Merge branch 'mg/small-fixes' of _OKE5H2PQKOUfzFFDuD4FA/default/CODE/gitness (#224)

This commit is contained in:
Marko Gacesa 2023-07-24 13:11:42 +00:00 committed by Harness
commit 6fb9b67404
9 changed files with 45 additions and 52 deletions

View File

@ -25,13 +25,12 @@ var (
ErrParentResourceTypeUnknown = errors.New("Unknown parent resource type") ErrParentResourceTypeUnknown = errors.New("Unknown parent resource type")
) )
/* // Check checks if a resource specific permission is granted for the current auth session in the scope.
* Check checks if a resource specific permission is granted for the current auth session in the scope. // Returns nil if the permission is granted, otherwise returns an error.
* Returns nil if the permission is granted, otherwise returns an error. // NotAuthenticated, NotAuthorized, or any underlying error.
* NotAuthenticated, NotAuthorized, or any unerlaying error.
*/
func Check(ctx context.Context, authorizer authz.Authorizer, session *auth.Session, func Check(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
scope *types.Scope, resource *types.Resource, permission enum.Permission) error { scope *types.Scope, resource *types.Resource, permission enum.Permission,
) error {
if session == nil { if session == nil {
return ErrNotAuthenticated return ErrNotAuthenticated
} }
@ -53,12 +52,10 @@ func Check(ctx context.Context, authorizer authz.Authorizer, session *auth.Sessi
return nil return nil
} }
/* // CheckChild checks if a resource specific permission is granted for the current auth session
* CheckChild checks if a resource specific permission is granted for the current auth session // in the scope of a parent.
* in the scope of a parent. // Returns nil if the permission is granted, otherwise returns an error.
* Returns nil if the permission is granted, otherwise returns an error. // NotAuthenticated, NotAuthorized, or any underlying error.
* NotAuthenticated, NotAuthorized, or any unerlaying error.
*/
func CheckChild(ctx context.Context, authorizer authz.Authorizer, session *auth.Session, func CheckChild(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
spaceStore store.SpaceStore, repoStore store.RepoStore, parentType enum.ParentResourceType, parentID int64, spaceStore store.SpaceStore, repoStore store.RepoStore, parentType enum.ParentResourceType, parentID int64,
resourceType enum.ResourceType, resourceName string, permission enum.Permission) error { resourceType enum.ResourceType, resourceName string, permission enum.Permission) error {

View File

@ -16,14 +16,13 @@ import (
"github.com/pkg/errors" "github.com/pkg/errors"
) )
/* // CheckRepo checks if a repo specific permission is granted for the current auth session
* CheckRepo checks if a repo specific permission is granted for the current auth session // in the scope of its parent.
* in the scope of its parent. // Returns nil if the permission is granted, otherwise returns an error.
* Returns nil if the permission is granted, otherwise returns an error. // NotAuthenticated, NotAuthorized, or any underlying error.
* NotAuthenticated, NotAuthorized, or any unerlaying error.
*/
func CheckRepo(ctx context.Context, authorizer authz.Authorizer, session *auth.Session, func CheckRepo(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
repo *types.Repository, permission enum.Permission, orPublic bool) error { repo *types.Repository, permission enum.Permission, orPublic bool,
) error {
if orPublic && repo.IsPublic { if orPublic && repo.IsPublic {
return nil return nil
} }

View File

@ -13,14 +13,13 @@ import (
"github.com/harness/gitness/types/enum" "github.com/harness/gitness/types/enum"
) )
/* // CheckService checks if a service specific permission is granted for the current auth session.
* CheckService checks if a service specific permission is granted for the current auth session. // Returns nil if the permission is granted, otherwise returns an error.
* Returns nil if the permission is granted, otherwise returns an error. // NotAuthenticated, NotAuthorized, or any underlying error.
* NotAuthenticated, NotAuthorized, or any unerlaying error.
*/
func CheckService(ctx context.Context, authorizer authz.Authorizer, session *auth.Session, func CheckService(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
svc *types.Service, permission enum.Permission) error { svc *types.Service, permission enum.Permission,
// a service exists outside of any scope ) error {
// a service exists outside any scope
scope := &types.Scope{} scope := &types.Scope{}
resource := &types.Resource{ resource := &types.Resource{
Type: enum.ResourceTypeService, Type: enum.ResourceTypeService,

