diff --git a/compose/commands/exporter.go b/compose/commands/exporter.go index 55ec0597a..f4bafcbf6 100644 --- a/compose/commands/exporter.go +++ b/compose/commands/exporter.go @@ -24,6 +24,7 @@ import ( "github.com/cortezaproject/corteza-server/pkg/permissions" "github.com/cortezaproject/corteza-server/pkg/settings" intSettings "github.com/cortezaproject/corteza-server/pkg/settings" + sysExporter "github.com/cortezaproject/corteza-server/system/exporter" sysTypes "github.com/cortezaproject/corteza-server/system/types" ) @@ -131,8 +132,8 @@ func nsExporter(ctx context.Context, out *Compose, nsFlag string, args []string) // nsOut.Enabled = ns.Enabled // nsOut.Meta = ns.Meta // - // nsOut.Allow = expResourcePermissions(permissions.Allow, ns.PermissionResource()) - // nsOut.Deny = expResourcePermissions(permissions.Deny, ns.PermissionResource()) + // nsOut.Allow = sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Allow, ns.PermissionResource()) + // nsOut.Deny = sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Deny, ns.PermissionResource()) for _, arg := range args { switch arg { @@ -168,8 +169,8 @@ func permissionExporter(ctx context.Context, out *Compose) { &sysTypes.Role{ID: permissions.AdminsRoleID, Handle: "admins"}, } - out.Allow = expServicePermissions(permissions.Allow) - out.Deny = expServicePermissions(permissions.Deny) + out.Allow = sysExporter.ExportableServicePermissions(roles, service.DefaultPermissions, permissions.Allow) + out.Deny = sysExporter.ExportableServicePermissions(roles, service.DefaultPermissions, permissions.Deny) } // This is PoC for exporting compose resources @@ -304,8 +305,8 @@ func expModules(mm types.ModuleSet) (o map[string]Module) { Name: m.Name, Fields: expModuleFields(m.Fields, mm), - Allow: expResourcePermissions(permissions.Allow, types.ModulePermissionResource), - Deny: expResourcePermissions(permissions.Deny, types.ModulePermissionResource), + Allow: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Allow, types.ModulePermissionResource), + Deny: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Deny, types.ModulePermissionResource), } if meta := expModuleMetaCleanup(m.Meta); len(meta) > 0 { @@ -353,8 +354,8 @@ func expModuleFields(ff types.ModuleFieldSet, modules types.ModuleSet) (o yaml.M Visible: f.Visible, Multi: f.Multi, - Allow: expResourcePermissions(permissions.Allow, types.ModuleFieldPermissionResource), - Deny: expResourcePermissions(permissions.Deny, types.ModuleFieldPermissionResource), + Allow: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Allow, types.ModuleFieldPermissionResource), + Deny: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Deny, types.ModuleFieldPermissionResource), }, } } @@ -433,8 +434,8 @@ func expPages(parentID uint64, pages types.PageSet, modules types.ModuleSet, cha Pages: expPages(child.ID, pages, modules, charts, scripts), Visible: child.Visible, - Allow: expResourcePermissions(permissions.Allow, types.PagePermissionResource), - Deny: expResourcePermissions(permissions.Deny, types.PagePermissionResource), + Allow: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Allow, types.PagePermissionResource), + Deny: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Deny, types.PagePermissionResource), } if child.ModuleID > 0 { @@ -587,8 +588,8 @@ func expCharts(charts types.ChartSet, modules types.ModuleSet) (o map[string]Cha Name: c.Name, Config: ChartConfig{Reports: make([]map[string]interface{}, len(c.Config.Reports))}, - Allow: expResourcePermissions(permissions.Allow, types.ChartPermissionResource), - Deny: expResourcePermissions(permissions.Deny, types.ChartPermissionResource), + Allow: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Allow, types.ChartPermissionResource), + Deny: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Deny, types.ChartPermissionResource), } for i, r := range c.Config.Reports { @@ -639,8 +640,8 @@ func expAutomation(ss automation.ScriptSet, tt automation.TriggerSet, mm types.M Triggers: []map[string]interface{}{}, - Allow: expResourcePermissions(permissions.Allow, types.AutomationScriptPermissionResource), - Deny: expResourcePermissions(permissions.Deny, types.AutomationScriptPermissionResource), + Allow: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Allow, types.AutomationScriptPermissionResource), + Deny: