DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Remove (repository-layer) resource filtering

Browse Source
This commit is contained in:
Denis Arh
2020-09-06 16:41:17 +02:00
parent f64bf4673e
commit d14b26923e
14 changed files with 0 additions and 310 deletions
Download Patch File Download Diff File Expand all files Collapse all files
compose/service/access_control.go
-35
View File
@@ -18,7 +18,6 @@ type (
Can([]uint64, permissions.Resource, permissions.Operation, ...permissions.CheckAccessFunc) bool
Grant(context.Context, permissions.Whitelist, ...*permissions.Rule) error
FindRulesByRoleID(roleID uint64) (rr permissions.RuleSet)
ResourceFilter([]uint64, permissions.Resource, permissions.Operation, permissions.Access) *permissions.ResourceFilter
}
secureResource interface {
@@ -71,10 +70,6 @@ func (svc accessControl) CanReadNamespace(ctx context.Context, r *types.Namespac
return svc.can(ctx, r, "read", permissions.Allowed)
}
func (svc accessControl) FilterReadableNamespaces(ctx context.Context) *permissions.ResourceFilter {
return svc.filter(ctx, types.NamespacePermissionResource, "read", permissions.Deny)
}
func (svc accessControl) CanUpdateNamespace(ctx context.Context, r *types.Namespace) bool {
return svc.can(ctx, r, "update")
}
@@ -95,10 +90,6 @@ func (svc accessControl) CanReadModule(ctx context.Context, r *types.Module) boo
return svc.can(ctx, r, "read")
}
func (svc accessControl) FilterReadableModules(ctx context.Context) *permissions.ResourceFilter {
return svc.filter(ctx, types.ModulePermissionResource, "read", permissions.Deny)
}
func (svc accessControl) CanUpdateModule(ctx context.Context, r *types.Module) bool {
return svc.can(ctx, r, "update")
}
@@ -143,10 +134,6 @@ func (svc accessControl) CanReadChart(ctx context.Context, r *types.Chart) bool
return svc.can(ctx, r, "read")
}
func (svc accessControl) FilterReadableCharts(ctx context.Context) *permissions.ResourceFilter {
return svc.filter(ctx, types.ChartPermissionResource, "read", permissions.Deny)
}
func (svc accessControl) CanUpdateChart(ctx context.Context, r *types.Chart) bool {
return svc.can(ctx, r, "update")
}
@@ -163,10 +150,6 @@ func (svc accessControl) CanReadPage(ctx context.Context, r *types.Page) bool {
return svc.can(ctx, r, "read")
}
func (svc accessControl) FilterReadablePages(ctx context.Context) *permissions.ResourceFilter {
return svc.filter(ctx, types.PagePermissionResource, "read", permissions.Deny)
}
func (svc accessControl) CanUpdatePage(ctx context.Context, r *types.Page) bool {
return svc.can(ctx, r, "update")
}
@@ -193,24 +176,6 @@ func (svc accessControl) can(ctx context.Context, res secureResource, op permiss
)
}
func (svc accessControl) filter(ctx context.Context, res permissions.Resource, op permissions.Operation, a permissions.Access) *permissions.ResourceFilter {
var u = auth.GetIdentityFromContext(ctx)
if auth.IsSuperUser(u) {
// Temp solution to allow migration from passing context to ResourceFilter
//and checking "superuser" privileges there
// to more sustainable solution (eg: creating super-role with allow-all)
return permissions.NewSuperuserFilter()
}
return svc.permissions.ResourceFilter(
append(u.Roles(), res.DynamicRoles(u.Identity())...),
res,
op,
a,
)
}
func (svc accessControl) Grant(ctx context.Context, rr ...*permissions.Rule) error {
if !svc.CanGrant(ctx) {
return AccessControlErrNotAllowedToSetPermissions()
compose/service/chart.go
-3
View File
@@ -7,7 +7,6 @@ import (
"github.com/cortezaproject/corteza-server/pkg/actionlog"
"github.com/cortezaproject/corteza-server/pkg/handle"
"github.com/cortezaproject/corteza-server/pkg/id"
"github.com/cortezaproject/corteza-server/pkg/permissions"
"github.com/cortezaproject/corteza-server/store"
)
@@ -25,8 +24,6 @@ type (
CanReadChart(context.Context, *types.Chart) bool
CanUpdateChart(context.Context, *types.Chart) bool
CanDeleteChart(context.Context, *types.Chart) bool
FilterReadableCharts(ctx context.Context) *permissions.ResourceFilter
}
ChartService interface {
compose/service/module.go
-3
View File
@@ -10,7 +10,6 @@ import (
"github.com/cortezaproject/corteza-server/pkg/eventbus"
"github.com/cortezaproject/corteza-server/pkg/handle"
"github.com/cortezaproject/corteza-server/pkg/id"
"github.com/cortezaproject/corteza-server/pkg/permissions"
"github.com/cortezaproject/corteza-server/store"
"sort"
"strconv"
@@ -31,8 +30,6 @@ type (
CanReadModule(context.Context, *types.Module) bool
CanUpdateModule(context.Context, *types.Module) bool
CanDeleteModule(context.Context, *types.Module) bool
FilterReadableModules(ctx context.Context) *permissions.ResourceFilter
}
ModuleService interface {
compose/service/namespace.go
-2
View File
@@ -29,8 +29,6 @@ type (
CanDeleteNamespace(context.Context, *types.Namespace) bool
Grant(ctx context.Context, rr ...*permissions.Rule) error
FilterReadableNamespaces(ctx context.Context) *permissions.ResourceFilter
}
NamespaceService interface {
compose/service/page.go
-3
View File
@@ -8,7 +8,6 @@ import (
"github.com/cortezaproject/corteza-server/pkg/actionlog"
"github.com/cortezaproject/corteza-server/pkg/eventbus"
"github.com/cortezaproject/corteza-server/pkg/handle"
"github.com/cortezaproject/corteza-server/pkg/permissions"
"github.com/cortezaproject/corteza-server/store"
)
@@ -27,8 +26,6 @@ type (
CanReadPage(context.Context, *types.Page) bool
CanUpdatePage(context.Context, *types.Page) bool
CanDeletePage(context.Context, *types.Page) bool
FilterReadablePages(ctx context.Context) *permissions.ResourceFilter
}
PageService interface {