::federation:node/... format +// +// This function is auto-generated +func NodeRbacResource(id uint64) string { + cpts := []interface{}{NodeResourceType} + if id != 0 { + cpts = append(cpts, strconv.FormatUint(id, 10)) + } else { + cpts = append(cpts, "*") + } + + return fmt.Sprintf(NodeRbacResourceTpl(), cpts...) + +} + +func NodeRbacResourceTpl() string { + return "%s/%s" +} + // RbacResource returns string representation of RBAC resource for ExposedModule by calling ExposedModuleRbacResource fn // // RBAC resource is in the corteza::federation:exposed-module/... format @@ -63,42 +92,10 @@ func ExposedModuleRbacResource(nodeID uint64, id uint64) string { } -// @todo template func ExposedModuleRbacResourceTpl() string { return "%s/%s/%s" } -// RbacResource returns string representation of RBAC resource for Node by calling NodeRbacResource fn -// -// RBAC resource is in the corteza::federation:node/... format -// -// This function is auto-generated -func (r Node) RbacResource() string { - return NodeRbacResource(r.ID) -} - -// NodeRbacResource returns string representation of RBAC resource for Node -// -// RBAC resource is in the corteza::federation:node/... format -// -// This function is auto-generated -func NodeRbacResource(id uint64) string { - cpts := []interface{}{NodeResourceType} - if id != 0 { - cpts = append(cpts, strconv.FormatUint(id, 10)) - } else { - cpts = append(cpts, "*") - } - - return fmt.Sprintf(NodeRbacResourceTpl(), cpts...) - -} - -// @todo template -func NodeRbacResourceTpl() string { - return "%s/%s" -} - // RbacResource returns string representation of RBAC resource for SharedModule by calling SharedModuleRbacResource fn // // RBAC resource is in the corteza::federation:shared-module/... format @@ -131,7 +128,6 @@ func SharedModuleRbacResource(nodeID uint64, id uint64) string { } -// @todo template func SharedModuleRbacResourceTpl() string { return "%s/%s/%s" } @@ -155,7 +151,6 @@ func ComponentRbacResource() string { } -// @todo template func ComponentRbacResourceTpl() string { return "%s" } diff --git a/pkg/envoy/resource/rbac_references_automation.gen.go b/pkg/envoy/resource/rbac_references_automation.gen.go index f3abc0b12..231c3fbe2 100644 --- a/pkg/envoy/resource/rbac_references_automation.gen.go +++ b/pkg/envoy/resource/rbac_references_automation.gen.go @@ -6,10 +6,6 @@ package resource // the code is regenerated. // -// Definitions file that controls how this file is generated: -// - automation.workflow.yaml -// - automation.yaml - import ( "github.com/cortezaproject/corteza-server/automation/types" ) diff --git a/pkg/envoy/resource/rbac_references_federation.gen.go b/pkg/envoy/resource/rbac_references_federation.gen.go new file mode 100644 index 000000000..5900fd1c3 --- /dev/null +++ b/pkg/envoy/resource/rbac_references_federation.gen.go @@ -0,0 +1,56 @@ +package resource + +// This file is auto-generated. +// +// Changes to this file may cause incorrect behavior and will be lost if +// the code is regenerated. +// + +import ( + "github.com/cortezaproject/corteza-server/federation/types" +) + +// FederationNodeRbacReferences generates RBAC references +// +// Resources with "envoy: false" are skipped +// +// This function is auto-generated +func FederationNodeRbacReferences(node string) (res *Ref, pp []*Ref, err error) { + if node != "*" { + res = &Ref{ResourceType: types.NodeResourceType, Identifiers: MakeIdentifiers(node)} + } + + return +} + +// FederationExposedModuleRbacReferences generates RBAC references +// +// Resources with "envoy: false" are skipped +// +// This function is auto-generated +func