DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Fix RBAC resource checks

Browse Source
This commit is contained in:
Denis Arh
2021-08-02 16:11:00 +02:00
parent 6419363220
commit 9e6d5884c2
5 changed files with 99 additions and 211 deletions
Download Patch File Download Diff File Expand all files Collapse all files
automation/service/access_control.gen.go
Generated
+6 -13
View File
@@ -325,8 +325,6 @@ func rbacWorkflowResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.WorkflowResourceType):], sep), sep)
prc = []string{
"ID",
@@ -337,22 +335,17 @@ func rbacWorkflowResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for Workflow", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
compose/service/access_control.gen.go
Generated
+38 -79
View File
@@ -18,11 +18,12 @@ package service
import (
"context"
"fmt"
"strings"
"github.com/cortezaproject/corteza-server/compose/types"
"github.com/cortezaproject/corteza-server/pkg/actionlog"
"github.com/cortezaproject/corteza-server/pkg/rbac"
"github.com/spf13/cast"
"strings"
)
type (
@@ -602,8 +603,6 @@ func rbacChartResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.ChartResourceType):], sep), sep)
prc = []string{
"namespaceID",
@@ -615,22 +614,17 @@ func rbacChartResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for Chart", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
@@ -654,8 +648,6 @@ func rbacModuleFieldResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.ModuleFieldResourceType):], sep), sep)
prc = []string{
"namespaceID",
@@ -668,22 +660,17 @@ func rbacModuleFieldResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for ModuleField", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
@@ -707,8 +694,6 @@ func rbacModuleResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.ModuleResourceType):], sep), sep)
prc = []string{
"namespaceID",
@@ -720,22 +705,17 @@ func rbacModuleResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for Module", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
@@ -759,8 +739,6 @@ func rbacNamespaceResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.NamespaceResourceType):], sep), sep)
prc = []string{
"ID",
@@ -771,22 +749,17 @@ func rbacNamespaceResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for Namespace", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
@@ -810,8 +783,6 @@ func rbacPageResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.PageResourceType):], sep), sep)
prc = []string{
"namespaceID",
@@ -823,22 +794,17 @@ func rbacPageResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for Page", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
@@ -862,8 +828,6 @@ func rbacRecordResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.RecordResourceType):], sep), sep)
prc = []string{
"namespaceID",
@@ -876,22 +840,17 @@ func rbacRecordResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for Record", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
federation/service/access_control.gen.go
Generated
+18 -39
View File
@@ -311,8 +311,6 @@ func rbacExposedModuleResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.ExposedModuleResourceType):], sep), sep)
prc = []string{
"nodeID",
@@ -324,22 +322,17 @@ func rbacExposedModuleResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for ExposedModule", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
@@ -363,8 +356,6 @@ func rbacNodeResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.NodeResourceType):], sep), sep)
prc = []string{
"ID",
@@ -375,22 +366,17 @@ func rbacNodeResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for Node", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
@@ -414,8 +400,6 @@ func rbacSharedModuleResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.SharedModuleResourceType):], sep), sep)
prc = []string{
"nodeID",
@@ -427,22 +411,17 @@ func rbacSharedModuleResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for SharedModule", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
pkg/codegen-v3/assets/templates/gocode/rbac/access_control.go.tpl
+6 -13
View File
@@ -219,8 +219,6 @@ func rbac{{ .Resource }}ResourceValidator(r string, oo ...string) error {
{{ if .RBAC.Resource.References }}
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len({{ $GoType }}ResourceType):], sep), sep)
prc = []string{
{{- range .RBAC.Resource.References }}
@@ -233,23 +231,18 @@ func rbac{{ .Resource }}ResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for {{ .Resource }}", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
{{- end }}
return nil
}
{{- end }}
system/service/access_control.gen.go
Generated
+31 -67
View File
@@ -17,12 +17,11 @@ package service
import (
"context"
"fmt"
"strings"
"github.com/cortezaproject/corteza-server/pkg/actionlog"
"github.com/cortezaproject/corteza-server/pkg/rbac"
"github.com/cortezaproject/corteza-server/system/types"
"github.com/spf13/cast"
"strings"
)
type (
@@ -740,8 +739,6 @@ func rbacApplicationResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.ApplicationResourceType):], sep), sep)
prc = []string{
"ID",
@@ -752,22 +749,17 @@ func rbacApplicationResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for Application", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
@@ -791,8 +783,6 @@ func rbacAuthClientResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.AuthClientResourceType):], sep), sep)
prc = []string{
"ID",
@@ -803,22 +793,17 @@ func rbacAuthClientResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for AuthClient", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
@@ -842,8 +827,6 @@ func rbacRoleResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.RoleResourceType):], sep), sep)
prc = []string{
"ID",
@@ -854,22 +837,17 @@ func rbacRoleResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for Role", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
@@ -893,8 +871,6 @@ func rbacTemplateResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.TemplateResourceType):], sep), sep)
prc = []string{
"ID",
@@ -905,22 +881,17 @@ func rbacTemplateResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for Template", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}
@@ -944,8 +915,6 @@ func rbacUserResourceValidator(r string, oo ...string) error {
const sep = "/"
var (
specIdUsed = true
pp = strings.Split(strings.Trim(r[len(types.UserResourceType):], sep), sep)
prc = []string{
"ID",
@@ -956,22 +925,17 @@ func rbacUserResourceValidator(r string, oo ...string) error {
return fmt.Errorf("invalid resource path structure")
}
for i, p := range pp {
if p == "*" {
if !specIdUsed {
for i := 0; i < len(pp); i++ {
if pp[i] != "*" {
if i > 0 && pp[i-1] == "*" {
return fmt.Errorf("invalid resource path wildcard level (%d) for User", i)
}
specIdUsed = false
continue
}
specIdUsed = true
if _, err := cast.ToUint64E(p); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], p)
if _, err := cast.ToUint64E(pp[i]); err != nil {
return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
}
}
}
return nil
}