sysExporter.ExportableResourcePermissions(roles, service.DefaultPermissions, permissions.Deny, types.AutomationScriptPermissionResource), } handle := makeHandleFromName(s.Name, "", "automation-script-%d", s.ID) @@ -692,77 +693,6 @@ func expAutomation(ss automation.ScriptSet, tt automation.TriggerSet, mm types.M return out } -func expServicePermissions(access permissions.Access) map[string]map[string][]string { - var ( - has bool - res string - rules permissions.RuleSet - sp = make(map[string]map[string][]string) - ) - - for _, r := range roles { - rules = service.DefaultPermissions.FindRulesByRoleID(r.ID) - - if len(rules) == 0 { - continue - } - - for _, rule := range rules { - if rule.Resource.GetService() != rule.Resource && !rule.Resource.HasWildcard() { - continue - } - - res = strings.TrimRight(rule.Resource.String(), ":*") - - if _, has = sp[r.Handle]; !has { - sp[r.Handle] = map[string][]string{} - } - - if _, has = sp[r.Handle][res]; !has { - sp[r.Handle][res] = make([]string, 0) - } - - sp[r.Handle][res] = append(sp[r.Handle][res], rule.Operation.String()) - } - } - - return sp -} - -func expResourcePermissions(access permissions.Access, resource permissions.Resource) map[string][]string { - var ( - has bool - rules permissions.RuleSet - sp = make(map[string][]string) - ) - - for _, r := range roles { - rules = service.DefaultPermissions.FindRulesByRoleID(r.ID) - - if len(rules) == 0 { - continue - } - - for _, rule := range rules { - if rule.Resource != resource { - continue - } - - if rule.Access != access { - continue - } - - if _, has = sp[r.Handle]; !has { - sp[r.Handle] = make([]string, 0) - } - - sp[r.Handle] = append(sp[r.Handle], rule.Operation.String()) - } - } - - return sp -} - func makeHandleFromName(name, currentHandle, def string, id uint64) string { if currentHandle != "" { return currentHandle diff --git a/messaging/commands/exporter.go b/messaging/commands/exporter.go index 6ed323b70..1896ddaa5 100644 --- a/messaging/commands/exporter.go +++ b/messaging/commands/exporter.go @@ -2,7 +2,6 @@ package commands import ( "context" - "strings" "github.com/pkg/errors" "github.com/spf13/cobra" @@ -13,6 +12,7 @@ import ( "github.com/cortezaproject/corteza-server/pkg/cli" "github.com/cortezaproject/corteza-server/pkg/permissions" "github.com/cortezaproject/corteza-server/pkg/settings" + sysExporter "github.com/cortezaproject/corteza-server/system/exporter" sysTypes "github.com/cortezaproject/corteza-server/system/types" ) @@ -60,13 +60,13 @@ func Exporter(ctx context.Context, c *cli.Config) *cobra.Command { } func permissionExporter(ctx context.Context, out *Messaging) { - roles = sysTypes.RoleSet{ + roles := sysTypes.RoleSet{ &sysTypes.Role{ID: permissions.EveryoneRoleID, Handle: "everyone"}, &sysTypes.Role{ID: permissions.AdminsRoleID, Handle: "admins"}, } - out.Allow = expServicePermissions(permissions.Allow) - out.Deny = expServicePermissions(permissions.Deny) + out.Allow = sysExporter.ExportableServicePermissions(roles, service.DefaultPermissions, permissions.Allow) + out.Deny = sysExporter.ExportableServicePermissions(roles, service.DefaultPermissions, permissions.Deny) } func settingExporter(ctx context.Context, out *Messaging) { @@ -91,45 +91,3 @@ type ( Deny map[string]map[string][]string `yaml:",omitempty"` } ) - -var ( - roles sysTypes.RoleSet -) - -// @todo move to pkg/permissions -func expServicePermissions(access permissions.Access) map[string]map[string][]string { - var ( - has bool - res string - rules permissions.RuleSet - sp = make(map[string]map[string][]string) - ) - - for _, r := range roles { - rules = service.DefaultPermissions.FindRulesByRoleID(r.ID) - - if len(rules) == 0 { - continue - } - - for _, rule := range rules { - if rule.Resource.GetService() != rule.Resource && !rule.Resource.HasWildcard() { - continue - } - - res = strings.TrimRight(rule.Resource.String(), ":*") - - if _, has = sp[r.Handle]; !has { - sp[r.Handle] = map[string][]string{} - } - - if _, has = sp[r.Handle][res]; !has { - sp[r.Handle][res] = make([]string, 0) - } - - sp[r.Handle][res] = append(sp[r.Handle][res], rule.Operation.String()) - } - } - - return sp -} diff --git