2019-07-29 07:13:33 +02:00
|
|
|
package serv
|
|
|
|
|
|
|
|
import (
|
|
|
|
"bytes"
|
2019-09-26 06:35:31 +02:00
|
|
|
"context"
|
2019-07-29 07:13:33 +02:00
|
|
|
"fmt"
|
|
|
|
"io"
|
|
|
|
|
2020-02-01 16:54:19 +01:00
|
|
|
"github.com/dosco/super-graph/allow"
|
2020-03-06 11:08:54 +01:00
|
|
|
"github.com/dosco/super-graph/psql"
|
2019-07-29 07:13:33 +02:00
|
|
|
"github.com/dosco/super-graph/qcode"
|
2019-09-26 06:35:31 +02:00
|
|
|
"github.com/jackc/pgconn"
|
2019-11-21 08:14:12 +01:00
|
|
|
"github.com/jackc/pgx/v4"
|
2019-07-29 07:13:33 +02:00
|
|
|
"github.com/valyala/fasttemplate"
|
|
|
|
)
|
|
|
|
|
|
|
|
type preparedItem struct {
|
2019-12-10 06:03:44 +01:00
|
|
|
sd *pgconn.StatementDescription
|
|
|
|
args [][]byte
|
|
|
|
st stmt
|
|
|
|
roleArg bool
|
2019-07-29 07:13:33 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
var (
|
|
|
|
_preparedList map[string]*preparedItem
|
|
|
|
)
|
|
|
|
|
2020-02-01 16:54:19 +01:00
|
|
|
func initPreparedList(cpath string) {
|
|
|
|
if allowList.IsPersist() {
|
|
|
|
return
|
|
|
|
}
|
2019-11-25 08:22:33 +01:00
|
|
|
_preparedList = make(map[string]*preparedItem)
|
2019-11-21 08:14:12 +01:00
|
|
|
|
2019-12-02 16:52:22 +01:00
|
|
|
tx, err := db.Begin(context.Background())
|
2019-11-21 08:14:12 +01:00
|
|
|
if err != nil {
|
2019-11-25 08:22:33 +01:00
|
|
|
errlog.Fatal().Err(err).Send()
|
2019-11-21 08:14:12 +01:00
|
|
|
}
|
2019-12-02 16:52:22 +01:00
|
|
|
defer tx.Rollback(context.Background()) //nolint: errcheck
|
2019-11-21 08:14:12 +01:00
|
|
|
|
2019-12-02 16:52:22 +01:00
|
|
|
err = prepareRoleStmt(tx)
|
2019-11-25 08:22:33 +01:00
|
|
|
if err != nil {
|
|
|
|
errlog.Fatal().Err(err).Msg("failed to prepare get role statement")
|
|
|
|
}
|
2019-07-29 07:13:33 +02:00
|
|
|
|
2019-12-02 16:52:22 +01:00
|
|
|
if err := tx.Commit(context.Background()); err != nil {
|
2019-11-25 08:22:33 +01:00
|
|
|
errlog.Fatal().Err(err).Send()
|
2019-10-24 08:07:42 +02:00
|
|
|
}
|
|
|
|
|
2019-11-25 08:22:33 +01:00
|
|
|
success := 0
|
|
|
|
|
2020-02-01 16:54:19 +01:00
|
|
|
list, err := allowList.Load()
|
|
|
|
if err != nil {
|
|
|
|
errlog.Fatal().Err(err).Send()
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, v := range list {
|
|
|
|
if len(v.Query) == 0 {
|
2019-11-25 08:22:33 +01:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
2020-02-01 16:54:19 +01:00
|
|
|
err := prepareStmt(v)
|
2019-11-25 08:22:33 +01:00
|
|
|
if err == nil {
|
|
|
|
success++
|
|
|
|
continue
|
2019-07-29 07:13:33 +02:00
|
|
|
}
|
2019-11-21 08:14:12 +01:00
|
|
|
|
2020-02-01 16:54:19 +01:00
|
|
|
if len(v.Vars) == 0 {
|
|
|
|
logger.Warn().Err(err).Msg(v.Query)
|
2019-11-25 08:22:33 +01:00
|
|
|
} else {
|
2020-02-01 16:54:19 +01:00
|
|
|
logger.Warn().Err(err).Msgf("%s %s", v.Vars, v.Query)
|
2019-11-25 08:22:33 +01:00
|
|
|
}
|
2019-11-21 08:14:12 +01:00
|
|
|
}
|
|
|
|
|
2019-11-25 08:22:33 +01:00
|
|
|
logger.Info().
