Skip to content

Commit c983121

Browse files
smarterclaytonsmarterclayton
committed
Rename AuthorizationAttributes -> Action
Allows conversions to be automatically generated, and the name is not externally visible.
1 parent 07c9f15 commit c983121

File tree

45 files changed

+157
-218
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+157
-218
lines changed

‎pkg/authorization/api/types.go

+6-6
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ type ResourceAccessReview struct {
189189
unversioned.TypeMeta
190190

191191
// Action describes the action being tested
192-
Action AuthorizationAttributes
192+
Action
193193
}
194194

195195
// SubjectAccessReviewResponse describes whether or not a user or group can perform an action
@@ -209,7 +209,7 @@ type SubjectAccessReview struct {
209209
unversioned.TypeMeta
210210

211211
// Action describes the action being tested
212-
Action AuthorizationAttributes
212+
Action
213213
// User is optional. If both User and Groups are empty, the current authenticated user is used.
214214
User string
215215
// Groups is optional. Groups is the list of groups to which the User belongs.
@@ -226,15 +226,15 @@ type LocalResourceAccessReview struct {
226226
unversioned.TypeMeta
227227

228228
// Action describes the action being tested
229-
Action AuthorizationAttributes
229+
Action
230230
}
231231

232232
// LocalSubjectAccessReview is an object for requesting information about whether a user or group can perform an action in a particular namespace
233233
type LocalSubjectAccessReview struct {
234234
unversioned.TypeMeta
235235

236236
// Action describes the action being tested. The Namespace element is FORCED to the current namespace.
237-
Action AuthorizationAttributes
237+
Action
238238
// User is optional. If both User and Groups are empty, the current authenticated user is used.
239239
User string
240240
// Groups is optional. Groups is the list of groups to which the User belongs.
@@ -246,8 +246,8 @@ type LocalSubjectAccessReview struct {
246246
Scopes []string
247247
}
248248

249-
// AuthorizationAttributes describes a request to be authorized
250-
type AuthorizationAttributes struct {
249+
// Action describes a request to be authorized
250+
type Action struct {
251251
// Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces
252252
Namespace string
253253
// Verb is one of: get, list, watch, create, update, delete

‎pkg/authorization/api/v1/conversion.go

+6-67
Original file line numberDiff line numberDiff line change
@@ -13,115 +13,54 @@ import (
1313
uservalidation "github.com/openshift/origin/pkg/user/api/validation"
1414
)
1515

16-
func Convert_v1_ResourceAccessReview_To_api_ResourceAccessReview(in *ResourceAccessReview, out *newer.ResourceAccessReview, s conversion.Scope) error {
17-
if err := s.DefaultConvert(in, out, conversion.IgnoreMissingFields); err != nil {
18-
return err
19-
}
20-
if err := s.DefaultConvert(&in.AuthorizationAttributes, &out.Action, conversion.IgnoreMissingFields); err != nil {
21-
return err
22-
}
23-
24-
return nil
25-
}
26-
27-
func Convert_api_ResourceAccessReview_To_v1_ResourceAccessReview(in *newer.ResourceAccessReview, out *ResourceAccessReview, s conversion.Scope) error {
28-
if err := s.DefaultConvert(in, out, conversion.IgnoreMissingFields); err != nil {
29-
return err
30-
}
31-
if err := s.DefaultConvert(&in.Action, &out.AuthorizationAttributes, conversion.IgnoreMissingFields); err != nil {
32-
return err
33-
}
34-
35-
return nil
36-
}
37-
38-
func Convert_v1_LocalResourceAccessReview_To_api_LocalResourceAccessReview(in *LocalResourceAccessReview, out *newer.LocalResourceAccessReview, s conversion.Scope) error {
39-
if err := s.DefaultConvert(in, out, conversion.IgnoreMissingFields); err != nil {
40-
return err
41-
}
42-
if err := s.DefaultConvert(&in.AuthorizationAttributes, &out.Action, conversion.IgnoreMissingFields); err != nil {
43-
return err
44-
}
45-
46-
return nil
47-
}
48-
49-
func Convert_api_LocalResourceAccessReview_To_v1_LocalResourceAccessReview(in *newer.LocalResourceAccessReview, out *LocalResourceAccessReview, s conversion.Scope) error {
50-
if err := s.DefaultConvert(in, out, conversion.IgnoreMissingFields); err != nil {
51-
return err
52-
}
53-
if err := s.DefaultConvert(&in.Action, &out.AuthorizationAttributes, conversion.IgnoreMissingFields); err != nil {
54-
return err
55-
}
56-
57-
return nil
58-
}
59-
6016
func Convert_v1_SubjectAccessReview_To_api_SubjectAccessReview(in *SubjectAccessReview, out *newer.SubjectAccessReview, s conversion.Scope) error {
61-
if err := s.DefaultConvert(in, out, conversion.IgnoreMissingFields); err != nil {
62-
return err
63-
}
64-
if err := s.DefaultConvert(&in.AuthorizationAttributes, &out.Action, conversion.IgnoreMissingFields); err != nil {
17+
if err := autoConvert_v1_SubjectAccessReview_To_api_SubjectAccessReview(in, out, s); err != nil {
6518
return err
6619
}
6720

