USEFULL/drone
1
0
Fork 0
mirror of https://github.com/harness/drone.git synced 2025-05-31 11:43:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

add one more assumption to harness ACL client

Browse Source
This commit is contained in:
Johannes Batzill 2022-09-05 22:29:40 -07:00
parent 3b6f6b8916
commit 4545ffa666
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
internal/auth/authz/harness/authorizer.go
View File

@ -128,9 +128,13 @@ func checkAclResponse(permissionChecks []*types.PermissionCheck, responseDto acl
* We are assuming two things: * We are assuming two things:
* - All permission checks were made for the same principal. * - All permission checks were made for the same principal.
* - Permissions inherit down the hierarchy (Account -> Organization -> Project -> Repository) * - Permissions inherit down the hierarchy (Account -> Organization -> Project -> Repository)
* - No two checks are for the same permission - is similar to ff implementation:
* https://github.com/wings-software/ff-server/blob/master/pkg/rbac/client.go#L88
* *
* Based on that, if there's any permitted result for a permission check the permission is allowed. * Based on that, if there's any permitted result for a permission check the permission is allowed.
* Now we just have to ensure that all permissions are allowed * Now we just have to ensure that all permissions are allowed
*
* TODO: Use resource name + scope for verifying results.
*/ */
for _, check := range permissionChecks { for _, check := range permissionChecks {

9
internal/auth/authz/harness/types.go
View File

@ -26,10 +26,11 @@ type aclResponseData struct {
} }
type aclControlElement struct { type aclControlElement struct {
Permission string `json:"permission"` Permission string `json:"permission"`
ResourceScope aclResourceScope `json:"resourceScope,omitempty"` ResourceScope aclResourceScope `json:"resourceScope,omitempty"`
ResourceType string `json:"resourceType"` ResourceType string `json:"resourceType"`
Permitted bool `json:"permitted"` ResourceIdentifier string `json:"resourceIdentifier"`
Permitted bool `json:"permitted"`
} }
type aclResourceScope struct { type aclResourceScope struct {