auth

package
v6.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 31, 2024 License: Apache-2.0 Imports: 20 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// DriverTLS is the default TLS authorization driver. It is not compatible with OIDC or Candid authentication.
	DriverTLS string = "tls"

	// DriverOpenFGA provides fine-grained authorization. It is compatible with any authentication method.
	DriverOpenFGA string = "openfga"
)

Variables

View Source 
var ErrUnknownDriver = fmt.Errorf("Unknown driver")

ErrUnknownDriver is the "Unknown driver" error.

Functions

func WithConfig 

func WithConfig(c map[string]any) func(*Opts)

WithConfig can be passed into LoadAuthorizer to pass in driver specific configuration.

func WithProjectsGetFunc 

func WithProjectsGetFunc(f func(ctx context.Context) (map[int64]string, error)) func(*Opts)

WithProjectsGetFunc should be passed into LoadAuthorizer when DriverRBAC is used.

func WithResourcesFunc 

func WithResourcesFunc(f func() (*Resources, error)) func(*Opts)

WithResourcesFunc should be passed into LoadAuthorizer when DriverOpenFGA is used.

Types

type Authorizer 

type Authorizer interface {
	Driver() string
	StopService(ctx context.Context) error

	CheckPermission(ctx context.Context, r *http.Request, object Object, entitlement Entitlement) error
	GetPermissionChecker(ctx context.Context, r *http.Request, entitlement Entitlement, objectType ObjectType) (PermissionChecker, error)

	AddProject(ctx context.Context, projectID int64, projectName string) error
	DeleteProject(ctx context.Context, projectID int64, projectName string) error
	RenameProject(ctx context.Context, projectID int64, oldName string, newName string) error

	AddCertificate(ctx context.Context, fingerprint string) error
	DeleteCertificate(ctx context.Context, fingerprint string) error

	AddStoragePool(ctx context.Context, storagePoolName string) error
	DeleteStoragePool(ctx context.Context, storagePoolName string) error

	AddImage(ctx context.Context, projectName string, fingerprint string) error
	DeleteImage(ctx context.Context, projectName string, fingerprint string) error

	AddImageAlias(ctx context.Context, projectName string, imageAliasName string) error
	DeleteImageAlias(ctx context.Context, projectName string, imageAliasName string) error
	RenameImageAlias(ctx context.Context, projectName string, oldAliasName string, newAliasName string) error

	AddInstance(ctx context.Context, projectName string, instanceName string) error
	DeleteInstance(ctx context.Context, projectName string, instanceName string) error
	RenameInstance(ctx context.Context, projectName string, oldInstanceName string, newInstanceName string) error

	AddNetwork(ctx context.Context, projectName string, networkName string) error
	DeleteNetwork(ctx context.Context, projectName string, networkName string) error
	RenameNetwork(ctx context.Context, projectName string, oldNetworkName string, newNetworkName string) error

	AddNetworkZone(ctx context.Context, projectName string, networkZoneName string) error
	DeleteNetworkZone(ctx context.Context, projectName string, networkZoneName string) error

	AddNetworkIntegration(ctx context.Context, networkIntegrationName string) error
	DeleteNetworkIntegration(ctx context.Context, networkIntegrationName string) error
	RenameNetworkIntegration(ctx context.Context, oldNetworkIntegrationName string, newNetworkIntegrationName string) error

	AddNetworkACL(ctx context.Context, projectName string, networkACLName string) error
	DeleteNetworkACL(ctx context.Context, projectName string, networkACLName string) error
	RenameNetworkACL(ctx context.Context, projectName string, oldNetworkACLName string, newNetworkACLName string) error

	AddProfile(ctx context.Context, projectName string, profileName string) error
	DeleteProfile(ctx context.Context, projectName string, profileName string) error
	RenameProfile(ctx context.Context, projectName string, oldProfileName string, newProfileName string) error

	AddStoragePoolVolume(ctx context.Context, projectName string, storagePoolName string, storageVolumeType string, storageVolumeName string, storageVolumeLocation string) error
	DeleteStoragePoolVolume(ctx context.Context, projectName string, storagePoolName string, storageVolumeType string, storageVolumeName string, storageVolumeLocation string) error
	RenameStoragePoolVolume(ctx context.Context, projectName string, storagePoolName string, storageVolumeType string, oldStorageVolumeName string, newStorageVolumeName string, storageVolumeLocation string) error

	AddStorageBucket(ctx context.Context, projectName string, storagePoolName string, storageBucketName string, storageBucketLocation string) error
	DeleteStorageBucket(ctx context.Context, projectName string, storagePoolName string, storageBucketName string, storageBucketLocation string) error

