DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Elevate permissions for user lookup when registering triggers, iterators

Browse Source
This commit is contained in:
Denis Arh
2021-10-08 17:40:11 +02:00
parent a30b532c15
commit 96a27b13ad
2 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
automation/service/trigger.go
+9 -1
View File
@@ -462,6 +462,14 @@ func (svc *trigger) registerWorkflow(ctx context.Context, wf *types.Workflow, tt
runAs auth.Identifiable
)
// Returns context with identity set to service user
//
// Current user (identity in the context) might not have
// sufficient privileges to load info about invoker and runner
sysUserCtx := func() context.Context {
return auth.SetIdentityToContext(ctx, auth.ServiceUser())
}
if !svc.opt.Register {
return nil
}
@@ -481,7 +489,7 @@ func (svc *trigger) registerWorkflow(ctx context.Context, wf *types.Workflow, tt
}
if wf.RunAs > 0 {
if runAs, err = DefaultUser.FindByAny(ctx, wf.RunAs); err != nil {
if runAs, err = DefaultUser.FindByAny(sysUserCtx(), wf.RunAs); err != nil {
return fmt.Errorf("failed to load run-as user %d: %w", wf.RunAs, err)
} else if !runAs.Valid() {
return fmt.Errorf("invalid user %d used for workflow run-as", wf.RunAs)
pkg/corredor/service.go
+18 -2
View File
@@ -295,6 +295,14 @@ func (svc service) ExecIterator(ctx context.Context, scriptName string) error {
runAs string
)
// Returns context with identity set to service user
//
// Current user (identity in the context) might not have
// sufficient privileges to load info about invoker and runner
sysUserCtx := func() context.Context {
return auth.SetIdentityToContext(ctx, auth.ServiceUser())
}
if script = svc.sScripts.FindByName(scriptName); script == nil {
return fmt.Errorf("nonexistent script (%q)", scriptName)
}
@@ -320,7 +328,7 @@ func (svc service) ExecIterator(ctx context.Context, scriptName string) error {
}
// Run this iterator as defined user
definer, err := svc.users.FindByAny(ctx, runAs)
definer, err := svc.users.FindByAny(sysUserCtx(), runAs)
if err != nil {
return err
}
@@ -947,6 +955,14 @@ func (svc *service) serverScriptSecurity(ctx context.Context, script *ServerScri
return
}
// Returns context with identity set to service user
//
// Current user (identity in the context) might not have
// sufficient privileges to load info about invoker and runner
sysUserCtx := func() context.Context {
return auth.SetIdentityToContext(ctx, auth.ServiceUser())
}
sec := &ScriptSecurity{Security: script.Security}
if sec.RunAs != "" {
@@ -963,7 +979,7 @@ func (svc *service) serverScriptSecurity(ctx context.Context, script *ServerScri
denyExec := make(map[uint64]bool)
for _, role := range script.Security.Deny {
if r, err := svc.roles.FindByAny(ctx, role); err != nil {
if r, err := svc.roles.FindByAny(sysUserCtx(), role); err != nil {
return fmt.Errorf("could not load security role: %s: %w", role, err)
} else {
denyExec[r.ID] = true