6821
out.Groups = sets.NewString(in.GroupsSlice...)
69-
7022
return nil
7123
}
7224

7325
func Convert_api_SubjectAccessReview_To_v1_SubjectAccessReview(in *newer.SubjectAccessReview, out *SubjectAccessReview, s conversion.Scope) error {
74-
if err := s.DefaultConvert(in, out, conversion.IgnoreMissingFields); err != nil {
75-
return err
76-
}
77-
if err := s.DefaultConvert(&in.Action, &out.AuthorizationAttributes, conversion.IgnoreMissingFields); err != nil {
26+
if err := autoConvert_api_SubjectAccessReview_To_v1_SubjectAccessReview(in, out, s); err != nil {
7827
return err
7928
}
8029

8130
out.GroupsSlice = in.Groups.List()
82-
8331
return nil
8432
}
8533

8634
func Convert_v1_LocalSubjectAccessReview_To_api_LocalSubjectAccessReview(in *LocalSubjectAccessReview, out *newer.LocalSubjectAccessReview, s conversion.Scope) error {
87-
if err := s.DefaultConvert(in, out, conversion.IgnoreMissingFields); err != nil {
88-
return err
89-
}
90-
if err := s.DefaultConvert(&in.AuthorizationAttributes, &out.Action, conversion.IgnoreMissingFields); err != nil {
35+
if err := autoConvert_v1_LocalSubjectAccessReview_To_api_LocalSubjectAccessReview(in, out, s); err != nil {
9136
return err
9237
}
9338

9439
out.Groups = sets.NewString(in.GroupsSlice...)
95-
9640
return nil
9741
}
9842

9943
func Convert_api_LocalSubjectAccessReview_To_v1_LocalSubjectAccessReview(in *newer.LocalSubjectAccessReview, out *LocalSubjectAccessReview, s conversion.Scope) error {
100-
if err := s.DefaultConvert(in, out, conversion.IgnoreMissingFields); err != nil {
101-
return err
102-
}
103-
if err := s.DefaultConvert(&in.Action, &out.AuthorizationAttributes, conversion.IgnoreMissingFields); err != nil {
44+
if err := autoConvert_api_LocalSubjectAccessReview_To_v1_LocalSubjectAccessReview(in, out, s); err != nil {
10445
return err
10546
}
10647

10748
out.GroupsSlice = in.Groups.List()
108-
10949
return nil
11050
}
11151

11252
func Convert_v1_ResourceAccessReviewResponse_To_api_ResourceAccessReviewResponse(in *ResourceAccessReviewResponse, out *newer.ResourceAccessReviewResponse, s conversion.Scope) error {
113-
if err := s.DefaultConvert(in, out, conversion.IgnoreMissingFields); err != nil {
53+
if err := autoConvert_v1_ResourceAccessReviewResponse_To_api_ResourceAccessReviewResponse(in, out, s); err != nil {
11454
return err
11555
}
11656