	GetInstanceAccess(ctx context.Context, projectName string, instanceName string) (*api.Access, error)
	GetProjectAccess(ctx context.Context, projectName string) (*api.Access, error)
}

Authorizer is the primary external API for this package.

func LoadAuthorizer 

func LoadAuthorizer(ctx context.Context, driver string, logger logger.Logger, certificateCache *certificate.Cache, options ...func(opts *Opts)) (Authorizer, error)

LoadAuthorizer instantiates, configures, and initializes an Authorizer.

type Entitlement 

type Entitlement string

Entitlement is a type representation of a permission as it applies to a particular ObjectType. 

const (
	// Entitlements that apply to all resources.
	EntitlementCanEdit Entitlement = "can_edit"
	EntitlementCanView Entitlement = "can_view"

	// Server entitlements.
	EntitlementCanCreateStoragePools               Entitlement = "can_create_storage_pools"
	EntitlementCanCreateProjects                   Entitlement = "can_create_projects"
	EntitlementCanViewResources                    Entitlement = "can_view_resources"
	EntitlementCanCreateCertificates               Entitlement = "can_create_certificates"
	EntitlementCanViewMetrics                      Entitlement = "can_view_metrics"
	EntitlementCanOverrideClusterTargetRestriction Entitlement = "can_override_cluster_target_restriction"
	EntitlementCanViewPrivilegedEvents             Entitlement = "can_view_privileged_events"

	// Project entitlements.
	EntitlementCanCreateImages              Entitlement = "can_create_images"
	EntitlementCanCreateImageAliases        Entitlement = "can_create_image_aliases"
	EntitlementCanCreateInstances           Entitlement = "can_create_instances"
	EntitlementCanCreateNetworks            Entitlement = "can_create_networks"
	EntitlementCanCreateNetworkACLs         Entitlement = "can_create_network_acls"
	EntitlementCanCreateNetworkIntegrations Entitlement = "can_create_network_integrations"
	EntitlementCanCreateNetworkZones        Entitlement = "can_create_network_zones"
	EntitlementCanCreateProfiles            Entitlement = "can_create_profiles"
	EntitlementCanCreateStorageVolumes      Entitlement = "can_create_storage_volumes"
	EntitlementCanCreateStorageBuckets      Entitlement = "can_create_storage_buckets"
	EntitlementCanViewOperations            Entitlement = "can_view_operations"
	EntitlementCanViewEvents                Entitlement = "can_view_events"

	// Instance entitlements.
	EntitlementCanUpdateState   Entitlement = "can_update_state"
	EntitlementCanConnectSFTP   Entitlement = "can_connect_sftp"
	EntitlementCanAccessFiles   Entitlement = "can_access_files"
	EntitlementCanAccessConsole Entitlement = "can_access_console"
	EntitlementCanExec          Entitlement = "can_exec"

	// Instance and storage volume entitlements.
	EntitlementCanManageSnapshots Entitlement = "can_manage_snapshots"
	EntitlementCanManageBackups   Entitlement = "can_manage_backups"
)

type Object 

type Object string

Object is a string alias that represents an authorization object. These are formatted strings that uniquely identify an API resource, and can be constructed/deconstructed reliably. An Object is always of the form <ObjectType>:<identifier> where the identifier is a "/" delimited path containing elements that uniquely identify a resource. If the resource is defined at the project level, the first element of this path is always the project. Some example objects would be:

  • `instance:default/c1`: Instance object in project "default" and name "c1".
  • `storage_pool:local`: Storage pool object with name "local".
  • `storage_volume:default/local/custom/vol1`: Storage volume object in project "default", storage pool "local", type "custom", and name "vol1".

func NewObject 

func NewObject(objectType ObjectType, projectName string, identifierElements ...string) (Object, error)

NewObject returns an Object of the given type. The passed in arguments must be in the correct order (as found in the URL for the resource). This function will error if an invalid object type is given, or if the correct number of arguments is not passed in.

func ObjectCertificate 

func ObjectCertificate(fingerprint string) Object

ObjectCertificate represents a certificate.

func ObjectFromRequest 

func ObjectFromRequest(r *http.Request, objectType ObjectType, expandProject func(string) string, expandFingerprint func(string, string) string, muxVars ...string) (Object, error)

ObjectFromRequest returns an object created from the request by evaluating the given mux vars. Mux vars must be provided in the order that they are found in the endpoint path. If the object requires a project name, this is taken from the project query parameter unless the URL begins with /1.0/projects.

func ObjectFromString 

func ObjectFromString(objectstr string) (Object, error)

ObjectFromString parses a string into an Object. It returns an error if the string is not valid.

func ObjectImage 

func ObjectImage(projectName string, imageFingerprint string) Object

ObjectImage represents an image.

func ObjectImageAlias 

func ObjectImageAlias(projectName string, aliasName string) Object

ObjectImageAlias represents an image alias.

