mirror of
https://github.com/harness/drone.git
synced 2025-05-17 09:30:00 +08:00
Merge branch 'mg/small-fixes' of _OKE5H2PQKOUfzFFDuD4FA/default/CODE/gitness (#224)
This commit is contained in:
commit
6fb9b67404
@ -25,13 +25,12 @@ var (
|
|||||||
ErrParentResourceTypeUnknown = errors.New("Unknown parent resource type")
|
ErrParentResourceTypeUnknown = errors.New("Unknown parent resource type")
|
||||||
)
|
)
|
||||||
|
|
||||||
/*
|
// Check checks if a resource specific permission is granted for the current auth session in the scope.
|
||||||
* Check checks if a resource specific permission is granted for the current auth session in the scope.
|
// Returns nil if the permission is granted, otherwise returns an error.
|
||||||
* Returns nil if the permission is granted, otherwise returns an error.
|
// NotAuthenticated, NotAuthorized, or any underlying error.
|
||||||
* NotAuthenticated, NotAuthorized, or any unerlaying error.
|
|
||||||
*/
|
|
||||||
func Check(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
func Check(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
||||||
scope *types.Scope, resource *types.Resource, permission enum.Permission) error {
|
scope *types.Scope, resource *types.Resource, permission enum.Permission,
|
||||||
|
) error {
|
||||||
if session == nil {
|
if session == nil {
|
||||||
return ErrNotAuthenticated
|
return ErrNotAuthenticated
|
||||||
}
|
}
|
||||||
@ -53,12 +52,10 @@ func Check(ctx context.Context, authorizer authz.Authorizer, session *auth.Sessi
|
|||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
// CheckChild checks if a resource specific permission is granted for the current auth session
|
||||||
* CheckChild checks if a resource specific permission is granted for the current auth session
|
// in the scope of a parent.
|
||||||
* in the scope of a parent.
|
// Returns nil if the permission is granted, otherwise returns an error.
|
||||||
* Returns nil if the permission is granted, otherwise returns an error.
|
// NotAuthenticated, NotAuthorized, or any underlying error.
|
||||||
* NotAuthenticated, NotAuthorized, or any unerlaying error.
|
|
||||||
*/
|
|
||||||
func CheckChild(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
func CheckChild(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
||||||
spaceStore store.SpaceStore, repoStore store.RepoStore, parentType enum.ParentResourceType, parentID int64,
|
spaceStore store.SpaceStore, repoStore store.RepoStore, parentType enum.ParentResourceType, parentID int64,
|
||||||
resourceType enum.ResourceType, resourceName string, permission enum.Permission) error {
|
resourceType enum.ResourceType, resourceName string, permission enum.Permission) error {
|
||||||
|
@ -16,14 +16,13 @@ import (
|
|||||||
"github.com/pkg/errors"
|
"github.com/pkg/errors"
|
||||||
)
|
)
|
||||||
|
|
||||||
/*
|
// CheckRepo checks if a repo specific permission is granted for the current auth session
|
||||||
* CheckRepo checks if a repo specific permission is granted for the current auth session
|
// in the scope of its parent.
|
||||||
* in the scope of its parent.
|
// Returns nil if the permission is granted, otherwise returns an error.
|
||||||
* Returns nil if the permission is granted, otherwise returns an error.
|
// NotAuthenticated, NotAuthorized, or any underlying error.
|
||||||
* NotAuthenticated, NotAuthorized, or any unerlaying error.
|
|
||||||
*/
|
|
||||||
func CheckRepo(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
func CheckRepo(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
||||||
repo *types.Repository, permission enum.Permission, orPublic bool) error {
|
repo *types.Repository, permission enum.Permission, orPublic bool,
|
||||||
|
) error {
|
||||||
if orPublic && repo.IsPublic {
|
if orPublic && repo.IsPublic {
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
@ -13,14 +13,13 @@ import (
|
|||||||
"github.com/harness/gitness/types/enum"
|
"github.com/harness/gitness/types/enum"
|
||||||
)
|
)
|
||||||
|
|
||||||
/*
|
// CheckService checks if a service specific permission is granted for the current auth session.