|
|
|
|
Msgf("Registered %d of %d queries from allow.list as prepared statements",
|
2020-02-01 16:54:19 +01:00
|
|
|
success, len(list))
|
2019-07-29 07:13:33 +02:00
|
|
|
}
|
|
|
|
|
2020-02-01 16:54:19 +01:00
|
|
|
func prepareStmt(item allow.Item) error {
|
|
|
|
gql := item.Query
|
|
|
|
vars := item.Vars
|
|
|
|
|
2019-11-25 08:22:33 +01:00
|
|
|
qt := qcode.GetQType(gql)
|
|
|
|
q := []byte(gql)
|
2019-10-24 08:07:42 +02:00
|
|
|
|
2019-12-02 16:52:22 +01:00
|
|
|
tx, err := db.Begin(context.Background())
|
2019-07-29 07:13:33 +02:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2019-12-02 16:52:22 +01:00
|
|
|
defer tx.Rollback(context.Background()) //nolint: errcheck
|
2019-07-29 07:13:33 +02:00
|
|
|
|
2019-11-25 08:22:33 +01:00
|
|
|
switch qt {
|
|
|
|
case qcode.QTQuery:
|
2019-12-09 07:48:18 +01:00
|
|
|
var stmts1 []stmt
|
|
|
|
var err error
|
|
|
|
|
2019-12-10 06:03:44 +01:00
|
|
|
if conf.isABACEnabled() {
|
2019-12-09 07:48:18 +01:00
|
|
|
stmts1, err = buildMultiStmt(q, vars)
|
|
|
|
} else {
|
|
|
|
stmts1, err = buildRoleStmt(q, vars, "user")
|
2019-10-24 08:07:42 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2019-07-29 07:13:33 +02:00
|
|
|
|
2020-03-31 07:28:39 +02:00
|
|
|
logger.Debug().Msgf("Prepared statement 'query %s' (user)", item.Name)
|
2019-12-25 07:24:30 +01:00
|
|
|
|
2020-02-01 16:54:19 +01:00
|
|
|
err = prepare(tx, stmts1, stmtHash(item.Name, "user"))
|
2019-11-25 08:22:33 +01:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2019-10-24 08:07:42 +02:00
|
|
|
|
2019-12-09 07:48:18 +01:00
|
|
|
if conf.isAnonRoleDefined() {
|
2020-03-31 07:28:39 +02:00
|
|
|
logger.Debug().Msgf("Prepared statement 'query %s' (anon)", item.Name)
|
2019-12-25 07:24:30 +01:00
|
|
|
|
2019-12-09 07:48:18 +01:00
|
|
|
stmts2, err := buildRoleStmt(q, vars, "anon")
|
2020-03-06 11:08:54 +01:00
|
|
|
if err == psql.ErrAllTablesSkipped {
|
|
|
|
return nil
|
|
|
|
}
|
2019-12-09 07:48:18 +01:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2020-02-01 16:54:19 +01:00
|
|
|
err = prepare(tx, stmts2, stmtHash(item.Name, "anon"))
|
2019-12-09 07:48:18 +01:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2019-10-24 08:07:42 +02:00
|
|
|
}
|
|
|
|
|
2019-11-25 08:22:33 +01:00
|
|
|
case qcode.QTMutation:
|
|
|
|
for _, role := range conf.Roles {
|
2020-03-31 07:28:39 +02:00
|
|
|
logger.Debug().Msgf("Prepared statement 'mutation %s' (%s)", item.Name, role.Name)
|
2019-12-25 07:24:30 +01:00
|
|
|
|
2019-11-25 08:22:33 +01:00
|
|
|
stmts, err := buildRoleStmt(q, vars, role.Name)
|
2020-03-31 07:28:39 +02:00
|
|
|
|
2019-11-25 08:22:33 +01:00
|
|
|
if err != nil {
|
2020-03-31 07:28:39 +02:00
|
|
|
if len(item.Vars) == 0 {
|
|
|
|
logger.Warn().Err(err).Msg(item.Query)
|
|
|
|
} else {
|
|
|
|
logger.Warn().Err(err).Msgf("%s %s", item.Vars, item.Query)
|
|
|
|
}
|
|
|
|
continue
|
2019-11-25 08:22:33 +01:00
|
|
|
}
|
|
|
|
|
2020-02-01 16:54:19 +01:00
|
|
|
err = prepare(tx, stmts, stmtHash(item.Name, role.Name))
|
2019-11-25 08:22:33 +01:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2019-10-24 08:07:42 +02:00
|
|
|
}
|
2019-11-25 08:22:33 +01:00
|
|
|
}
|
2019-10-24 08:07:42 +02:00
|
|
|
|
2019-12-02 16:52:22 +01:00
|
|
|
if err := tx.Commit(context.Background()); err != nil {
|
2019-11-25 08:22:33 +01:00
|
|
|
return err
|
