DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Simplify automation permissions

Browse Source
This commit is contained in:
Denis Arh
2019-09-05 09:34:27 +02:00
parent a2dc8e96fe
commit ca38697b5b
4 changed files with 10 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
system/internal/service/access_control.go
View File

@@ -81,10 +81,6 @@ func (svc accessControl) CanCreateAutomationScript(ctx context.Context) bool {
return svc.can(ctx, types.SystemPermissionResource, "automation-script.create")
}
func (svc accessControl) CanManageMailGatewayAutomation(ctx context.Context) bool {
return svc.can(ctx, types.SystemPermissionResource, "mail-gw-automation.manage")
}
func (svc accessControl) CanReadRole(ctx context.Context, rl *types.Role) bool {
return svc.can(ctx, rl, "read", permissions.Allowed)
}
@@ -196,7 +192,6 @@ func (svc accessControl) DefaultRules() permissions.RuleSet {
allowAdm(sys, "user.create"),
allowAdm(sys, "role.create"),
allowAdm(sys, "automation-script.create"),
allowAdm(sys, "mail-gw-automation.manage"),
allowAdm(organisations, "access"),
allowAdm(applications, "read"),
@@ -234,7 +229,6 @@ func (svc accessControl) Whitelist() permissions.Whitelist {
"user.create",
"application.create",
"automation-script.create",
"mail-gw-automation.manage",
)
wl.Set(

2
system/internal/service/automation_script.go
View File

@@ -29,8 +29,6 @@ type (
automationScriptAccessController interface {
CanGrant(context.Context) bool
CanManageMailGatewayAutomation(context.Context) bool
CanCreateAutomationScript(context.Context) bool
CanReadAnyAutomationScript(context.Context) bool
CanReadAutomationScript(context.Context, *automation.Script) bool

6
system/internal/service/automation_trigger.go
View File

@@ -26,8 +26,8 @@ type (
}
automationTriggerAccessController interface {
CanCreateAutomationScript(context.Context) bool
CanUpdateAutomationScript(context.Context, *automation.Script) bool
CanManageMailGatewayAutomation(context.Context) bool
}
)
@@ -95,8 +95,8 @@ func (svc automationTrigger) isValid(ctx context.Context, s *automation.Script,
}
if t.Resource == "system:mail" {
if !svc.ac.CanManageMailGatewayAutomation(ctx) {
return ErrNoMailGatewayManagementPermissions
if !svc.ac.CanCreateAutomationScript(ctx) {
return ErrNoScriptCreatePermissions
}
if t.IsDeferred() {

14
system/internal/service/error.go
View File

@@ -9,13 +9,13 @@ type (
)
const (
ErrInvalidID serviceError = "InvalidID"
ErrNoPermissions serviceError = "NoPermissions"
ErrNoGrantPermissions serviceError = "NoGrantPermissions"
ErrNoCreatePermissions serviceError = "NoCreatePermissions"
ErrNoReadPermissions serviceError = "NoReadPermissions"
ErrNoTriggerManagementPermissions serviceError = "NoTriggerManagementPermissions"
ErrNoMailGatewayManagementPermissions serviceError = "NoMailGatewayManagementPermissions"
ErrInvalidID serviceError = "InvalidID"
ErrNoPermissions serviceError = "NoPermissions"
ErrNoGrantPermissions serviceError = "NoGrantPermissions"
ErrNoCreatePermissions serviceError = "NoCreatePermissions"
ErrNoReadPermissions serviceError = "NoReadPermissions"
ErrNoTriggerManagementPermissions serviceError = "NoTriggerManagementPermissions"
ErrNoScriptCreatePermissions serviceError = "NoScriptCreatePermissions"
)
func (e serviceError) Error() string {