DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Remove AC from ComposeRecord import

Browse Source
This commit is contained in:
Tomaž Jerman
2021-07-15 12:51:11 +02:00
parent 579fe3f9eb
commit a2b964c53e
3 changed files with 66 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/envoy/store/compose_record_marshal.go
+2 -21
View File
@@ -221,9 +221,6 @@ func (n *composeRecord) Encode(ctx context.Context, pl *payload) (err error) {
rm := n.recMap
im := n.res.IDMap
createAcChecked := false
updateAcChecked := false
getKey := func(i int, k string) string {
if k == "" {
return strconv.FormatInt(int64(i), 10)
@@ -424,7 +421,7 @@ func (n *composeRecord) Encode(ctx context.Context, pl *payload) (err error) {
rve *composeTypes.RecordValueErrorSet
canAccessField = func(f *composeTypes.ModuleField) bool {
return pl.composeAccessControl.CanUpdateRecordValue(ctx, f)
return true
}
)
@@ -436,7 +433,7 @@ func (n *composeRecord) Encode(ctx context.Context, pl *payload) (err error) {
return mod.Fields.HasName(v.Name), nil
})
rve = service.RecordValueUpdateOpCheck(ctx, pl.composeAccessControl, mod, rec.Values)
rve = service.RecordValueUpdateOpCheck(ctx, nil, mod, rec.Values)
if !rve.IsValid() {
return rve
}
@@ -446,22 +443,6 @@ func (n *composeRecord) Encode(ctx context.Context, pl *payload) (err error) {
return rve
}
// AC
//
// AC needs to happen down here, because we are either creating or updating
// records and we don't know that for sure in the Prepare method.
if !exists && !createAcChecked {
createAcChecked = true
if !pl.composeAccessControl.CanCreateRecordOnModule(ctx, mod) {
return fmt.Errorf("not allowed to create records for module %d", mod.ID)
}
} else if exists && !updateAcChecked {
updateAcChecked = true
if !pl.composeAccessControl.CanUpdateRecord(ctx, rec) {
return fmt.Errorf("not allowed to update record")
}
}
// Create a new record
if !exists {
err = store.CreateComposeRecord(ctx, pl.s, mod, rec)
pkg/envoy/store/encoder.go
+4 -8
View File
@@ -5,7 +5,6 @@ import (
"errors"
"fmt"
"github.com/cortezaproject/corteza-server/compose/service"
"github.com/cortezaproject/corteza-server/compose/types"
"github.com/cortezaproject/corteza-server/pkg/auth"
"github.com/cortezaproject/corteza-server/pkg/envoy"
@@ -67,9 +66,7 @@ type (
s store.Storer
state *envoy.ResourceState
composeAccessControl composeAccessController
systemAC accessControlRBACServicer
invokerID uint64
invokerID uint64
}
// resourceState allows each conforming struct to be initialized and encoded
@@ -189,10 +186,9 @@ func (se *storeEncoder) Encode(ctx context.Context, p envoy.Provider) error {
func (se *storeEncoder) makePayload(ctx context.Context, s store.Storer, ers *envoy.ResourceState) *payload {
return &payload{
s: s,
state: ers,
composeAccessControl: service.AccessControl(),
invokerID: auth.GetIdentityFromContext(ctx).Identity(),
s: s,
state: ers,
invokerID: auth.GetIdentityFromContext(ctx).Identity(),
}
}
tests/compose/record_test.go
+60 -58
View File
@@ -872,75 +872,77 @@ func TestRecordImportRun_sessionNotFound(t *testing.T) {
End()
}
func TestRecordImportRunForbidden(t *testing.T) {
h := newHelper(t)
h.clearRecords()
helpers.DenyMe(h, types.ModuleRbacResource(0, 0), "record.create")
// @todo revert whe we add import RBAC operations
// func TestRecordImportRunForbidden(t *testing.T) {
// h := newHelper(t)
// h.clearRecords()
// helpers.DenyMe(h, types.ModuleRbacResource(0, 0), "record.create")
module := h.repoMakeRecordModuleWithFields("record import run module")
tests := []struct {
Name string
Content string
}{
{
Name: "f1.csv",
Content: "fname,femail\nv1,v2\n",
},
}
// module := h.repoMakeRecordModuleWithFields("record import run module")
// tests := []struct {
// Name string
// Content string
// }{
// {
// Name: "f1.csv",
// Content: "fname,femail\nv1,v2\n",
// },
// }
for _, test := range tests {
t.Run(test.Name, func(t *testing.T) {
url := fmt.Sprintf("/namespace/%d/module/%d/record/import", module.NamespaceID, module.ID)
rsp := &rImportSession{}
api := h.apiInit()
// for _, test := range tests {
// t.Run(test.Name, func(t *testing.T) {
// url := fmt.Sprintf("/namespace/%d/module/%d/record/import", module.NamespaceID, module.ID)
// rsp := &rImportSession{}
// api := h.apiInit()
r := h.apiInitRecordImport(api, url, test.Name, []byte(test.Content)).End()
r.JSON(rsp)
// r := h.apiInitRecordImport(api, url, test.Name, []byte(test.Content)).End()
// r.JSON(rsp)
h.apiRunRecordImport(api, fmt.Sprintf("%s/%s", url, rsp.Response.SessionID), `{"fields":{"fname":"name","femail":"email"},"onError":"fail"}`).