|
||||||
* CheckService checks if a service specific permission is granted for the current auth session.
|
// Returns nil if the permission is granted, otherwise returns an error.
|
||||||
* Returns nil if the permission is granted, otherwise returns an error.
|
// NotAuthenticated, NotAuthorized, or any underlying error.
|
||||||
* NotAuthenticated, NotAuthorized, or any unerlaying error.
|
|
||||||
*/
|
|
||||||
func CheckService(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
func CheckService(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
||||||
svc *types.Service, permission enum.Permission) error {
|
svc *types.Service, permission enum.Permission,
|
||||||
// a service exists outside of any scope
|
) error {
|
||||||
|
// a service exists outside any scope
|
||||||
scope := &types.Scope{}
|
scope := &types.Scope{}
|
||||||
resource := &types.Resource{
|
resource := &types.Resource{
|
||||||
Type: enum.ResourceTypeService,
|
Type: enum.ResourceTypeService,
|
||||||
|
@ -13,15 +13,15 @@ import (
|
|||||||
"github.com/harness/gitness/types/enum"
|
"github.com/harness/gitness/types/enum"
|
||||||
)
|
)
|
||||||
|
|
||||||
/*
|
// CheckServiceAccount checks if a service account specific permission is granted for the current auth session
|
||||||
* CheckServiceAccount checks if a service account specific permission is granted for the current auth session
|
// in the scope of the parent.
|
||||||
* in the scope of the parent.
|
// Returns nil if the permission is granted, otherwise returns an error.
|
||||||
* Returns nil if the permission is granted, otherwise returns an error.
|
// NotAuthenticated, NotAuthorized, or any underlying error.
|
||||||
* NotAuthenticated, NotAuthorized, or any unerlaying error.
|
|
||||||
*/
|
|
||||||
func CheckServiceAccount(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
func CheckServiceAccount(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
||||||
spaceStore store.SpaceStore, repoStore store.RepoStore, parentType enum.ParentResourceType, parentID int64,
|
spaceStore store.SpaceStore, repoStore store.RepoStore, parentType enum.ParentResourceType, parentID int64,
|
||||||
saUID string, permission enum.Permission) error {
|
saUID string, permission enum.Permission,
|
||||||
return CheckChild(ctx, authorizer, session, spaceStore, repoStore, parentType, parentID,
|
) error {
|
||||||
|
return CheckChild(ctx, authorizer, session,
|
||||||
|
spaceStore, repoStore, parentType, parentID,
|
||||||
enum.ResourceTypeServiceAccount, saUID, permission)
|
enum.ResourceTypeServiceAccount, saUID, permission)
|
||||||
}
|
}
|
@ -16,14 +16,13 @@ import (
|
|||||||
"github.com/pkg/errors"
|
"github.com/pkg/errors"
|
||||||
)
|
)
|
||||||
|
|
||||||
/*
|
// CheckSpace checks if a space specific permission is granted for the current auth session
|
||||||
* CheckSpace checks if a space specific permission is granted for the current auth session
|
// in the scope of its parent.
|
||||||
* in the scope of its parent.
|
// Returns nil if the permission is granted, otherwise returns an error.
|
||||||
* Returns nil if the permission is granted, otherwise returns an error.
|
// NotAuthenticated, NotAuthorized, or any underlying error.
|
||||||
* NotAuthenticated, NotAuthorized, or any unerlaying error.
|
|
||||||
*/
|
|
||||||
func CheckSpace(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
func CheckSpace(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
||||||
space *types.Space, permission enum.Permission, orPublic bool) error {
|
space *types.Space, permission enum.Permission, orPublic bool,
|
||||||
|
) error {
|
||||||
if orPublic && space.IsPublic {
|
if orPublic && space.IsPublic {
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
@ -13,14 +13,13 @@ import (
|
|||||||
"github.com/harness/gitness/types/enum"
|
"github.com/harness/gitness/types/enum"
|
||||||
)
|
)
|
||||||
|
|
||||||
/*
|
// CheckUser checks if a user specific permission is granted for the current auth session.
