-
Notifications
You must be signed in to change notification settings - Fork 113
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Use permissions API in decomposedfs (#2341)
- Loading branch information
David Christofas
authored
Jan 24, 2022
1 parent
cf04a9f
commit 393f831
Showing
34 changed files
with
389 additions
and
35 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| Enhancement: Use CS3 permissions API | ||
|
|
||
| Added calls to the CS3 permissions API to the decomposedfs in order to check the user permissions. | ||
|
|
||
| https://github.com/cs3org/reva/pull/2341 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| // Copyright 2021 CERN | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
| // In applying this license, CERN does not waive the privileges and immunities | ||
| // granted to it by virtue of its status as an Intergovernmental Organization | ||
| // or submit itself to any jurisdiction. | ||
|
|
||
| package gateway | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| permissions "github.com/cs3org/go-cs3apis/cs3/permissions/v1beta1" | ||
| "github.com/cs3org/reva/pkg/rgrpc/status" | ||
| "github.com/cs3org/reva/pkg/rgrpc/todo/pool" | ||
| "github.com/pkg/errors" | ||
| ) | ||
|
|
||
| func (s *svc) CheckPermission(ctx context.Context, req *permissions.CheckPermissionRequest) (*permissions.CheckPermissionResponse, error) { | ||
| c, err := pool.GetPermissionsClient(s.c.PermissionsEndpoint) | ||
| if err != nil { | ||
| err = errors.Wrap(err, "gateway: error calling GetPermissionssClient") | ||
| return &permissions.CheckPermissionResponse{ | ||
| Status: status.NewInternal(ctx, err, "error getting permissions client"), | ||
| }, nil | ||
| } | ||
| return c.CheckPermission(ctx, req) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,104 @@ | ||
| // Copyright 2021 CERN | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
| // In applying this license, CERN does not waive the privileges and immunities | ||
| // granted to it by virtue of its status as an Intergovernmental Organization | ||
| // or submit itself to any jurisdiction. | ||
|
|
||
| package permissions | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
|
|
||
| permissions "github.com/cs3org/go-cs3apis/cs3/permissions/v1beta1" | ||
| rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1" | ||
| "github.com/cs3org/reva/pkg/permission" | ||
| "github.com/cs3org/reva/pkg/permission/manager/registry" | ||
| "github.com/cs3org/reva/pkg/rgrpc" | ||
| "github.com/mitchellh/mapstructure" | ||
| "github.com/pkg/errors" | ||
| "google.golang.org/grpc" | ||
| ) | ||
|
|
||
| func init() { | ||
| rgrpc.Register("permissions", New) | ||
| } | ||
|
|
||
| type config struct { | ||
| Driver string `mapstructure:"driver" docs:"localhome;The permission driver to be used."` | ||
| Drivers map[string]map[string]interface{} `mapstructure:"drivers" docs:"url:pkg/permission/permission.go"` | ||
| } | ||
|
|
||
| func parseConfig(m map[string]interface{}) (*config, error) { | ||
| c := &config{} | ||
| if err := mapstructure.Decode(m, c); err != nil { | ||
| err = errors.Wrap(err, "error decoding conf") | ||
| return nil, err | ||
| } | ||
| return c, nil | ||
| } | ||
|
|
||
| type service struct { | ||
| manager permission.Manager | ||
| } | ||
|
|
||
| // New returns a new PermissionsServiceServer | ||
| func New(m map[string]interface{}, ss *grpc.Server) (rgrpc.Service, error) { | ||
| c, err := parseConfig(m) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| f, ok := registry.NewFuncs[c.Driver] | ||
| if !ok { | ||
| return nil, fmt.Errorf("could not get permission manager '%s'", c.Driver) | ||
| } | ||
| manager, err := f(c.Drivers[c.Driver]) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| service := &service{manager: manager} | ||
| return service, nil | ||
| } | ||
|
|
||
| func (s *service) Close() error { | ||
| return nil | ||
| } | ||
|
|
||
| func (s *service) UnprotectedEndpoints() []string { | ||
| return []string{} | ||
| } | ||
|
|
||
| func (s *service) Register(ss *grpc.Server) { | ||
| permissions.RegisterPermissionsAPIServer(ss, s) | ||
