From c136c30061e1fd7e1d59a6e1bc9bcacdb5989ad8 Mon Sep 17 00:00:00 2001 From: Benjamin Somers Date: Fri, 22 Nov 2024 14:45:24 +0000 Subject: [PATCH] incusd/auth: Comment exported methods and types Signed-off-by: Benjamin Somers --- internal/server/auth/common/common.go | 4 ++ internal/server/auth/driver_openfga.go | 69 +++++++++++++----------- internal/server/auth/driver_scriptlet.go | 5 ++ internal/server/auth/driver_tls.go | 1 + 4 files changed, 48 insertions(+), 31 deletions(-) diff --git a/internal/server/auth/common/common.go b/internal/server/auth/common/common.go index f1356e7247..e25127a015 100644 --- a/internal/server/auth/common/common.go +++ b/internal/server/auth/common/common.go @@ -1,5 +1,6 @@ package common +// RequestDetails is a type representing an authorization request. type RequestDetails struct { UserName string Protocol string @@ -9,6 +10,7 @@ type RequestDetails struct { ProjectName string } +// IsInternalOrUnix tells whether a given request has been initiated locally. func (r *RequestDetails) IsInternalOrUnix() bool { if r.Protocol == "unix" { return true @@ -21,6 +23,7 @@ func (r *RequestDetails) IsInternalOrUnix() bool { return false } +// Username extracts the request username. func (r *RequestDetails) Username() string { if r.Protocol == "cluster" && r.ForwardedUsername != "" { return r.ForwardedUsername @@ -29,6 +32,7 @@ func (r *RequestDetails) Username() string { return r.UserName } +// AuthenticationProtocol extracts the request protocol. func (r *RequestDetails) AuthenticationProtocol() string { if r.Protocol == "cluster" { return r.ForwardedProtocol diff --git a/internal/server/auth/driver_openfga.go b/internal/server/auth/driver_openfga.go index 8ca1250f91..dbdabe6bee 100644 --- a/internal/server/auth/driver_openfga.go +++ b/internal/server/auth/driver_openfga.go @@ -17,6 +17,7 @@ import ( "github.com/lxc/incus/v6/shared/logger" ) +// FGA represents an OpenFGA authorizer. type FGA struct { commonAuthorizer tls *TLS @@ -137,6 +138,7 @@ func (f *FGA) load(ctx context.Context, certificateCache *certificate.Cache, opt return nil } +// StopService stops the authorizer gracefully. func (f *FGA) StopService(ctx context.Context) error { // Cancel any background routine. f.shutdownCancel() @@ -247,6 +249,7 @@ func (f *FGA) connect(ctx context.Context, certificateCache *certificate.Cache, return nil } +// CheckPermission returns an error if the user does not have the given Entitlement on the given Object. func (f *FGA) CheckPermission(ctx context.Context, r *http.Request, object Object, entitlement Entitlement) error { logCtx := logger.Ctx{"object": object, "entitlement": entitlement, "url": r.URL.String(), "method": r.Method} ctx, cancel := context.WithTimeout(ctx, 10*time.Second) @@ -295,6 +298,7 @@ func (f *FGA) CheckPermission(ctx context.Context, r *http.Request, object Objec return nil } +// GetPermissionChecker returns a function that can be used to check whether a user has the required entitlement on an authorization object. func (f *FGA) GetPermissionChecker(ctx context.Context, r *http.Request, entitlement Entitlement, objectType ObjectType) (PermissionChecker, error) { allowFunc := func(b bool) func(Object) bool { return func(Object) bool { @@ -338,6 +342,7 @@ func (f *FGA) GetPermissionChecker(ctx context.Context, r *http.Request, entitle }, nil } +// AddProject adds a project to the authorizer. func (f *FGA) AddProject(ctx context.Context, _ int64, projectName string) error { writes := []client.ClientTupleKey{ { @@ -355,6 +360,7 @@ func (f *FGA) AddProject(ctx context.Context, _ int64, projectName string) error return f.updateTuples(ctx, writes, nil) } +// DeleteProject deletes a project from the authorizer. func (f *FGA) DeleteProject(ctx context.Context, _ int64, projectName string) error { // Only empty projects can be deleted, so we don't need to worry about any tuples with this project as a parent. deletions := []client.ClientTupleKeyWithoutCondition{ @@ -374,6 +380,7 @@ func (f *FGA) DeleteProject(ctx context.Context, _ int64, projectName string) er return f.updateTuples(ctx, nil, deletions) } +// RenameProject renames a project in the authorizer. func (f *FGA) RenameProject(ctx context.Context, _ int64, oldName string, newName string) error { writes := []client.ClientTupleKey{ { @@ -406,7 +413,7 @@ func (f *FGA) RenameProject(ctx context.Context, _ int64, oldName string, newNam return f.updateTuples(ctx, writes, deletions) } -// AddCertificate is a no-op. +// AddCertificate adds a certificate to the authorizer. func (f *FGA) AddCertificate(ctx context.Context, fingerprint string) error { writes := []client.ClientTupleKey{ { @@ -419,7 +426,7 @@ func (f *FGA) AddCertificate(ctx context.Context, fingerprint string) error { return f.updateTuples(ctx, writes, nil) } -// DeleteCertificate is a no-op. +// DeleteCertificate deletes a certificate from the authorizer. func (f *FGA) DeleteCertificate(ctx context.Context, fingerprint string) error { deletions := []client.ClientTupleKeyWithoutCondition{ { @@ -432,7 +439,7 @@ func (f *FGA) DeleteCertificate(ctx context.Context, fingerprint string) error { return f.updateTuples(ctx, nil, deletions) } -// AddStoragePool is a no-op. +// AddStoragePool adds a storage pool to the authorizer. func (f *FGA) AddStoragePool(ctx context.Context, storagePoolName string) error { writes := []client.ClientTupleKey{ { @@ -445,7 +452,7 @@ func (f *FGA) AddStoragePool(ctx context.Context, storagePoolName string) error return f.updateTuples(ctx, writes, nil) } -// DeleteStoragePool is a no-op. +// DeleteStoragePool deletes a storage pool from the authorizer. func (f *FGA) DeleteStoragePool(ctx context.Context, storagePoolName string) error { deletions := []client.ClientTupleKeyWithoutCondition{ { @@ -458,7 +465,7 @@ func (f *FGA) DeleteStoragePool(ctx context.Context, storagePoolName string) err return f.updateTuples(ctx, nil, deletions) } -// AddImage is a no-op. +// AddImage adds an image to the authorizer. func (f *FGA) AddImage(ctx context.Context, projectName string, fingerprint string) error { writes := []client.ClientTupleKey{ { @@ -471,7 +478,7 @@ func (f *FGA) AddImage(ctx context.Context, projectName string, fingerprint stri return f.updateTuples(ctx, writes, nil) } -// DeleteImage is a no-op. +// DeleteImage deletes an image from the authorizer. func (f *FGA) DeleteImage(ctx context.Context, projectName string, fingerprint string) error { deletions := []client.ClientTupleKeyWithoutCondition{ { @@ -484,7 +491,7 @@ func (f *FGA) DeleteImage(ctx context.Context, projectName string, fingerprint s return f.updateTuples(ctx, nil, deletions) } -// AddImageAlias is a no-op. +// AddImageAlias adds an image alias to the authorizer. func (f *FGA) AddImageAlias(ctx context.Context, projectName string, imageAliasName string) error { writes := []client.ClientTupleKey{ { @@ -497,7 +504,7 @@ func (f *FGA) AddImageAlias(ctx context.Context, projectName string, imageAliasN return f.updateTuples(ctx, writes, nil) } -// DeleteImageAlias is a no-op. +// DeleteImageAlias deletes an image alias from the authorizer. func (f *FGA) DeleteImageAlias(ctx context.Context, projectName string, imageAliasName string) error { deletions := []client.ClientTupleKeyWithoutCondition{ { @@ -510,7 +517,7 @@ func (f *FGA) DeleteImageAlias(ctx context.Context, projectName string, imageAli return f.updateTuples(ctx, nil, deletions) } -// RenameImageAlias is a no-op. +// RenameImageAlias renames an image alias in the authorizer. func (f *FGA) RenameImageAlias(ctx