DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Add system role everyone, closes #55

Browse Source
This commit is contained in:
Denis Arh
2019-02-26 21:32:28 +01:00
parent 5650a10b23
commit 6985608449
3 changed files with 67 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/rules/resources.go
+4 -2
View File
@@ -57,18 +57,20 @@ func (r *resources) Check(resource string, operation string) Access {
}
func (r *resources) checkAccess(resource string, operation string) Access {
const everyoneRoleId uint64 = 1
user := r.identity()
result := []Access{}
query := []string{
// select rules
"select r.value from sys_rules r",
// join members
"inner join sys_role_member m on (m.rel_role = r.rel_role and m.rel_user=?)",
"inner join sys_role_member m on ",
"((m.rel_role = r.rel_role and m.rel_user=?) or (r.rel_role = ?))",
// add conditions
"where r.resource=? and r.operation=?",
}
queryString := strings.Join(query, " ")
if err := r.db.Select(&result, queryString, user, resource, operation); err != nil {
if err := r.db.Select(&result, queryString, user, everyoneRoleId, resource, operation); err != nil {
// @todo: log error
return Deny
}
system/db/mysql/statik.go
+1 -1
View File
File diff suppressed because one or more lines are too long
system/db/schema/mysql/20190226160000.system_roles_and_rules.up.sql
+62
View File
@@ -0,0 +1,62 @@
INSERT INTO `sys_role` (`id`, `name`, `handle`) VALUES (1, 'Everyone', 'everyone');
INSERT INTO `sys_role` (`id`, `name`, `handle`) VALUES (2, 'Administrators', 'admins');
-- Value: Allow (2), Deny (1), Inherit(0),
INSERT INTO `sys_rules` (`rel_role`, `resource`, `operation`, `value`) VALUES
-- Everyone
(1, 'compose', 'access', 2),
(1, 'messaging', 'access', 2),
-- Admins
(2, 'compose', 'namespace.create', 2),
(2, 'compose', 'access', 2),
(2, 'compose', 'grant', 2),
(2, 'compose:namespace', 'page.create', 2),
(2, 'compose:namespace', 'read', 2),
(2, 'compose:namespace', 'update', 2),
(2, 'compose:namespace', 'delete', 2),
(2, 'compose:namespace', 'module.create', 2),
(2, 'compose:namespace', 'chart.create', 2),
(2, 'compose:namespace', 'trigger.create', 2),
(2, 'compose:chart', 'read', 2),
(2, 'compose:chart', 'update', 2),
(2, 'compose:chart', 'delete', 2),
(2, 'compose:trigger', 'read', 2),
(2, 'compose:trigger', 'update', 2),
(2, 'compose:trigger', 'delete', 2),
(2, 'compose:page', 'read', 2),
(2, 'compose:page', 'update', 2),
(2, 'compose:page', 'delete', 2),
(2, 'system', 'grant', 2),
(2, 'system', 'organisation.create', 2),
(2, 'system', 'role.create', 2),
(2, 'system:organisation', 'access', 2),
(2, 'system:role', 'read', 2),
(2, 'system:role', 'update', 2),
(2, 'system:role', 'delete', 2),
(2, 'system:role', 'members.manage', 2),
(2, 'messaging', 'access', 2),
(2, 'messaging', 'grant', 2),
(2, 'messaging', 'channel.public.create', 2),
(2, 'messaging', 'channel.private.create', 2),
(2, 'messaging', 'channel.direct.create', 2),
(2, 'messaging:channel', 'update', 2),
(2, 'messaging:channel', 'message.attach', 2),
(2, 'messaging:channel', 'message.update.all', 2),
(2, 'messaging:channel', 'leave', 2),
(2, 'messaging:channel', 'webhooks.manage', 2),
(2, 'messaging:channel', 'message.embed', 2),
(2, 'messaging:channel', 'members.manage', 2),
(2, 'messaging:channel', 'attachments.manage', 2),
(2, 'messaging:channel', 'message.send', 2),
(2, 'messaging:channel', 'message.reply', 2),
(2, 'messaging:channel', 'read', 2),
(2, 'messaging:channel', 'join', 2),
(2, 'messaging:channel', 'message.update.own', 2),
(2, 'messaging:channel', 'message.react', 2),
(2, 'compose:module', 'read', 2),
(2, 'compose:module', 'update', 2),
(2, 'compose:module', 'delete', 2),
(2, 'compose:module', 'record.create', 2),
(2, 'compose:module', 'record.read', 2),
(2, 'compose:module', 'record.update', 2),
(2, 'compose:module', 'record.delete', 2);