11757
out.Users = sets.NewString(in.UsersSlice...)
11858
out.Groups = sets.NewString(in.GroupsSlice...)
119-
12059
return nil
12160
}
12261

12362
func Convert_api_ResourceAccessReviewResponse_To_v1_ResourceAccessReviewResponse(in *newer.ResourceAccessReviewResponse, out *ResourceAccessReviewResponse, s conversion.Scope) error {
124-
if err := s.DefaultConvert(in, out, conversion.IgnoreMissingFields); err != nil {
63+
if err := autoConvert_api_ResourceAccessReviewResponse_To_v1_ResourceAccessReviewResponse(in, out, s); err != nil {
12564
return err
12665
}
12766

‎pkg/authorization/api/v1/swagger_doc.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ package v1
55
// by hack/update-generated-swagger-descriptions.sh and should be run after a full build of OpenShift.
66
// ==== DO NOT EDIT THIS FILE MANUALLY ====
77

8-
var map_AuthorizationAttributes = map[string]string{
9-
"": "AuthorizationAttributes describes a request to the API server",
8+
var map_Action = map[string]string{
9+
"": "Action describes a request to the API server",
1010
"namespace": "Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces",
1111
"verb": "Verb is one of: get, list, watch, create, update, delete",
1212
"resourceAPIGroup": "Group is the API group of the resource Serialized as resourceAPIGroup to avoid confusion with the 'groups' field when inlined",
@@ -16,8 +16,8 @@ var map_AuthorizationAttributes = map[string]string{
1616
"content": "Content is the actual content of the request for create and update",
1717
}
1818

19-
func (AuthorizationAttributes) SwaggerDoc() map[string]string {
20-
return map_AuthorizationAttributes
19+
func (Action) SwaggerDoc() map[string]string {
20+
return map_Action
2121
}
2222

2323
var map_ClusterPolicy = map[string]string{

‎pkg/authorization/api/v1/types.go

+10-10
Original file line numberDiff line numberDiff line change
@@ -173,8 +173,8 @@ type ResourceAccessReviewResponse struct {
173173
type ResourceAccessReview struct {
174174
unversioned.TypeMeta `json:",inline"`
175175

176-
// AuthorizationAttributes describes the action being tested.
177-
AuthorizationAttributes `json:",inline" protobuf:"bytes,1,opt,name=authorizationAttributes"`
176+
// Action describes the action being tested.
177+
Action `json:",inline" protobuf:"bytes,1,opt,name=Action"`
178178
}
179179

180180
// SubjectAccessReviewResponse describes whether or not a user or group can perform an action
@@ -197,8 +197,8 @@ type OptionalScopes []string
197197
type SubjectAccessReview struct {
198198
unversioned.TypeMeta `json:",inline"`
199199

200-
// AuthorizationAttributes describes the action being tested.
201-
AuthorizationAttributes `json:",inline" protobuf:"bytes,1,opt,name=authorizationAttributes"`
200+
// Action describes the action being tested.
201+
Action `json:",inline" protobuf:"bytes,1,opt,name=Action"`
202202
// User is optional. If both User and Groups are empty, the current authenticated user is used.
203203
User string `json:"user" protobuf:"bytes,2,opt,name=user"`
204204
// GroupsSlice is optional. Groups is the list of groups to which the User belongs.
@@ -214,16 +214,16 @@ type SubjectAccessReview struct {
214214
type LocalResourceAccessReview struct {
215215
unversioned.TypeMeta `json:",inline"`
216216

217-
// AuthorizationAttributes describes the action being tested. The Namespace element is FORCED to the current namespace.
218-
AuthorizationAttributes `json:",inline" protobuf:"bytes,1,opt,name=authorizationAttributes"`
217+
// Action describes the action being tested. The Namespace element is FORCED to the current namespace.
218+
Action `json:",inline" protobuf:"bytes,1,opt,name=Action"`
219219
}
220220