View File

@ -13,15 +13,15 @@ import (
"github.com/harness/gitness/types/enum" "github.com/harness/gitness/types/enum"
) )
/* // CheckServiceAccount checks if a service account specific permission is granted for the current auth session
* CheckServiceAccount checks if a service account specific permission is granted for the current auth session // in the scope of the parent.
* in the scope of the parent. // Returns nil if the permission is granted, otherwise returns an error.
* Returns nil if the permission is granted, otherwise returns an error. // NotAuthenticated, NotAuthorized, or any underlying error.
* NotAuthenticated, NotAuthorized, or any unerlaying error.
*/
func CheckServiceAccount(ctx context.Context, authorizer authz.Authorizer, session *auth.Session, func CheckServiceAccount(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
spaceStore store.SpaceStore, repoStore store.RepoStore, parentType enum.ParentResourceType, parentID int64, spaceStore store.SpaceStore, repoStore store.RepoStore, parentType enum.ParentResourceType, parentID int64,
saUID string, permission enum.Permission) error { saUID string, permission enum.Permission,
return CheckChild(ctx, authorizer, session, spaceStore, repoStore, parentType, parentID, ) error {
return CheckChild(ctx, authorizer, session,
spaceStore, repoStore, parentType, parentID,
enum.ResourceTypeServiceAccount, saUID, permission) enum.ResourceTypeServiceAccount, saUID, permission)
} }

View File

@ -16,14 +16,13 @@ import (
"github.com/pkg/errors" "github.com/pkg/errors"
) )
/* // CheckSpace checks if a space specific permission is granted for the current auth session
* CheckSpace checks if a space specific permission is granted for the current auth session // in the scope of its parent.
* in the scope of its parent. // Returns nil if the permission is granted, otherwise returns an error.
* Returns nil if the permission is granted, otherwise returns an error. // NotAuthenticated, NotAuthorized, or any underlying error.
* NotAuthenticated, NotAuthorized, or any unerlaying error.
*/
func CheckSpace(ctx context.Context, authorizer authz.Authorizer, session *auth.Session, func CheckSpace(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
space *types.Space, permission enum.Permission, orPublic bool) error { space *types.Space, permission enum.Permission, orPublic bool,
) error {
if orPublic && space.IsPublic { if orPublic && space.IsPublic {
return nil return nil
} }

View File

@ -13,14 +13,13 @@ import (
"github.com/harness/gitness/types/enum" "github.com/harness/gitness/types/enum"
) )
/* // CheckUser checks if a user specific permission is granted for the current auth session.
* CheckUser checks if a user specific permission is granted for the current auth session. // Returns nil if the permission is granted, otherwise returns an error.
* Returns nil if the permission is granted, otherwise returns an error. // NotAuthenticated, NotAuthorized, or any underlying error.
* NotAuthenticated, NotAuthorized, or any unerlaying error.
*/
func CheckUser(ctx context.Context, authorizer authz.Authorizer, session *auth.Session, func CheckUser(ctx context.Context, authorizer authz.Authorizer, session *auth.Session,
user *types.User, permission enum.Permission) error { user *types.User, permission enum.Permission,
// a user exists outside of any scope ) error {
// a user exists outside any scope
scope := &types.Scope{} scope := &types.Scope{}
resource := &types.Resource{ resource := &types.Resource{
Type: enum.ResourceTypeUser, Type: enum.ResourceTypeUser,

View File

@ -83,7 +83,7 @@ func (c *Controller) MembershipAdd(ctx context.Context,
Role: in.Role, Role: in.Role,
Principal: *user.ToPrincipalInfo(), Principal: *user.ToPrincipalInfo(),
AdddedBy: *session.Principal.ToPrincipalInfo(), AddedBy: *session.Principal.ToPrincipalInfo(),
} }
err = c.membershipStore.Create(ctx, membership) err = c.membershipStore.Create(ctx, membership)

View File

@ -213,7 +213,7 @@ func (s *MembershipStore) mapToMembership(ctx context.Context, m *membership) *t
log.Ctx(ctx).Error().Err(err).Msg("failed to load membership creator") log.Ctx(ctx).Error().Err(err).Msg("failed to load membership creator")
} }
if addedBy != nil { if addedBy != nil {
res.AdddedBy = *addedBy res.AddedBy = *addedBy
} }
principal, err := s.pCache.Get(ctx, res.PrincipalID) principal, err := s.pCache.Get(ctx, res.PrincipalID)
@ -245,7 +245,7 @@ func (s *MembershipStore) mapToMemberships(ctx context.Context, ms []*membership
for i, m := range ms { for i, m := range ms {
res[i] = mapToMembershipNoPrincipalInfo(m) res[i] = mapToMembershipNoPrincipalInfo(m)
if addedBy, ok := infoMap[m.CreatedBy]; ok { if addedBy, ok := infoMap[m.CreatedBy]; ok {
res[i].AdddedBy = *addedBy res[i].AddedBy = *addedBy
} }
if principal, ok := infoMap[m.PrincipalID]; ok { if principal, ok := infoMap[m.PrincipalID]; ok {
res[i].Principal = *principal res[i].Principal = *principal

View File

@ -26,5 +26,5 @@ type Membership struct {
Role enum.MembershipRole `json:"role"` Role enum.MembershipRole `json:"role"`
Principal PrincipalInfo `json:"principal"` Principal PrincipalInfo `json:"principal"`
AdddedBy PrincipalInfo `json:"added_by"` AddedBy PrincipalInfo `json:"added_by"`
} }