| } | ||
|
|
||
| func (s *service) CheckPermission(ctx context.Context, req *permissions.CheckPermissionRequest) (*permissions.CheckPermissionResponse, error) { | ||
| var subject string | ||
| switch ref := req.SubjectRef.Spec.(type) { | ||
| case *permissions.SubjectReference_UserId: | ||
| subject = ref.UserId.OpaqueId | ||
| case *permissions.SubjectReference_GroupId: | ||
| subject = ref.GroupId.OpaqueId | ||
| } | ||
| var status *rpc.Status | ||
| if ok := s.manager.CheckPermission(req.Permission, subject, req.Ref); ok { | ||
| status = &rpc.Status{Code: rpc.Code_CODE_OK} | ||
| } else { | ||
| status = &rpc.Status{Code: rpc.Code_CODE_PERMISSION_DENIED} | ||
| } | ||
| return &permissions.CheckPermissionResponse{Status: status}, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| // Copyright 2021 CERN | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
| // In applying this license, CERN does not waive the privileges and immunities | ||
| // granted to it by virtue of its status as an Intergovernmental Organization | ||
| // or submit itself to any jurisdiction. | ||
|
|
||
| package demo | ||
|
|
||
| import ( | ||
| provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1" | ||
| "github.com/cs3org/reva/pkg/permission" | ||
| "github.com/cs3org/reva/pkg/permission/manager/registry" | ||
| ) | ||
|
|
||
| func init() { | ||
| registry.Register("demo", New) | ||
| } | ||
|
|
||
| // New returns a new demo permission manager | ||
| func New(c map[string]interface{}) (permission.Manager, error) { | ||
| return manager{}, nil | ||
| } | ||
|
|
||
| type manager struct { | ||
| } | ||
|
|
||
| func (m manager) CheckPermission(permission string, subject string, ref *provider.Reference) bool { | ||
| // We can currently return true all the time. | ||
| // Once we beginn testing roles we need to somehow check the roles of the users here | ||
| return true | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| // Copyright 2021 CERN | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
| // In applying this license, CERN does not waive the privileges and immunities | ||
| // granted to it by virtue of its status as an Intergovernmental Organization | ||
| // or submit itself to any jurisdiction. | ||
|
|
||
| package loader | ||
|
|
||
| import ( | ||
| // Load permission manager drivers | ||
| _ "github.com/cs3org/reva/pkg/permission/manager/demo" | ||
| // Add your own here | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| // Copyright 2021 CERN | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
| // In applying this license, CERN does not waive the privileges and immunities | ||
| // granted to it by virtue of its status as an Intergovernmental Organization | ||
| // or submit itself to any jurisdiction. | ||
|
|
||
| package registry | ||
|
|
||
| import "github.com/cs3org/reva/pkg/permission" | ||
|
|
||
| // NewFunc is the function that permission managers | ||
| // should register at init time. | ||
| type NewFunc func(map[string]interface{}) (permission.Manager, error) | ||
|
|
||
| // NewFuncs is a map containing all the registered share managers. | ||
| var NewFuncs = map[string]NewFunc{} | ||
|
|
||
| // Register registers a new permission manager new function. | ||
| // Not safe for concurrent use. Safe for use from package init. | ||
| func Register(name string, f NewFunc) { | ||
| NewFuncs[name] = f | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| // Copyright 2021 CERN | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
| // In applying this license, CERN does not waive the privileges and immunities | ||
| // granted to it by virtue of its status as an Intergovernmental Organization | ||
| // or submit itself to any jurisdiction. | ||
|
|
||
| package permission | ||
|
|
||
| import ( | ||
| provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1" | ||
| ) | ||
|
|
||
| // Manager defines the interface for the permission service driver | ||
| type Manager interface { | ||
| CheckPermission(permission string, subject string, ref *provider.Reference) bool | ||
| } |
Oops, something went wrong.