221221
// LocalSubjectAccessReview is an object for requesting information about whether a user or group can perform an action in a particular namespace
222222
type LocalSubjectAccessReview struct {
223223
unversioned.TypeMeta `json:",inline"`
224224

225-
// AuthorizationAttributes describes the action being tested. The Namespace element is FORCED to the current namespace.
226-
AuthorizationAttributes `json:",inline" protobuf:"bytes,1,opt,name=authorizationAttributes"`
225+
// Action describes the action being tested. The Namespace element is FORCED to the current namespace.
226+
Action `json:",inline" protobuf:"bytes,1,opt,name=Action"`
227227
// User is optional. If both User and Groups are empty, the current authenticated user is used.
228228
User string `json:"user" protobuf:"bytes,2,opt,name=user"`
229229
// Groups is optional. Groups is the list of groups to which the User belongs.
@@ -235,8 +235,8 @@ type LocalSubjectAccessReview struct {
235235
Scopes OptionalScopes `json:"scopes" protobuf:"bytes,4,rep,name=scopes"`
236236
}
237237

238-
// AuthorizationAttributes describes a request to the API server
239-
type AuthorizationAttributes struct {
238+
// Action describes a request to the API server
239+
type Action struct {
240240
// Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces
241241
Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
242242
// Verb is one of: get, list, watch, create, update, delete

‎pkg/authorization/authorizer/adapter/attributes.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ type AdapterAttributes struct {
1717
namespace string
1818
userName string
1919
groups []string
20-
authorizationAttributes oauthorizer.AuthorizationAttributes
20+
authorizationAttributes oauthorizer.Action
2121
}
2222

2323
// OriginAuthorizerAttributes adapts Kubernetes authorization attributes to Origin authorization attributes
2424
// Note that some info (like resourceName, apiVersion, apiGroup) is not available from the Kubernetes attributes
25-
func OriginAuthorizerAttributes(kattrs kauthorizer.Attributes) (kapi.Context, oauthorizer.AuthorizationAttributes) {
25+
func OriginAuthorizerAttributes(kattrs kauthorizer.Attributes) (kapi.Context, oauthorizer.Action) {
2626
// Build a context to hold the namespace and user info
2727
ctx := kapi.NewContext()
2828
ctx = kapi.WithNamespace(ctx, kattrs.GetNamespace())
@@ -59,7 +59,7 @@ func OriginAuthorizerAttributes(kattrs kauthorizer.Attributes) (kapi.Context, oa
5959

6060
// KubernetesAuthorizerAttributes adapts Origin authorization attributes to Kubernetes authorization attributes
6161
// The returned attributes can be passed to OriginAuthorizerAttributes to access extra information from the Origin attributes interface
62-
func KubernetesAuthorizerAttributes(namespace string, userName string, groups []string, oattrs oauthorizer.AuthorizationAttributes) kauthorizer.Attributes {
62+
func KubernetesAuthorizerAttributes(namespace string, userName string, groups []string, oattrs oauthorizer.Action) kauthorizer.Attributes {
6363
return AdapterAttributes{
6464
namespace: namespace,
6565
userName: userName,

‎pkg/authorization/authorizer/adapter/attributes_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ func TestAttributeIntersection(t *testing.T) {
112112
)
113113

114114
kattributesType := reflect.TypeOf((*kauthorizer.Attributes)(nil)).Elem()
115-
oattributesType := reflect.TypeOf((*oauthorizer.AuthorizationAttributes)(nil)).Elem()
115+
oattributesType := reflect.TypeOf((*oauthorizer.Action)(nil)).Elem()
116116

117117
kattributesMethods := sets.NewString()
118118
for i := 0; i < kattributesType.NumMethod(); i++ {

‎pkg/authorization/authorizer/attributes.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ type DefaultAuthorizationAttributes struct {
2121
URL string
2222
}
2323