2019-07-29 07:13:33 +02:00
|
|
|
}
|
|
|
|
|
2019-10-24 08:07:42 +02:00
|
|
|
return nil
|
|
|
|
}
|
2019-07-29 07:13:33 +02:00
|
|
|
|
2019-12-10 06:03:44 +01:00
|
|
|
func prepare(tx pgx.Tx, st []stmt, key string) error {
|
|
|
|
finalSQL, am := processTemplate(st[0].sql)
|
2019-11-25 08:22:33 +01:00
|
|
|
|
2019-12-02 16:52:22 +01:00
|
|
|
sd, err := tx.Prepare(context.Background(), "", finalSQL)
|
2019-11-25 08:22:33 +01:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
_preparedList[key] = &preparedItem{
|
2019-12-10 06:03:44 +01:00
|
|
|
sd: sd,
|
|
|
|
args: am,
|
|
|
|
st: st[0],
|
|
|
|
roleArg: len(st) > 1,
|
2019-11-25 08:22:33 +01:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-11-28 07:25:46 +01:00
|
|
|
// nolint: errcheck
|
2019-12-02 16:52:22 +01:00
|
|
|
func prepareRoleStmt(tx pgx.Tx) error {
|
2019-12-10 06:03:44 +01:00
|
|
|
if !conf.isABACEnabled() {
|
2019-10-24 08:07:42 +02:00
|
|
|
return nil
|
|
|
|
}
|
2019-07-29 07:13:33 +02:00
|
|
|
|
2019-10-24 08:07:42 +02:00
|
|
|
w := &bytes.Buffer{}
|
|
|
|
|
2019-12-25 07:24:30 +01:00
|
|
|
io.WriteString(w, `SELECT (CASE WHEN EXISTS (`)
|
|
|
|
io.WriteString(w, conf.RolesQuery)
|
|
|
|
io.WriteString(w, `) THEN `)
|
|
|
|
|
|
|
|
io.WriteString(w, `(SELECT (CASE`)
|
2019-10-24 08:07:42 +02:00
|
|
|
for _, role := range conf.Roles {
|
|
|
|
if len(role.Match) == 0 {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
io.WriteString(w, ` WHEN `)
|
|
|
|
io.WriteString(w, role.Match)
|
|
|
|
io.WriteString(w, ` THEN '`)
|
|
|
|
io.WriteString(w, role.Name)
|
|
|
|
io.WriteString(w, `'`)
|
2019-07-29 07:13:33 +02:00
|
|
|
}
|
|
|
|
|
2019-10-24 08:07:42 +02:00
|
|
|
io.WriteString(w, ` ELSE {{role}} END) FROM (`)
|
|
|
|
io.WriteString(w, conf.RolesQuery)
|
2019-12-25 07:24:30 +01:00
|
|
|
io.WriteString(w, `) AS "_sg_auth_roles_query" LIMIT 1) `)
|
|
|
|
io.WriteString(w, `ELSE 'anon' END) FROM (VALUES (1)) AS "_sg_auth_filler" LIMIT 1; `)
|
2019-10-24 08:07:42 +02:00
|
|
|
|
|
|
|
roleSQL, _ := processTemplate(w.String())
|
|
|
|
|
2019-12-02 16:52:22 +01:00
|
|
|
_, err := tx.Prepare(context.Background(), "_sg_get_role", roleSQL)
|
2019-07-29 07:13:33 +02:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2019-10-24 08:07:42 +02:00
|
|
|
return nil
|
|
|
|
}
|
2019-07-29 07:13:33 +02:00
|
|
|
|
2019-10-24 08:07:42 +02:00
|
|
|
func processTemplate(tmpl string) (string, [][]byte) {
|
2019-11-21 08:14:12 +01:00
|
|
|
st := struct {
|
|
|
|
vmap map[string]int
|
|
|
|
am [][]byte
|
|
|
|
i int
|
|
|
|
}{
|
|
|
|
vmap: make(map[string]int),
|
|
|
|
am: make([][]byte, 0, 5),
|
|
|
|
i: 0,
|
|
|
|
}
|
2019-10-24 08:07:42 +02:00
|
|
|
|
2019-11-21 08:14:12 +01:00
|
|
|
execFunc := func(w io.Writer, tag string) (int, error) {
|
|
|
|
if n, ok := st.vmap[tag]; ok {
|
2019-10-24 08:07:42 +02:00
|
|
|
return w.Write([]byte(fmt.Sprintf("$%d", n)))
|
|
|
|
}
|
2019-11-21 08:14:12 +01:00
|
|
|
st.am = append(st.am, []byte(tag))
|
|
|
|
st.i++
|
|
|
|
st.vmap[tag] = st.i
|
|
|
|
return w.Write([]byte(fmt.Sprintf("$%d", st.i)))
|
|
|
|
}
|
|
|
|
|
|
|
|
t1 := fasttemplate.New(tmpl, `'{{`, `}}'`)
|
|
|
|
ts1 := t1.ExecuteFuncString(execFunc)
|
|
|
|
|
|
|
|
t2 := fasttemplate.New(ts1, `{{`, `}}`)
|
|
|
|
ts2 := t2.ExecuteFuncString(execFunc)
|
|
|
|
|
|
|
|
return ts2, st.am
|
2019-07-29 07:13:33 +02:00
|
|
|
}
|