|
||||||
* CheckUser checks if a user specific permission is granted for the current auth session.
|
// Returns nil if the permission is granted, otherwise returns an error.
|
||||||
* Returns nil if the permission is granted, otherwise returns an error.
|
// NotAuthenticated, NotAuthorized, or any underlying error.
|
||||||
* NotAuthenticated, NotAuthorized, or any unerlaying error.
|
|
||||||
*/
|
|
||||||
func CheckUser(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
func CheckUser(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
|
||||||
user *types.User, permission enum.Permission) error {
|
user *types.User, permission enum.Permission,
|
||||||
// a user exists outside of any scope
|
) error {
|
||||||
|
// a user exists outside any scope
|
||||||
scope := &types.Scope{}
|
scope := &types.Scope{}
|
||||||
resource := &types.Resource{
|
resource := &types.Resource{
|
||||||
Type: enum.ResourceTypeUser,
|
Type: enum.ResourceTypeUser,
|
||||||
|
@ -83,7 +83,7 @@ func (c *Controller) MembershipAdd(ctx context.Context,
|
|||||||
Role: in.Role,
|
Role: in.Role,
|
||||||
|
|
||||||
Principal: *user.ToPrincipalInfo(),
|
Principal: *user.ToPrincipalInfo(),
|
||||||
AdddedBy: *session.Principal.ToPrincipalInfo(),
|
AddedBy: *session.Principal.ToPrincipalInfo(),
|
||||||
}
|
}
|
||||||
|
|
||||||
err = c.membershipStore.Create(ctx, membership)
|
err = c.membershipStore.Create(ctx, membership)
|
||||||
|
@ -213,7 +213,7 @@ func (s *MembershipStore) mapToMembership(ctx context.Context, m *membership) *t
|
|||||||
log.Ctx(ctx).Error().Err(err).Msg("failed to load membership creator")
|
log.Ctx(ctx).Error().Err(err).Msg("failed to load membership creator")
|
||||||
}
|
}
|
||||||
if addedBy != nil {
|
if addedBy != nil {
|
||||||
res.AdddedBy = *addedBy
|
res.AddedBy = *addedBy
|
||||||
}
|
}
|
||||||
|
|
||||||
principal, err := s.pCache.Get(ctx, res.PrincipalID)
|
principal, err := s.pCache.Get(ctx, res.PrincipalID)
|
||||||
@ -245,7 +245,7 @@ func (s *MembershipStore) mapToMemberships(ctx context.Context, ms []*membership
|
|||||||
for i, m := range ms {
|
for i, m := range ms {
|
||||||
res[i] = mapToMembershipNoPrincipalInfo(m)
|
res[i] = mapToMembershipNoPrincipalInfo(m)
|
||||||
if addedBy, ok := infoMap[m.CreatedBy]; ok {
|
if addedBy, ok := infoMap[m.CreatedBy]; ok {
|
||||||
res[i].AdddedBy = *addedBy
|
res[i].AddedBy = *addedBy
|
||||||
}
|
}
|
||||||
if principal, ok := infoMap[m.PrincipalID]; ok {
|
if principal, ok := infoMap[m.PrincipalID]; ok {
|
||||||
res[i].Principal = *principal
|
res[i].Principal = *principal
|
||||||
|
@ -26,5 +26,5 @@ type Membership struct {
|
|||||||
Role enum.MembershipRole `json:"role"`
|
Role enum.MembershipRole `json:"role"`
|
||||||
|
|
||||||
Principal PrincipalInfo `json:"principal"`
|
Principal PrincipalInfo `json:"principal"`
|
||||||
AdddedBy PrincipalInfo `json:"added_by"`
|
AddedBy PrincipalInfo `json:"added_by"`
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user