24-
// ToDefaultAuthorizationAttributes coerces AuthorizationAttributes to DefaultAuthorizationAttributes. Namespace is not included
24+
// ToDefaultAuthorizationAttributes coerces Action to DefaultAuthorizationAttributes. Namespace is not included
2525
// because the authorizer takes that information on the context
26-
func ToDefaultAuthorizationAttributes(in authorizationapi.AuthorizationAttributes) DefaultAuthorizationAttributes {
26+
func ToDefaultAuthorizationAttributes(in authorizationapi.Action) DefaultAuthorizationAttributes {
2727
return DefaultAuthorizationAttributes{
2828
Verb: in.Verb,
2929
APIGroup: in.Group,
@@ -136,8 +136,8 @@ func splitPath(thePath string) []string {
136136
return strings.Split(thePath, "/")
137137
}
138138

139-
// DefaultAuthorizationAttributes satisfies the AuthorizationAttributes interface
140-
var _ AuthorizationAttributes = DefaultAuthorizationAttributes{}
139+
// DefaultAuthorizationAttributes satisfies the Action interface
140+
var _ Action = DefaultAuthorizationAttributes{}
141141

142142
func (a DefaultAuthorizationAttributes) GetAPIVersion() string {
143143
return a.APIVersion

‎pkg/authorization/authorizer/attributes_builder.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ func NewAuthorizationAttributeBuilder(contextMapper kapi.RequestContextMapper, i
1616
return &openshiftAuthorizationAttributeBuilder{contextMapper, infoResolver}
1717
}
1818

19-
func (a *openshiftAuthorizationAttributeBuilder) GetAttributes(req *http.Request) (AuthorizationAttributes, error) {
19+
func (a *openshiftAuthorizationAttributeBuilder) GetAttributes(req *http.Request) (Action, error) {
2020
requestInfo, err := a.infoResolver.GetRequestInfo(req)
2121
if err != nil {
2222
return nil, err

‎pkg/authorization/authorizer/attributes_test.go

+7-7
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,13 @@ import (
77
)
88

99
func TestAuthorizationAttributes(t *testing.T) {
10-
// Wrapper to make sure additions to the AuthorizationAttributes interface get corresponding fields added in api.AuthorizationAttributes
11-
// If an additional function is required to satisfy this interface, the data for it should come from the contained authorizationapi.AuthorizationAttributes
12-
var _ AuthorizationAttributes = authorizationAttributesAdapter{}
10+
// Wrapper to make sure additions to the Action interface get corresponding fields added in api.Action
11+
// If an additional function is required to satisfy this interface, the data for it should come from the contained authorizationapi.Action
12+
var _ Action = authorizationAttributesAdapter{}
1313
}
1414

1515
type authorizationAttributesAdapter struct {
16-
attrs authorizationapi.AuthorizationAttributes
16+
attrs authorizationapi.Action
1717
}
1818

1919
func (a authorizationAttributesAdapter) GetVerb() string {
@@ -37,17 +37,17 @@ func (a authorizationAttributesAdapter) GetResourceName() string {
3737
}
3838

3939
func (a authorizationAttributesAdapter) GetRequestAttributes() interface{} {
40-
// AuthorizationAttributes doesn't currently support request attributes,
40+
// Action doesn't currently support request attributes,
4141
// because they cannot be reliably serialized
4242
return nil
4343
}
4444

4545
func (a authorizationAttributesAdapter) IsNonResourceURL() bool {
46-
// AuthorizationAttributes currently only supports resource authorization checks
46+
// Action currently only supports resource authorization checks
4747
return false
4848
}
4949

5050
func (a authorizationAttributesAdapter) GetURL() string {
51-
// AuthorizationAttributes currently only supports resource authorization checks
51+
// Action currently only supports resource authorization checks
5252
return ""
5353
}

‎pkg/authorization/authorizer/authorizer.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ func NewAuthorizer(ruleResolver rulevalidation.AuthorizationRuleResolver, forbid
1818
return &openshiftAuthorizer{ruleResolver, forbiddenMessageMaker}
1919
}
2020