context.Context, projectName string, oldAliasName string, newAliasName string) error { writes := []client.ClientTupleKey{ { @@ -531,7 +538,7 @@ func (f *FGA) RenameImageAlias(ctx context.Context, projectName string, oldAlias return f.updateTuples(ctx, writes, deletions) } -// AddInstance is a no-op. +// AddInstance adds an instance to the authorizer. func (f *FGA) AddInstance(ctx context.Context, projectName string, instanceName string) error { writes := []client.ClientTupleKey{ { @@ -544,7 +551,7 @@ func (f *FGA) AddInstance(ctx context.Context, projectName string, instanceName return f.updateTuples(ctx, writes, nil) } -// DeleteInstance is a no-op. +// DeleteInstance deletes an instance from the authorizer. func (f *FGA) DeleteInstance(ctx context.Context, projectName string, instanceName string) error { deletions := []client.ClientTupleKeyWithoutCondition{ { @@ -557,7 +564,7 @@ func (f *FGA) DeleteInstance(ctx context.Context, projectName string, instanceNa return f.updateTuples(ctx, nil, deletions) } -// RenameInstance is a no-op. +// RenameInstance renames an instance in the authorizer. func (f *FGA) RenameInstance(ctx context.Context, projectName string, oldInstanceName string, newInstanceName string) error { writes := []client.ClientTupleKey{ { @@ -578,7 +585,7 @@ func (f *FGA) RenameInstance(ctx context.Context, projectName string, oldInstanc return f.updateTuples(ctx, writes, deletions) } -// AddNetwork is a no-op. +// AddNetwork adds a network to the authorizer. func (f *FGA) AddNetwork(ctx context.Context, projectName string, networkName string) error { writes := []client.ClientTupleKey{ { @@ -591,7 +598,7 @@ func (f *FGA) AddNetwork(ctx context.Context, projectName string, networkName st return f.updateTuples(ctx, writes, nil) } -// DeleteNetwork is a no-op. +// DeleteNetwork deletes a network from the authorizer. func (f *FGA) DeleteNetwork(ctx context.Context, projectName string, networkName string) error { deletions := []client.ClientTupleKeyWithoutCondition{ { @@ -604,7 +611,7 @@ func (f *FGA) DeleteNetwork(ctx context.Context, projectName string, networkName return f.updateTuples(ctx, nil, deletions) } -// RenameNetwork is a no-op. +// RenameNetwork renames a network in the authorizer. func (f *FGA) RenameNetwork(ctx context.Context, projectName string, oldNetworkName string, newNetworkName string) error { writes := []client.ClientTupleKey{ { @@ -625,7 +632,7 @@ func (f *FGA) RenameNetwork(ctx context.Context, projectName string, oldNetworkN return f.updateTuples(ctx, writes, deletions) } -// AddNetworkZone is a no-op. +// AddNetworkZone adds a network zone in the authorizer. func (f *FGA) AddNetworkZone(ctx context.Context, projectName string, networkZoneName string) error { writes := []client.ClientTupleKey{ { @@ -638,7 +645,7 @@ func (f *FGA) AddNetworkZone(ctx context.Context, projectName string, networkZon return f.updateTuples(ctx, writes, nil) } -// DeleteNetworkZone is a no-op. +// DeleteNetworkZone deletes a network zone from the authorizer. func (f *FGA) DeleteNetworkZone(ctx context.Context, projectName string, networkZoneName string) error { deletions := []client.ClientTupleKeyWithoutCondition{ { @@ -651,7 +658,7 @@ func (f *FGA) DeleteNetworkZone(ctx context.Context, projectName string, network return f.updateTuples(ctx, nil, deletions) } -// AddNetworkIntegration is a no-op. +// AddNetworkIntegration adds a network integration to the authorizer. func (f *FGA) AddNetworkIntegration(ctx context.Context, networkIntegrationName string) error { writes := []client.ClientTupleKey{ { @@ -664,7 +671,7 @@ func (f *FGA) AddNetworkIntegration(ctx context.Context, networkIntegrationName return f.updateTuples(ctx, writes, nil) } -// DeleteNetworkIntegration is a no-op. +// DeleteNetworkIntegration