emissary/internal/server/api/authorization.go

252 lines
5.1 KiB
Go
Raw Normal View History

2024-02-27 09:56:15 +01:00
package api
2023-03-13 10:44:58 +01:00
import (
"context"
"fmt"
"net/http"
"forge.cadoles.com/Cadoles/emissary/internal/auth"
"forge.cadoles.com/Cadoles/emissary/internal/auth/agent"
"forge.cadoles.com/Cadoles/emissary/internal/auth/user"
2024-02-26 18:20:40 +01:00
"forge.cadoles.com/Cadoles/emissary/internal/datastore"
2023-03-13 10:44:58 +01:00
"github.com/pkg/errors"
"gitlab.com/wpetit/goweb/api"
"gitlab.com/wpetit/goweb/logger"
)
var ErrCodeForbidden api.ErrorCode = "forbidden"
func assertQueryAccess(h http.Handler) http.Handler {
return assertAuthz(
h,
assertOneOfRoles(user.RoleReader, user.RoleWriter, user.RoleAdmin),
nil,
)
}
func assertUserWithWriteAccess(h http.Handler) http.Handler {
return assertAuthz(
h,
assertOneOfRoles(user.RoleWriter, user.RoleAdmin),
nil,
)
}
func assertAgentOrUserWithWriteAccess(h http.Handler) http.Handler {
return assertAuthz(
h,
assertOneOfRoles(user.RoleWriter, user.RoleAdmin),
assertMatchingAgent(),
)
}
func assertAgentOrUserWithReadAccess(h http.Handler) http.Handler {
return assertAuthz(
h,
assertOneOfRoles(user.RoleReader, user.RoleWriter, user.RoleAdmin),
assertMatchingAgent(),
)
}
func assertAdminAccess(h http.Handler) http.Handler {
return assertAuthz(
h,
assertOneOfRoles(user.RoleAdmin),
nil,
)
}
func assertAdminOrTenantReadAccess(h http.Handler) http.Handler {
return assertAuthz(
h,
assertOneOfUser(
assertOneOfRoles(user.RoleAdmin),
assertAllOfUser(
assertOneOfRoles(user.RoleReader, user.RoleWriter),
2024-02-27 15:30:21 +01:00
assertSameTenant(),
),
),
nil,
)
}
func assertAdminOrTenantWriteAccess(h http.Handler) http.Handler {
return assertAuthz(
h,
assertOneOfUser(
assertOneOfRoles(user.RoleAdmin),
assertAllOfUser(
assertOneOfRoles(user.RoleWriter),
2024-02-27 15:30:21 +01:00
assertSameTenant(),
),
),
nil,
)
}
func assertAuthz(h http.Handler, assertUser assertUser, assertAgent assertAgent) http.Handler {
2023-03-13 10:44:58 +01:00
fn := func(w http.ResponseWriter, r *http.Request) {
reqUser, ok := assertRequestUser(w, r)
if !ok {
return
}
switch u := reqUser.(type) {
case *user.User:
if assertUser != nil {
if ok := assertUser(w, r, u); ok {
h.ServeHTTP(w, r)
2023-03-13 10:44:58 +01:00
return
}
2023-03-13 10:44:58 +01:00
}
case *agent.User:
if assertAgent != nil {
if ok := assertAgent(w, r, u); ok {
h.ServeHTTP(w, r)
2023-03-13 10:44:58 +01:00
return
}
}
2023-03-13 10:44:58 +01:00
default:
logUnexpectedUserType(r.Context(), reqUser)
}
forbidden(w, r)
}
return http.HandlerFunc(fn)
}
2023-03-13 10:44:58 +01:00
type assertUser func(w http.ResponseWriter, r *http.Request, u *user.User) bool
type assertAgent func(w http.ResponseWriter, r *http.Request, u *agent.User) bool
2023-03-13 10:44:58 +01:00
func assertAllOfUser(funcs ...assertUser) assertUser {
return func(w http.ResponseWriter, r *http.Request, u *user.User) bool {
for _, fn := range funcs {
if ok := fn(w, r, u); !ok {
return false
2023-03-13 10:44:58 +01:00
}
}
