@@ -13,6 +13,7 @@ import (
1313
1414 "github.com/gaia-pipeline/gaia"
1515 "github.com/gaia-pipeline/gaia/helper/rolehelper"
16+ "github.com/gaia-pipeline/gaia/security/rbac"
1617)
1718
1819var (
3839 }
3940)
4041
41- // AuthContext is the wrapped context to pass through the echo handlers and middleware. This allows us to bind the user
42- // RBAC policy names into the server request context.
43- type AuthContext struct {
44- echo.Context
45- username string
46- policies map [string ]interface {}
47- }
48-
49- // AuthMiddleware is middleware used for each request. Includes functionality that validates the JWT tokens and user
42+ // Do is middleware used for each request. Includes functionality that validates the JWT tokens and user
5043// permissions.
51- func AuthMiddleware ( roleAuth * AuthConfig ) echo.MiddlewareFunc {
44+ func ( a * AuthMiddleware ) Do ( ) echo.MiddlewareFunc {
5245 return func (next echo.HandlerFunc ) echo.HandlerFunc {
5346 return func (c echo.Context ) error {
5447 // Check if it matches an explicit paths
@@ -82,49 +75,94 @@ func AuthMiddleware(roleAuth *AuthConfig) echo.MiddlewareFunc {
8275 policies , okPolicies := claims ["policies" ]
8376 if okUsername && okPerms && okPolicies && roles != nil {
8477 // Look through the perms until we find that the user has this permission
85- err := roleAuth .checkRole (roles , c .Request ().Method , c .Path ())
86- if err != nil {
87- return c .String (http .StatusForbidden , fmt .Sprintf ("Permission denied for user %s. %s" , username , err .Error ()))
78+ if err := a .checkRole (roles , c .Request ().Method , c .Path ()); err != nil {
79+ return c .String (http .StatusForbidden , fmt .Sprintf ("Permission denied for user %s: %s" , username , err .Error ()))
8880 }
8981
90- policiesFromClaims , err := getPoliciesFromClaims (policies )
91- if err != nil {
92- return c .String (http .StatusForbidden , fmt .Sprintf ("Permission denied for user %s. %s" , username , err .Error ()))
82+ if err := a .enforceRBAC (c , username .(string ), policies ); err != nil {
83+ return c .String (http .StatusForbidden , fmt .Sprintf ("Permission denied for user %s: %s" , username , err .Error ()))
9384 }
9485
95- ctx := AuthContext {
96- Context : c ,
97- username : username .(string ),
98- policies : policiesFromClaims ,
99- }
100- return next (ctx )
86+ return next (c )
10187 }
10288 }
10389 return c .String (http .StatusUnauthorized , errNotAuthorized .Error ())
10490 }
10591 }
10692}
10793
108- // AuthConfig is a simple config struct to be passed into AuthMiddleware. Currently allows the ability to specify
94+ func (a * AuthMiddleware ) enforceRBAC (c echo.Context , username string , policiesFromClaims interface {}) error {
95+ policies , err := getPoliciesFromClaims (policiesFromClaims )
96+ if err != nil {
97+ gaia .Cfg .Logger .Warn ("rbac enforcement failed" , "error" , err .Error (), "username" , username )
98+ return errors .New ("failed to get policies" )
99+ }
100+
101+ group := a .rbacEnforcer .GetDefaultAPIGroup ()
102+
103+ endpoint , ok := group .Endpoints [c .Path ()]
104+ if ! ok {
105+ gaia .Cfg .Logger .Warn ("path not mapped to api group" , "path" , c .Path ())
106+ return nil
107+ }
108+
109+ perm , ok := endpoint .Methods [c .Request ().Method ]
110+ if ! ok {
111+ gaia .Cfg .Logger .Warn ("method not mapped to api group path" , "path" , c .Path (), "method" , c .Request ().Method )
112+ return nil
113+ }
114+
115+ ns , act := rbac .ParseStatementAction (perm )
116+
117+ fullResource := ""
118+ if endpoint .Param != "" {
119+ param := c .Param (endpoint .Param )
120+ if param == "" {
121+ return fmt .Errorf ("param %s missing" , endpoint .Param )
122+ }
123+ fullResource = fmt .Sprintf ("%s/%s/%s" , ns , endpoint .Param , param )
124+ }
125+
126+ enfCfg := rbac.EnforcerConfig {
127+ User : rbac.User {
128+ Username : username ,
129+ Policies : policies ,
130+ },
131+ Namespace : ns ,
132+ Action : act ,
133+ Resource : gaia .RBACPolicyResource (fullResource ),
134+ }
135+
136+ if err := a .rbacEnforcer .Enforce (enfCfg ); err != nil {
137+ gaia .Cfg .Logger .Warn ("rbac enforcement failed" , "error" , err .Error (), "username" , username , "namespace" , ns , "action" , act )
138+ return fmt .Errorf ("missing required permission %s/%s" , ns , act )
139+ }
140+
141+ return nil
142+ }
143+
144+ // AuthMiddleware is a simple config struct to be passed into AuthMiddleware. Currently allows the ability to specify
109145// the permission roles required for each echo endpoint.
110- type AuthConfig struct {
146+ type AuthMiddleware struct {
111147 RoleCategories []* gaia.UserRoleCategory
148+ rbacEnforcer rbac.PolicyEnforcer
112149}
113150
114151func getPoliciesFromClaims (policyClaims interface {}) (map [string ]interface {}, error ) {
115152 if policyClaims == nil || reflect .ValueOf (policyClaims ).IsNil () {
116- return nil , errors .New ("nil policyClaims" )
153+ return nil , errors .New ("policyClaims is nil " )
117154 }
118- if _ , ok := policyClaims .(map [string ]interface {}); ! ok {
155+ pc , ok := policyClaims .(map [string ]interface {})
156+ if ! ok {
119157 return nil , errors .New ("policyClaims is not correct type" )
120158 }
121- return policyClaims .( map [ string ] interface {}) , nil
159+ return pc , nil
122160}
123161
124162// Finds the required role for the metho & path specified. If it exists we validate that the provided user roles have
125163// the permission role. If not, error specifying the required role.
126- func (ra * AuthConfig ) checkRole (userRoles interface {}, method , path string ) error {
127- perm := ra .getRequiredRole (method , path )
164+ func (a * AuthMiddleware ) checkRole (userRoles interface {}, method , path string ) error {
165+ perm := a .getRequiredRole (method , path )
128166 if perm == "" {
129167 return nil
130168 }
@@ -137,8 +175,8 @@ func (ra *AuthConfig) checkRole(userRoles interface{}, method, path string) erro
137175}
138176
139177// Iterate over each category to find a permission (if existing) for this API endpoint.
140- func (ra * AuthConfig ) getRequiredRole (method , path string ) string {
141- for _ , category := range ra .RoleCategories {
178+ func (a * AuthMiddleware ) getRequiredRole (method , path string ) string {
179+ for _ , category := range a .RoleCategories {
142180 for _ , role := range category .Roles {
143181 for _ , endpoint := range role .APIEndpoint {
144182 // If the http method & path match then return the role required for this endpoint
0 commit comments