diff --git a/api/go.mod b/api/go.mod index 2febfb82892..5cd531b7a3c 100644 --- a/api/go.mod +++ b/api/go.mod @@ -11,11 +11,7 @@ require ( github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect github.com/sirupsen/logrus v1.6.0 // indirect github.com/stretchr/testify v1.2.2 -<<<<<<< HEAD golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 -======= - github.com/vulcand/predicate v1.1.0 ->>>>>>> custom approval conditions golang.org/x/net v0.0.0-20200707034311-ab3426394381 google.golang.org/grpc v1.27.0 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect diff --git a/api/go.sum b/api/go.sum index 68e8cb94e6b..12b13b9faa0 100644 --- a/api/go.sum +++ b/api/go.sum @@ -45,8 +45,6 @@ github.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88= github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= -github.com/vulcand/predicate v1.1.0 h1:Gq/uWopa4rx/tnZu2opOSBqHK63Yqlou/SzrbwdJiNg= -github.com/vulcand/predicate v1.1.0/go.mod h1:mlccC5IRBoc2cIFmCB8ZM62I3VDb6p2GXESMHa3CnZg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= diff --git a/api/types/access_request.go b/api/types/access_request.go index 066c134fd5f..e1df831e98c 100644 --- a/api/types/access_request.go +++ b/api/types/access_request.go @@ -26,8 +26,6 @@ import ( "github.com/gravitational/teleport/api/utils" "github.com/gravitational/trace" - - "github.com/vulcand/predicate" ) // AccessRequest is a request for temporarily granted roles @@ -406,23 +404,6 @@ func (r *AccessRequestV3) Equals(other AccessRequest) bool { return r.Spec.Equals(&o.Spec) } -// MatchesFilter returns true if Filter rule matches -// Empty Filter block always matches -func (t AccessReviewThreshold) MatchesFilter(parser predicate.Parser) (bool, error) { - if t.Filter == "" { - return true, nil - } - ifn, err := parser.Parse(t.Filter) - if err != nil { - return false, trace.Wrap(err) - } - fn, ok := ifn.(predicate.BoolPredicate) - if !ok { - return false, trace.BadParameter("unsupported type: %T", ifn) - } - return fn(), nil -} - func (t AccessReviewThreshold) Equals(other AccessReviewThreshold) bool { return reflect.DeepEqual(t, other) } diff --git a/lib/services/access_request.go b/lib/services/access_request.go index 34c0d97cc60..5ef78eaaed6 100644 --- a/lib/services/access_request.go +++ b/lib/services/access_request.go @@ -26,8 +26,8 @@ import ( "github.com/gravitational/teleport/lib/utils/parse" "github.com/gravitational/trace" - "github.com/pborman/uuid" + "github.com/vulcand/predicate" ) // ValidateAccessRequest validates the AccessRequest and sets default values @@ -350,7 +350,7 @@ func collectReviewThresholdIndexes(req AccessRequest, rev types.AccessReview, au var tids []uint32 for i, t := range req.GetThresholds() { - match, err := t.MatchesFilter(parser) + match, err := accessReviewThresholdMatchesFilter(t, parser) if err != nil { return nil, trace.Wrap(err) } @@ -371,6 +371,23 @@ func collectReviewThresholdIndexes(req AccessRequest, rev types.AccessReview, au return tids, nil } +// accessReviewThresholdMatchesFilter returns true if Filter rule matches +// Empty Filter block always matches +func accessReviewThresholdMatchesFilter(t types.AccessReviewThreshold, parser predicate.Parser) (bool, error) { + if t.Filter == "" { + return true, nil + } + ifn, err := parser.Parse(t.Filter) + if err != nil { + return false, trace.Wrap(err) + } + fn, ok := ifn.(predicate.BoolPredicate) + if !ok { + return false, trace.BadParameter("unsupported type: %T", ifn) + } + return fn(), nil +} + // newThresholdFilterParser creates a custom parser context which exposes a simplified view of the review author // and the request for evaluation of review threshold filters. func newThresholdFilterParser(req AccessRequest, rev types.AccessReview, author User) (BoolPredicateParser, error) {