2023-03-13 10:44:58 +01:00
return true
}
}
2023-03-13 10:44:58 +01:00
func assertOneOfUser(funcs ...assertUser) assertUser {
return func(w http.ResponseWriter, r *http.Request, u *user.User) bool {
for _, fn := range funcs {
if ok := fn(w, r, u); ok {
return true
2023-03-13 10:44:58 +01:00
}
}
return false
2023-03-13 10:44:58 +01:00
}
}
2024-02-27 15:30:21 +01:00
func assertSameTenant() assertUser {
return func(w http.ResponseWriter, r *http.Request, u *user.User) bool {
tenantID, ok := getTenantID(w, r)
2023-03-13 10:44:58 +01:00
if !ok {
return false
2023-03-13 10:44:58 +01:00
}
if u.Tenant() == tenantID {
return true
2023-03-13 10:44:58 +01:00
}
return false
}
}
2023-03-13 10:44:58 +01:00
func assertOneOfRoles(roles ...user.Role) assertUser {
return func(w http.ResponseWriter, r *http.Request, u *user.User) bool {
role := u.Role()
for _, rr := range roles {
if rr == role {
return true
2023-03-13 10:44:58 +01:00
}
}
2023-03-13 10:44:58 +01:00
return false
}
}
2023-03-13 10:44:58 +01:00
func assertMatchingAgent() assertAgent {
return func(w http.ResponseWriter, r *http.Request, u *agent.User) bool {
agentID, ok := getAgentID(w, r)
if !ok {
return false
}
2023-03-13 10:44:58 +01:00
agent := u.Agent()
if agent != nil && agent.ID == agentID && agent.Status == datastore.AgentStatusAccepted {
return true
2023-03-13 10:44:58 +01:00
}
return false
2023-03-13 10:44:58 +01:00
}
}
func assertRequestUser(w http.ResponseWriter, r *http.Request) (auth.User, bool) {
ctx := r.Context()
user, err := auth.CtxUser(ctx)
if err != nil {
2023-10-13 12:30:52 +02:00
err = errors.WithStack(err)
2023-10-19 22:09:18 +02:00
logger.Error(ctx, "could not retrieve user", logger.CapturedE(err))
2023-03-13 10:44:58 +01:00
forbidden(w, r)
return nil, false
}
2024-02-26 18:20:40 +01:00
if user == nil || user.Tenant() == "" {
2023-03-13 10:44:58 +01:00
forbidden(w, r)
return nil, false
}
return user, true
}
2024-02-27 09:56:15 +01:00
func (m *Mount) assertTenantOwns(w http.ResponseWriter, r *http.Request, agentID datastore.AgentID) bool {
2024-02-26 18:20:40 +01:00
ctx := r.Context()
user, ok := assertRequestUser(w, r)
if !ok {
return false
}
2024-02-27 09:56:15 +01:00
agent, err := m.agentRepo.Get(ctx, agentID)
2024-02-26 18:20:40 +01:00
if err != nil {
err = errors.WithStack(err)
logger.Error(ctx, "could not get agent", logger.CapturedE(err))
api.ErrorResponse(w, http.StatusInternalServerError, ErrCodeUnknownError, nil)
}
if agent.TenantID != nil && *agent.TenantID == user.Tenant() {
return true
}
api.ErrorResponse(w, http.StatusForbidden, ErrCodeForbidden, nil)
return false
}
2023-03-13 10:44:58 +01:00
func forbidden(w http.ResponseWriter, r *http.Request) {
logger.Warn(r.Context(), "forbidden", logger.F("path", r.URL.Path))
api.ErrorResponse(w, http.StatusForbidden, ErrCodeForbidden, nil)
}
func logUnexpectedUserType(ctx context.Context, user auth.User) {
2023-10-13 12:30:52 +02:00
logger.Warn(
2023-03-13 10:44:58 +01:00
ctx, "unexpected user type",
logger.F("subject", user.Subject()),
logger.F("type", fmt.Sprintf("%T", user)),
)
}