21-
func (a *openshiftAuthorizer) Authorize(ctx kapi.Context, passedAttributes AuthorizationAttributes) (bool, string, error) {
21+
func (a *openshiftAuthorizer) Authorize(ctx kapi.Context, passedAttributes Action) (bool, string, error) {
2222
attributes := CoerceToDefaultAuthorizationAttributes(passedAttributes)
2323

2424
// keep track of errors in case we are unable to authorize the action.
@@ -63,7 +63,7 @@ func (a *openshiftAuthorizer) Authorize(ctx kapi.Context, passedAttributes Autho
6363
// If we got an error, then the list of subjects may not be complete, but it does not contain any incorrect names.
6464
// This is done because policy rules are purely additive and policy determinations
6565
// can be made on the basis of those rules that are found.
66-
func (a *openshiftAuthorizer) GetAllowedSubjects(ctx kapi.Context, attributes AuthorizationAttributes) (sets.String, sets.String, error) {
66+
func (a *openshiftAuthorizer) GetAllowedSubjects(ctx kapi.Context, attributes Action) (sets.String, sets.String, error) {
6767
errs := []error{}
6868

6969
masterContext := kapi.WithNamespace(ctx, kapi.NamespaceNone)
@@ -87,7 +87,7 @@ func (a *openshiftAuthorizer) GetAllowedSubjects(ctx kapi.Context, attributes Au
8787
return users, groups, kerrors.NewAggregate(errs)
8888
}
8989

90-
func (a *openshiftAuthorizer) getAllowedSubjectsFromNamespaceBindings(ctx kapi.Context, passedAttributes AuthorizationAttributes) (sets.String, sets.String, error) {
90+
func (a *openshiftAuthorizer) getAllowedSubjectsFromNamespaceBindings(ctx kapi.Context, passedAttributes Action) (sets.String, sets.String, error) {
9191
attributes := CoerceToDefaultAuthorizationAttributes(passedAttributes)
9292

9393
errs := []error{}
@@ -129,7 +129,7 @@ func (a *openshiftAuthorizer) getAllowedSubjectsFromNamespaceBindings(ctx kapi.C
129129
// authorizeWithNamespaceRules returns isAllowed, reason, and error. If an error is returned, isAllowed and reason are still valid. This seems strange
130130
// but errors are not always fatal to the authorization process. It is entirely possible to get an error and be able to continue determine authorization
131131
// status in spite of it. This is most common when a bound role is missing, but enough roles are still present and bound to authorize the request.
132-
func (a *openshiftAuthorizer) authorizeWithNamespaceRules(ctx kapi.Context, passedAttributes AuthorizationAttributes) (bool, string, error) {
132+
func (a *openshiftAuthorizer) authorizeWithNamespaceRules(ctx kapi.Context, passedAttributes Action) (bool, string, error) {
133133
attributes := CoerceToDefaultAuthorizationAttributes(passedAttributes)
134134

135135
allRules, ruleRetrievalError := a.ruleResolver.GetEffectivePolicyRules(ctx)
@@ -153,7 +153,7 @@ func (a *openshiftAuthorizer) authorizeWithNamespaceRules(ctx kapi.Context, pass
153153

154154
// TODO this may or may not be the behavior we want for managing rules. As a for instance, a verb might be specified
155155
// that our attributes builder will never satisfy. For now, I think gets us close. Maybe a warning message of some kind?
156-
func CoerceToDefaultAuthorizationAttributes(passedAttributes AuthorizationAttributes) *DefaultAuthorizationAttributes {
156+
func CoerceToDefaultAuthorizationAttributes(passedAttributes Action) *DefaultAuthorizationAttributes {
157157
attributes, ok := passedAttributes.(*DefaultAuthorizationAttributes)
158158
if !ok {
159159
attributes = &DefaultAuthorizationAttributes{

0 commit comments

Comments
 (0)