mirror of
https://github.com/harness/drone.git
synced 2025-05-06 06:29:39 +08:00
8c2f900c80
This change introduces the concept of a principal (abstraction of call identity), and adds a new service account type principal. Also adds support for different tokens (session, PAT, SAT, OAuth2) and adds auth.Session which is being used to capture information about the caller and call method.
60 lines
1.9 KiB
Go
60 lines
1.9 KiB
Go
// Copyright 2021 Harness Inc. All rights reserved.
|
|
// Use of this source code is governed by the Polyform Free Trial License
|
|
// that can be found in the LICENSE.md file for this repository.
|
|
|
|
package guard
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/harness/gitness/internal/api/render"
|
|
"github.com/harness/gitness/internal/api/request"
|
|
"github.com/harness/gitness/types"
|
|
"github.com/harness/gitness/types/enum"
|
|
"github.com/rs/zerolog/hlog"
|
|
)
|
|
|
|
/*
|
|
* Returns a middleware that guards service account related handlers from being executed.
|
|
* Only principals that are authorized are able to execute the handler, everyone else is forbidden.
|
|
*
|
|
* Assumes the service account is already available in the request context.
|
|
*/
|
|
func (g *Guard) ForServiceAccount(requiredPermission enum.Permission) func(http.Handler) http.Handler {
|
|
return func(h http.Handler) http.Handler {
|
|
return g.ServiceAccount(requiredPermission, h.ServeHTTP)
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Returns an http.HandlerFunc that guards service account related http.HandlerFunc from being executed.
|
|
* Only principals that are authorized are able to execute the handler, everyone else is forbidden.
|
|
* Assumes the service account is already available in the request context.
|
|
*/
|
|
func (g *Guard) ServiceAccount(permission enum.Permission, guarded http.HandlerFunc) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
ctx := r.Context()
|
|
log := hlog.FromRequest(r)
|
|
|
|
sa, ok := request.ServiceAccountFrom(ctx)
|
|
if !ok {
|
|
log.Error().Msg("Method expects the service account in request context, but wasnt.")
|
|
|
|
render.InternalError(w)
|
|
return
|
|
}
|
|
|
|
// Enforce permission (renders error)
|
|
// TODO: Currently we don't support per service account RBAC (only all or nothing)
|
|
if !g.EnforceInParentScope(w, r, &types.Resource{
|
|
Type: enum.ResourceTypeServiceAccount,
|
|
Name: ""},
|
|
permission, sa.ParentType, sa.ParentID) {
|
|
return
|
|
}
|
|
|
|
// executed guarded function
|
|
guarded(w, r)
|
|
}
|
|
}
|