deletes a network integration from the authorizer. func (f *FGA) DeleteNetworkIntegration(ctx context.Context, networkIntegrationName string) error { deletions := []client.ClientTupleKeyWithoutCondition{ { @@ -677,7 +684,7 @@ func (f *FGA) DeleteNetworkIntegration(ctx context.Context, networkIntegrationNa return f.updateTuples(ctx, nil, deletions) } -// RenameNetworkIntegration is a no-op. +// RenameNetworkIntegration renames a network integration in the authorizer. func (f *FGA) RenameNetworkIntegration(ctx context.Context, oldNetworkIntegrationName string, newNetworkIntegrationName string) error { writes := []client.ClientTupleKey{ { @@ -698,7 +705,7 @@ func (f *FGA) RenameNetworkIntegration(ctx context.Context, oldNetworkIntegratio return f.updateTuples(ctx, writes, deletions) } -// AddNetworkACL is a no-op. +// AddNetworkACL adds a network ACL in the authorizer. func (f *FGA) AddNetworkACL(ctx context.Context, projectName string, networkACLName string) error { writes := []client.ClientTupleKey{ { @@ -711,7 +718,7 @@ func (f *FGA) AddNetworkACL(ctx context.Context, projectName string, networkACLN return f.updateTuples(ctx, writes, nil) } -// DeleteNetworkACL is a no-op. +// DeleteNetworkACL deletes a network ACL from the authorizer. func (f *FGA) DeleteNetworkACL(ctx context.Context, projectName string, networkACLName string) error { deletions := []client.ClientTupleKeyWithoutCondition{ { @@ -724,7 +731,7 @@ func (f *FGA) DeleteNetworkACL(ctx context.Context, projectName string, networkA return f.updateTuples(ctx, nil, deletions) } -// RenameNetworkACL is a no-op. +// RenameNetworkACL renames a network ACL in the authorizer. func (f *FGA) RenameNetworkACL(ctx context.Context, projectName string, oldNetworkACLName string, newNetworkACLName string) error { writes := []client.ClientTupleKey{ { @@ -745,7 +752,7 @@ func (f *FGA) RenameNetworkACL(ctx context.Context, projectName string, oldNetwo return f.updateTuples(ctx, writes, deletions) } -// AddProfile is a no-op. +// AddProfile adds a profile in the authorizer. func (f *FGA) AddProfile(ctx context.Context, projectName string, profileName string) error { writes := []client.ClientTupleKey{ { @@ -758,7 +765,7 @@ func (f *FGA) AddProfile(ctx context.Context, projectName string, profileName st return f.updateTuples(ctx, writes, nil) } -// DeleteProfile is a no-op. +// DeleteProfile deletes a profile from the authorizer. func (f *FGA) DeleteProfile(ctx context.Context, projectName string, profileName string) error { deletions := []client.ClientTupleKeyWithoutCondition{ { @@ -771,7 +778,7 @@ func (f *FGA) DeleteProfile(ctx context.Context, projectName string, profileName return f.updateTuples(ctx, nil, deletions) } -// RenameProfile is a no-op. +// RenameProfile renames a profile in the authorizer. func (f *FGA) RenameProfile(ctx context.Context, projectName string, oldProfileName string, newProfileName string) error { writes := []client.ClientTupleKey{ { @@ -792,7 +799,7 @@ func (f *FGA) RenameProfile(ctx context.Context, projectName string, oldProfileN return f.updateTuples(ctx, writes, deletions) } -// AddStoragePoolVolume is a no-op. +// AddStoragePoolVolume adds a storage volume to the authorizer. func (f *FGA) AddStoragePoolVolume(ctx context.Context, projectName string, storagePoolName string, storageVolumeType string, storageVolumeName string, storageVolumeLocation string) error { writes := []client.ClientTupleKey{ { @@ -805,7 +812,7 @@ func (f *FGA) AddStoragePoolVolume(ctx context.Context, projectName string, stor return f.updateTuples(ctx, writes, nil) } -// DeleteStoragePoolVolume is a no-op. +// DeleteStoragePoolVolume deletes a storage volume from the authorizer. func (f *FGA) DeleteStoragePoolVolume(ctx context.Context, projectName