a/system/commands/exporter.go b/system/commands/exporter.go index 7700f690f..ba7703136 100644 --- a/system/commands/exporter.go +++ b/system/commands/exporter.go @@ -2,7 +2,6 @@ package commands import ( "context" - "strings" "github.com/pkg/errors" "github.com/spf13/cobra" @@ -12,6 +11,7 @@ import ( "github.com/cortezaproject/corteza-server/pkg/cli" "github.com/cortezaproject/corteza-server/pkg/permissions" "github.com/cortezaproject/corteza-server/pkg/settings" + sysExporter "github.com/cortezaproject/corteza-server/system/exporter" "github.com/cortezaproject/corteza-server/system/service" sysTypes "github.com/cortezaproject/corteza-server/system/types" ) @@ -60,13 +60,13 @@ func Exporter(ctx context.Context, c *cli.Config) *cobra.Command { } func permissionExporter(ctx context.Context, out *System) { - roles = sysTypes.RoleSet{ + roles := sysTypes.RoleSet{ &sysTypes.Role{ID: permissions.EveryoneRoleID, Handle: "everyone"}, &sysTypes.Role{ID: permissions.AdminsRoleID, Handle: "admins"}, } - out.Allow = expServicePermissions(permissions.Allow) - out.Deny = expServicePermissions(permissions.Deny) + out.Allow = sysExporter.ExportableServicePermissions(roles, service.DefaultPermissions, permissions.Allow) + out.Deny = sysExporter.ExportableServicePermissions(roles, service.DefaultPermissions, permissions.Deny) } func settingExporter(ctx context.Context, out *System) { @@ -91,45 +91,3 @@ type ( Deny map[string]map[string][]string `yaml:",omitempty"` } ) - -var ( - roles sysTypes.RoleSet -) - -// @todo move to pkg/permissions -func expServicePermissions(access permissions.Access) map[string]map[string][]string { - var ( - has bool - res string - rules permissions.RuleSet - sp = make(map[string]map[string][]string) - ) - - for _, r := range roles { - rules = service.DefaultPermissions.FindRulesByRoleID(r.ID) - - if len(rules) == 0 { - continue - } - - for _, rule := range rules { - if rule.Resource.GetService() != rule.Resource && !rule.Resource.HasWildcard() { - continue - } - - res = strings.TrimRight(rule.Resource.String(), ":*") - - if _, has = sp[r.Handle]; !has { - sp[r.Handle] = map[string][]string{} - } - - if _, has = sp[r.Handle][res]; !has { - sp[r.Handle][res] = make([]string, 0) - } - - sp[r.Handle][res] = append(sp[r.Handle][res], rule.Operation.String()) - } - } - - return sp -} diff --git a/system/exporter/export.go b/system/exporter/export.go new file mode 100644 index 000000000..43b2703b9 --- /dev/null +++ b/system/exporter/export.go @@ -0,0 +1,89 @@ +package exporter + +import ( + "strings" + + "github.com/cortezaproject/corteza-server/pkg/permissions" + "github.com/cortezaproject/corteza-server/system/types" +) + +type ( + ruleFinder interface { + FindRulesByRoleID(uint64) permissions.RuleSet + } +) + +func ExportableServicePermissions(roles types.RoleSet, rf ruleFinder, access permissions.Access) map[string]map[string][]string { + var ( + has bool + res string + rules permissions.RuleSet + sp = make(map[string]map[string][]string) + ) + + for _, r := range roles { + rules = rf.FindRulesByRoleID(r.ID) + + if len(rules) == 0 { + continue + } + + for _, rule := range rules { + if rule.Resource.GetService() != rule.Resource && !rule.Resource.HasWildcard() { + continue + } + + if rule.Access != access { + continue + } + + res = strings.TrimRight(rule.Resource.String(), ":*") + + if _, has = sp[r.Handle]; !has { + sp[r.Handle] = map[string][]string{} + } + + if _, has = sp[r.Handle][res]; !has { + sp[r.Handle][res] = make([]string, 0) + } + + sp[r.Handle][res] = append(sp[r.Handle][res], rule.Operation.String()) + } + } + + return sp +} + +func ExportableResourcePermissions(roles types.RoleSet, rf ruleFinder, access permissions.Access, resource permissions.Resource) map[string][]string { + var ( + has bool + rules permissions.RuleSet + sp = make(map[string][]string) + ) + + for _, r := range roles { + rules = rf.FindRulesByRoleID(r.ID) + + if len(rules) == 0 { + continue + } + + for _, rule := range rules { + if rule.Resource != resource { + continue + } + + if rule.Access != access { + continue + } + + if _, has = sp[r.Handle]; !has { + sp[r.Handle] = make([]string, 0) + } + + sp[r.Handle] = append(sp[r.Handle], rule.Operation.String()) + } + } + + return sp +}