FederationExposedModuleRbacReferences(nodeID string, exposedModule string) (res *Ref, pp []*Ref, err error) { + if nodeID != "*" { + pp = append(pp, &Ref{ResourceType: types.NodeResourceType, Identifiers: MakeIdentifiers(nodeID)}) + } + if exposedModule != "*" { + res = &Ref{ResourceType: types.ExposedModuleResourceType, Identifiers: MakeIdentifiers(exposedModule)} + } + + return +} + +// FederationSharedModuleRbacReferences generates RBAC references +// +// Resources with "envoy: false" are skipped +// +// This function is auto-generated +func FederationSharedModuleRbacReferences(nodeID string, sharedModule string) (res *Ref, pp []*Ref, err error) { + if nodeID != "*" { + pp = append(pp, &Ref{ResourceType: types.NodeResourceType, Identifiers: MakeIdentifiers(nodeID)}) + } + if sharedModule != "*" { + res = &Ref{ResourceType: types.SharedModuleResourceType, Identifiers: MakeIdentifiers(sharedModule)} + } + + return +} diff --git a/pkg/envoy/resource/rbac_rules_parse.gen.go b/pkg/envoy/resource/rbac_rules_parse.gen.go index f5c9d7a04..58d30aae9 100644 --- a/pkg/envoy/resource/rbac_rules_parse.gen.go +++ b/pkg/envoy/resource/rbac_rules_parse.gen.go @@ -8,7 +8,9 @@ package resource import ( "fmt" + automationTypes "github.com/cortezaproject/corteza-server/automation/types" composeTypes "github.com/cortezaproject/corteza-server/compose/types" + federationTypes "github.com/cortezaproject/corteza-server/federation/types" systemTypes "github.com/cortezaproject/corteza-server/system/types" "strings" ) @@ -178,6 +180,44 @@ func ParseRule(res string) (string, *Ref, []*Ref, error) { ) return resourceType, ref, pp, err + case automationTypes.WorkflowResourceType: + if len(path) != 1 { + return "", nil, nil, fmt.Errorf("expecting 1 reference components in path, got %d", len(path)) + } + ref, pp, err := AutomationWorkflowRbacReferences( + path[0], + ) + return resourceType, ref, pp, err + + case federationTypes.NodeResourceType: + if len(path) != 1 { + return "", nil, nil, fmt.Errorf("expecting 1 reference components in path, got %d", len(path)) + } + ref, pp, err := FederationNodeRbacReferences( + path[0], + ) + return resourceType, ref, pp, err + + case federationTypes.ExposedModuleResourceType: + if len(path) != 2 { + return "", nil, nil, fmt.Errorf("expecting 2 reference components in path, got %d", len(path)) + } + ref, pp, err := FederationExposedModuleRbacReferences( + path[0], + path[1], + ) + return resourceType, ref, pp, err + + case federationTypes.SharedModuleResourceType: + if len(path) != 2 { + return "", nil, nil, fmt.Errorf("expecting 2 reference components in path, got %d", len(path)) + } + ref, pp, err := FederationSharedModuleRbacReferences( + path[0], + path[1], + ) + return resourceType, ref, pp, err + case systemTypes.ComponentResourceType: if len(path) != 0 { return "", nil, nil, fmt.Errorf("expecting 0 reference components in path, got %d", len(path)) @@ -190,6 +230,20 @@ func ParseRule(res string) (string, *Ref, []*Ref, error) { return "", nil, nil, fmt.Errorf("expecting 0 reference components in path, got %d", len(path)) } + // Component resource, no path + return resourceType, nil, nil, nil + case automationTypes.ComponentResourceType: + if len(path) != 0 { + return "", nil, nil, fmt.Errorf("expecting 0 reference components in path, got %d", len(path)) + } + + // Component resource, no path + return resourceType, nil, nil, nil + case federationTypes.ComponentResourceType: + if len(path) != 0 { + return "", nil, nil, fmt.Errorf("expecting 0 reference components in path, got %d", len(path)) + } + // Component resource, no path return resourceType, nil, nil, nil }