From 5155310ca0f200df3da5bdbc05cca47c35a32fee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Toma=C5=BE=20Jerman?= Date: Wed, 29 Sep 2021 14:26:19 +0200 Subject: [PATCH] Slight record resource RBAC tweaks * Add canRead to record response * Use existing record when evaluating record update ctx roles --- compose/rest/record.go | 4 ++++ compose/service/record.go | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/compose/rest/record.go b/compose/rest/record.go index 5ec0f8606..55a0e75ee 100644 --- a/compose/rest/record.go +++ b/compose/rest/record.go @@ -33,6 +33,7 @@ type ( Records types.RecordSet `json:"records,omitempty"` CanUpdateRecord bool `json:"canUpdateRecord"` + CanReadRecord bool `json:"canReadRecord"` CanDeleteRecord bool `json:"canDeleteRecord"` CanGrant bool `json:"canGrant"` } @@ -56,6 +57,7 @@ type ( CanGrant(context.Context) bool CanUpdateRecord(context.Context, *types.Record) bool + CanReadRecord(context.Context, *types.Record) bool CanDeleteRecord(context.Context, *types.Record) bool } ) @@ -562,6 +564,7 @@ func (ctrl Record) makeBulkPayload(ctx context.Context, m *types.Module, err err Records: rr[1:], CanUpdateRecord: ctrl.ac.CanUpdateRecord(ctx, rr[0]), + CanReadRecord: ctrl.ac.CanReadRecord(ctx, rr[0]), CanDeleteRecord: ctrl.ac.CanDeleteRecord(ctx, rr[0]), }, nil } @@ -577,6 +580,7 @@ func (ctrl Record) makePayload(ctx context.Context, m *types.Module, r *types.Re CanGrant: ctrl.ac.CanGrant(ctx), CanUpdateRecord: ctrl.ac.CanUpdateRecord(ctx, r), + CanReadRecord: ctrl.ac.CanReadRecord(ctx, r), CanDeleteRecord: ctrl.ac.CanDeleteRecord(ctx, r), }, nil } diff --git a/compose/service/record.go b/compose/service/record.go index 70328faa4..159d9ae8c 100644 --- a/compose/service/record.go +++ b/compose/service/record.go @@ -723,7 +723,7 @@ func (svc record) update(ctx context.Context, upd *types.Record) (rec *types.Rec aProps.setModule(m) aProps.setRecord(old) - if !svc.ac.CanUpdateRecord(ctx, upd) { + if !svc.ac.CanUpdateRecord(ctx, old) { return nil, RecordErrNotAllowedToUpdate() }