github/drone
5
0
Fork 0
mirror of https://github.com/harness/drone.git synced 2025-05-21 11:29:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

Address comments on customer guard errors

Browse Source
This commit is contained in:
Johannes Batzill 2022-09-06 15:01:13 -07:00
parent 4545ffa666
commit 3fa479429c
2 changed files with 27 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
internal/api/guard/error.go
View File

@ -12,45 +12,38 @@ import (
)
type notAuthenticatedError struct {
msg string
}
func IsNotAuthenticatedError(err error) bool {
_, ok := err.(*notAuthenticatedError)
return ok
}
func newNotAuthenticatedError(permission enum.Permission, resource *types.Resource) *notAuthenticatedError {
return &notAuthenticatedError{
msg: fmt.Sprintf("Operation %s on resource %v requires authentication.", permission, resource),
}
resource *types.Resource
permission enum.Permission
}
func (e *notAuthenticatedError) Error() string {
return e.msg
return fmt.Sprintf("Operation %s on resource %v requires authentication.", e.permission, e.resource)
}
type notAuthorizedError struct {
msg string
}
func IsNotAuthorizedError(err error) bool {
_, ok := err.(*notAuthorizedError)
func (e *notAuthenticatedError) Is(target error) bool {
_, ok := target.(*notAuthenticatedError)
return ok
}
func newNotAuthorizedError(user *types.User, scope *types.Scope, resource *types.Resource, permission enum.Permission) *notAuthorizedError {
return &notAuthorizedError{
msg: fmt.Sprintf(
"User '%s' (%s) is not authorized to execute %s on resource %v in scope %v.",
user.Name,
user.Email,
permission,
resource,
scope),
}
type notAuthorizedError struct {
user *types.User
scope *types.Scope
resource *types.Resource
permission enum.Permission
}
func (e *notAuthorizedError) Error() string {
return e.msg
// ASSUMPTION: user is never nil at this point (type is not exported)
return fmt.Sprintf(
"User '%s' (%s) is not authorized to execute %s on resource %v in scope %v.",
e.user.Name,
e.user.Email,
e.permission,
e.resource,
e.scope)
}
func (e *notAuthorizedError) Is(target error) bool {
_, ok := target.(*notAuthorizedError)
return ok
}

8
internal/api/guard/guard.go
View File

@ -68,9 +68,9 @@ func (g *Guard) EnforceAuthenticated(next http.Handler) http.Handler {
func (g *Guard) Enforce(w http.ResponseWriter, r *http.Request, scope *types.Scope, resource *types.Resource, permission enum.Permission) bool {
err := g.Check(r, scope, resource, permission)
if IsNotAuthenticatedError(err) {
if errors.Is(err, &notAuthenticatedError{}) {
render.Unauthorized(w, err)
} else if IsNotAuthorizedError(err) {
} else if errors.Is(err, &notAuthorizedError{}) {
render.Forbidden(w, err)
} else if err != nil {
render.InternalError(w, err)
@ -87,7 +87,7 @@ func (g *Guard) Enforce(w http.ResponseWriter, r *http.Request, scope *types.Sco
func (g *Guard) Check(r *http.Request, scope *types.Scope, resource *types.Resource, permission enum.Permission) error {
u, present := request.UserFrom(r.Context())
if !present {
return newNotAuthenticatedError(permission, resource)
return &notAuthenticatedError{resource, permission}
}
// TODO: don't hardcode principal type USER
@ -102,7 +102,7 @@ func (g *Guard) Check(r *http.Request, scope *types.Scope, resource *types.Resou
}
if !authorized {
return newNotAuthorizedError(u, scope, resource, permission)
return &notAuthorizedError{u, scope, resource, permission}
}
return nil