string, storagePoolName string, storageVolumeType string, storageVolumeName string, storageVolumeLocation string) error { deletions := []client.ClientTupleKeyWithoutCondition{ { @@ -818,7 +825,7 @@ func (f *FGA) DeleteStoragePoolVolume(ctx context.Context, projectName string, s return f.updateTuples(ctx, nil, deletions) } -// RenameStoragePoolVolume is a no-op. +// RenameStoragePoolVolume renames a storage volume in the authorizer. func (f *FGA) RenameStoragePoolVolume(ctx context.Context, projectName string, storagePoolName string, storageVolumeType string, oldStorageVolumeName string, newStorageVolumeName string, storageVolumeLocation string) error { writes := []client.ClientTupleKey{ { @@ -839,7 +846,7 @@ func (f *FGA) RenameStoragePoolVolume(ctx context.Context, projectName string, s return f.updateTuples(ctx, writes, deletions) } -// AddStorageBucket is a no-op. +// AddStorageBucket adds a storage bucket to the authorizer. func (f *FGA) AddStorageBucket(ctx context.Context, projectName string, storagePoolName string, storageBucketName string, storageBucketLocation string) error { writes := []client.ClientTupleKey{ { @@ -852,7 +859,7 @@ func (f *FGA) AddStorageBucket(ctx context.Context, projectName string, storageP return f.updateTuples(ctx, writes, nil) } -// DeleteStorageBucket is a no-op. +// DeleteStorageBucket deletes a storage bucket from the authorizer. func (f *FGA) DeleteStorageBucket(ctx context.Context, projectName string, storagePoolName string, storageBucketName string, storageBucketLocation string) error { deletions := []client.ClientTupleKeyWithoutCondition{ { diff --git a/internal/server/auth/driver_scriptlet.go b/internal/server/auth/driver_scriptlet.go index 4998d83417..cbc7dc2829 100644 --- a/internal/server/auth/driver_scriptlet.go +++ b/internal/server/auth/driver_scriptlet.go @@ -10,10 +10,12 @@ import ( "github.com/lxc/incus/v6/shared/logger" ) +// Scriptlet represents a scriptlet authorizer. type Scriptlet struct { commonAuthorizer } +// CheckPermission returns an error if the user does not have the given Entitlement on the given Object. func (s *Scriptlet) CheckPermission(ctx context.Context, r *http.Request, object Object, entitlement Entitlement) error { details, err := s.requestDetails(r) if err != nil { @@ -36,10 +38,12 @@ func (s *Scriptlet) CheckPermission(ctx context.Context, r *http.Request, object return api.StatusErrorf(http.StatusForbidden, "Permission denied") } +// GetInstanceAccess returns the list of entities who have access to the instance. func (s *Scriptlet) GetInstanceAccess(ctx context.Context, projectName string, instanceName string) (*api.Access, error) { return &api.Access{}, nil } +// GetPermissionChecker returns a function that can be used to check whether a user has the required entitlement on an authorization object. func (s *Scriptlet) GetPermissionChecker(ctx context.Context, r *http.Request, entitlement Entitlement, objectType ObjectType) (PermissionChecker, error) { allowFunc := func(b bool) func(Object) bool { return func(Object) bool { @@ -69,6 +73,7 @@ func (s *Scriptlet) GetPermissionChecker(ctx context.Context, r *http.Request, e return permissionChecker, nil } +// GetProjectAccess returns the list of entities who have access to the project. func (s *Scriptlet) GetProjectAccess(ctx context.Context, projectName string) (*api.Access, error) { return &api.Access{}, nil } diff --git a/internal/server/auth/driver_tls.go b/internal/server/auth/driver_tls.go index fce42645a8..3bb45d4575 100644 --- a/internal/server/auth/driver_tls.go +++ b/internal/server/auth/driver_tls.go @@ -13,6 +13,7 @@ import ( "github.com/lxc/incus/v6/shared/util" ) +// TLS represents a TLS authorizer. type TLS struct { commonAuthorizer certificates *certificate.Cache