From e4953c83f840518cebfaf8d1a4d77344f96a9ead Mon Sep 17 00:00:00 2001
From: Peter Grlica <peter.grlica@gmail.com>
Date: Mon, 16 Aug 2021 15:48:46 +0200
Subject: [PATCH] Rbac fallback for messagebus queues for now

---
 system/service/access_control.gen.go |  8 ++++-
 system/service/access_control.go     | 53 ++++++++++++++++++++++++++++
 2 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/system/service/access_control.gen.go b/system/service/access_control.gen.go
index ebba02a51..eb6364b89 100644
--- a/system/service/access_control.gen.go
+++ b/system/service/access_control.gen.go
@@ -20,11 +20,13 @@ package service
 import (
 	"context"
 	"fmt"
+	"strings"
+
 	"github.com/cortezaproject/corteza-server/pkg/actionlog"
+	"github.com/cortezaproject/corteza-server/pkg/messagebus"
 	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/system/types"
 	"github.com/spf13/cast"
-	"strings"
 )
 
 type (
@@ -845,6 +847,10 @@ func rbacResourceValidator(r string, oo ...string) error {
 		return rbacUserResourceValidator(r, oo...)
 	case types.ComponentResourceType:
 		return rbacComponentResourceValidator(r, oo...)
+	// added as an exception, will be fixed in the next
+	// queues refactoring
+	case messagebus.QueueResourceType:
+		return rbacQueueResourceValidator(r, oo...)
 	}
 
 	return fmt.Errorf("unknown resource type '%q'", r)
diff --git a/system/service/access_control.go b/system/service/access_control.go
index 7560a6c64..677043531 100644
--- a/system/service/access_control.go
+++ b/system/service/access_control.go
@@ -2,8 +2,11 @@ package service
 
 import (
 	"context"
+	"fmt"
+	"strings"
 
 	"github.com/cortezaproject/corteza-server/pkg/messagebus"
+	"github.com/spf13/cast"
 )
 
 // Addition to list of defined resouces
@@ -52,3 +55,53 @@ func (svc accessControl) CanReadMessageOnQueue(ctx context.Context, r *messagebu
 func (svc accessControl) CanWriteMessageOnQueue(ctx context.Context, r *messagebus.QueueSettings) bool {
 	return svc.can(ctx, "queue.write", r)
 }
+
+func rbacQueueResourceValidator(r string, oo ...string) error {
+	defOps := rbacResourceOperationsQueue(r)
+
+	for _, o := range oo {
+		if !defOps[o] {
+			return fmt.Errorf("invalid operation '%s' for system Queue resource", o)
+		}
+	}
+
+	if !strings.HasPrefix(r, messagebus.QueueResourceType) {
+		// expecting resource to always include path
+		return fmt.Errorf("invalid resource type")
+	}
+
+	const sep = "/"
+	var (
+		pp  = strings.Split(strings.Trim(r[len(messagebus.QueueResourceType):], sep), sep)
+		prc = []string{
+			"ID",
+		}
+	)
+
+	if len(pp) != len(prc) {
+		return fmt.Errorf("invalid resource path structure")
+	}
+
+	for i := 0; i < len(pp); i++ {
+		if pp[i] != "*" {
+			if i > 0 && pp[i-1] == "*" {
+				return fmt.Errorf("invalid resource path wildcard level (%d) for Queue", i)
+			}
+
+			if _, err := cast.ToUint64E(pp[i]); err != nil {
+				return fmt.Errorf("invalid reference for %s: '%s'", prc[i], pp[i])
+			}
+		}
+	}
+	return nil
+}
+
+func rbacResourceOperationsQueue(r string) map[string]bool {
+	return map[string]bool{
+		"read":        true,
+		"update":      true,
+		"delete":      true,
+		"queue.read":  true,
+		"queue.write": true,
+	}
+}