Assert(helpers.AssertErrorP("not allowed to create records for module")).
End()
})
}
}
// h.apiRunRecordImport(api, fmt.Sprintf("%s/%s", url, rsp.Response.SessionID), `{"fields":{"fname":"name","femail":"email"},"onError":"fail"}`).
// Assert(helpers.AssertErrorP("not allowed to create records for module")).
// End()
// })
// }
// }
func TestRecordImportRunForbidden_field(t *testing.T) {
h := newHelper(t)
h.clearRecords()
helpers.AllowMe(h, types.ModuleRbacResource(0, 0), "record.create")
helpers.AllowMe(h, types.ModuleFieldRbacResource(0, 0, 0), "record.value.update")
// @todo revert whe we add import RBAC operations
// func TestRecordImportRunForbidden_field(t *testing.T) {
// h := newHelper(t)
// h.clearRecords()
// helpers.AllowMe(h, types.ModuleRbacResource(0, 0), "record.create")
// helpers.AllowMe(h, types.ModuleFieldRbacResource(0, 0, 0), "record.value.update")
module := h.repoMakeRecordModuleWithFields("record import run module")
// module := h.repoMakeRecordModuleWithFields("record import run module")
f := module.Fields.FindByName("name")
helpers.DenyMe(h, f.RbacResource(), "record.value.update")
// f := module.Fields.FindByName("name")
// helpers.DenyMe(h, f.RbacResource(), "record.value.update")
tests := []struct {
Name string
Content string
}{
{
Name: "f1.csv",
Content: "fname,femail\nv1,v2\n",
},
}
// tests := []struct {
// Name string
// Content string
// }{
// {
// Name: "f1.csv",
// Content: "fname,femail\nv1,v2\n",
// },
// }
for _, test := range tests {
t.Run(test.Name, func(t *testing.T) {
h.t = t
url := fmt.Sprintf("/namespace/%d/module/%d/record/import", module.NamespaceID, module.ID)
rsp := &rImportSession{}
api := h.apiInit()
// for _, test := range tests {
// t.Run(test.Name, func(t *testing.T) {
// h.t = t
// url := fmt.Sprintf("/namespace/%d/module/%d/record/import", module.NamespaceID, module.ID)
// rsp := &rImportSession{}
// api := h.apiInit()
r := h.apiInitRecordImport(api, url, test.Name, []byte(test.Content)).End()
r.JSON(rsp)
// r := h.apiInitRecordImport(api, url, test.Name, []byte(test.Content)).End()
// r.JSON(rsp)
h.apiRunRecordImport(api, fmt.Sprintf("%s/%s", url, rsp.Response.SessionID), `{"fields":{"fname":"name","femail":"email"},"onError":"fail"}`).
Assert(helpers.AssertErrorP("1 issue(s) found")).
End()
})
}
}
// h.apiRunRecordImport(api, fmt.Sprintf("%s/%s", url, rsp.Response.SessionID), `{"fields":{"fname":"name","femail":"email"},"onError":"fail"}`).
// Assert(helpers.AssertErrorP("1 issue(s) found")).
// End()
// })
// }
// }
func TestRecordImportRunFieldError_missing(t *testing.T) {
h := newHelper(t)