func ObjectInstance 

func ObjectInstance(projectName string, instanceName string) Object

ObjectInstance represents an instance.

func ObjectNetwork 

func ObjectNetwork(projectName string, networkName string) Object

ObjectNetwork represents a network.

func ObjectNetworkACL 

func ObjectNetworkACL(projectName string, networkACLName string) Object

ObjectNetworkACL represents a network ACL.

func ObjectNetworkIntegration 

func ObjectNetworkIntegration(networkIntegrationName string) Object

ObjectNetworkIntegration represents a network integration.

func ObjectNetworkZone 

func ObjectNetworkZone(projectName string, networkZoneName string) Object

ObjectNetworkZone represents a network zone.

func ObjectProfile 

func ObjectProfile(projectName string, profileName string) Object

ObjectProfile represents a profile.

func ObjectProject 

func ObjectProject(projectName string) Object

ObjectProject represents a project.

func ObjectServer 

func ObjectServer() Object

ObjectServer represents a server.

func ObjectStorageBucket 

func ObjectStorageBucket(projectName string, poolName string, bucketName string, location string) Object

ObjectStorageBucket represents a storage bucket.

func ObjectStoragePool 

func ObjectStoragePool(storagePoolName string) Object

ObjectStoragePool represents a storage pool.

func ObjectStorageVolume 

func ObjectStorageVolume(projectName string, poolName string, volumeType string, volumeName string, location string) Object

ObjectStorageVolume represents a storage volume.

func ObjectUser 

func ObjectUser(userName string) Object

ObjectUser represents a user.

func (Object) Elements 

func (o Object) Elements() []string

Elements returns the elements that uniquely identify the authorization Object.

func (Object) Project 

func (o Object) Project() string

Project returns the project of the Object if present.

func (Object) String 

func (o Object) String() string

String implements fmt.Stringer for Object.

func (Object) Type 

func (o Object) Type() ObjectType

Type returns the ObjectType of the Object.

type ObjectType 

type ObjectType string

ObjectType is a type of resource within Incus. 

const (
	// ObjectTypeUser represents a user.
	ObjectTypeUser ObjectType = "user"

	// ObjectTypeServer represents a server.
	ObjectTypeServer ObjectType = "server"

	// ObjectTypeCertificate represents a certificate.
	ObjectTypeCertificate ObjectType = "certificate"

	// ObjectTypeStoragePool represents a storage pool.
	ObjectTypeStoragePool ObjectType = "storage_pool"

	// ObjectTypeProject represents a project.
	ObjectTypeProject ObjectType = "project"

	// ObjectTypeImage represents an image.
	ObjectTypeImage ObjectType = "image"

	// ObjectTypeImageAlias represents an image alias.
	ObjectTypeImageAlias ObjectType = "image_alias"

	// ObjectTypeInstance represents an instance.
	ObjectTypeInstance ObjectType = "instance"

	// ObjectTypeNetwork represents a network.
	ObjectTypeNetwork ObjectType = "network"

	// ObjectTypeNetworkACL represents a network ACL.
	ObjectTypeNetworkACL ObjectType = "network_acl"

	// ObjectTypeNetworkIntegration represents a network integration.
	ObjectTypeNetworkIntegration ObjectType = "network_integration"

	// ObjectTypeNetworkZone represents a network zone.
	ObjectTypeNetworkZone ObjectType = "network_zone"

	// ObjectTypeProfile represents a profile.
	ObjectTypeProfile ObjectType = "profile"

	// ObjectTypeStorageBucket represents a storage bucket.
	ObjectTypeStorageBucket ObjectType = "storage_bucket"

	// ObjectTypeStorageVolume represents a storage volume.
	ObjectTypeStorageVolume ObjectType = "storage_volume"
)

type Opts 

type Opts struct {
	// contains filtered or unexported fields
}

Opts is used as part of the LoadAuthorizer function so that only the relevant configuration fields are passed into a particular driver.

type PermissionChecker 

type PermissionChecker func(object Object) bool

PermissionChecker is a type alias for a function that returns whether a user has required permissions on an object. It is returned by Authorizer.GetPermissionChecker.

type Resources 

type Resources struct {
	CertificateObjects       []Object
	StoragePoolObjects       []Object
	ProjectObjects           []Object
	ImageObjects             []Object
	ImageAliasObjects        []Object
	InstanceObjects          []Object
	NetworkObjects           []Object
	NetworkACLObjects        []Object
	NetworkZoneObjects       []Object
	ProfileObjects           []Object
	StoragePoolVolumeObjects []Object
	StorageBucketObjects     []Object
}

Resources represents a set of current API resources as Object slices for use when loading an Authorizer.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.