opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-10-29 17:58:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: refine policy match conditions

Browse Source
This commit is contained in:
Qiu Jian
2019-03-21 10:16:55 +08:00
parent 9d966e9959
commit cc30b585e0
2 changed files with 24 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/util/rbacutils/rabc.go
+3 -6
View File
@@ -437,13 +437,10 @@ func intersect(s1 []string, s2 []string) bool {
}
func (policy *SRbacPolicy) Match(userCred mcclient.TokenCredential) bool {
if len(policy.Projects) > 0 && userCred != nil && !contains(policy.Projects, userCred.GetProjectName()) {
return false
if (len(policy.Projects) == 0 || (userCred != nil && contains(policy.Projects, userCred.GetProjectName()))) && (len(policy.Roles) == 0 || (userCred != nil && intersect(policy.Roles, userCred.GetRoles()))) {
return true
}
if len(policy.Roles) > 0 && userCred != nil && !intersect(policy.Roles, userCred.GetRoles()) {
return false
}
return true
return false
}
func (policy *SRbacPolicy) Allow(userCred mcclient.TokenCredential, service, resource, action string, extra ...string) TRbacResult {
pkg/util/rbacutils/rabc_test.go
+21 -8
View File
@@ -240,19 +240,24 @@ func TestConditionParser(t *testing.T) {
func TestSRbacPolicyMatch(t *testing.T) {
cases := []struct {
policy SRbacPolicy
userCred mcclient.SSimpleToken
userCred mcclient.TokenCredential
want bool
}{
{
SRbacPolicy{},
mcclient.SSimpleToken{},
&mcclient.SSimpleToken{},
true,
},
{
SRbacPolicy{},
nil,
true,
},
{
SRbacPolicy{
Projects: []string{"system"},
},
mcclient.SSimpleToken{
&mcclient.SSimpleToken{
Project: "system",
},
true,
@@ -261,7 +266,7 @@ func TestSRbacPolicyMatch(t *testing.T) {
SRbacPolicy{
Projects: []string{"system"},
},
mcclient.SSimpleToken{
&mcclient.SSimpleToken{
Project: "demo",
},
false,
@@ -271,7 +276,7 @@ func TestSRbacPolicyMatch(t *testing.T) {
Projects: []string{"system"},
Roles: []string{"admin"},
},
mcclient.SSimpleToken{
&mcclient.SSimpleToken{
Project: "system",
Roles: "admin",
},
@@ -282,7 +287,7 @@ func TestSRbacPolicyMatch(t *testing.T) {
Projects: []string{"system"},
Roles: []string{"admin"},
},
mcclient.SSimpleToken{
&mcclient.SSimpleToken{
Project: "system",
Roles: "admin,_member_",
},
@@ -293,15 +298,23 @@ func TestSRbacPolicyMatch(t *testing.T) {
Projects: []string{"system"},
Roles: []string{"admin"},
},
mcclient.SSimpleToken{
&mcclient.SSimpleToken{
Project: "system",
Roles: "_member_",
},
false,
},
{
SRbacPolicy{
Projects: []string{"system"},
Roles: []string{"admin"},
},
nil,
false,
},
}
for _, c := range cases {
got := c.policy.Match(&c.userCred)
got := c.policy.Match(c.userCred)
if got != c.want {
t.Errorf("%#v %#v got %v want %v", c.policy, c.userCred, got, c.want)
}