From de53206c277f0cc716a470a4191c1661ec3f5a14 Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Mon, 11 Mar 2019 14:12:27 +0100 Subject: [PATCH] Fix handling wildcarded lookups on global resources --- internal/rules/resources.go | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/internal/rules/resources.go b/internal/rules/resources.go index d3c081f1a..155700f31 100644 --- a/internal/rules/resources.go +++ b/internal/rules/resources.go @@ -50,17 +50,25 @@ func (r *resources) Check(resource string, operation string, fallbacks ...CheckA return Deny } - // Create resource definition for global level. - parts[len(parts)-1] = "*" - globalResource := strings.Join(parts, delimiter) - - // Access checks. + // Resource-specific check checks := []CheckAccessFunc{ func() Access { return r.checkAccess(resource, operation) }, func() Access { return r.checkAccessEveryone(resource, operation) }, - func() Access { return r.checkAccess(globalResource, operation) }, - func() Access { return r.checkAccessEveryone(globalResource, operation) }, } + + if len(parts) > 1 { + // If this is a non-service resource (so, not system, messaging), + // add checks for any-resouce (ending with `*`) + parts[len(parts)-1] = "*" + anyResource := strings.Join(parts, delimiter) + + checks = append( + checks, + func() Access { return r.checkAccess(anyResource, operation) }, + func() Access { return r.checkAccessEveryone(anyResource, operation) }, + ) + } + checks = append(checks, fallbacks...) for _, check := range checks {