2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2016-03-03 05:32:52 +03:00
|
|
|
package vault
|
|
|
|
|
2017-02-17 07:09:39 +03:00
|
|
|
import (
|
2018-01-19 09:44:44 +03:00
|
|
|
"context"
|
2017-02-17 07:09:39 +03:00
|
|
|
"sort"
|
2016-03-18 19:40:17 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
"github.com/hashicorp/vault/helper/namespace"
|
2019-04-13 00:54:35 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
2017-02-17 07:09:39 +03:00
|
|
|
)
|
2016-03-03 05:32:52 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
// Capabilities is used to fetch the capabilities of the given token on the
|
|
|
|
// given path
|
2018-01-19 09:44:44 +03:00
|
|
|
func (c *Core) Capabilities(ctx context.Context, token, path string) ([]string, error) {
|
2016-03-03 05:32:52 +03:00
|
|
|
if path == "" {
|
2017-02-17 07:09:39 +03:00
|
|
|
return nil, &logical.StatusBadRequest{Err: "missing path"}
|
2016-03-03 05:32:52 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if token == "" {
|
2017-02-17 07:09:39 +03:00
|
|
|
return nil, &logical.StatusBadRequest{Err: "missing token"}
|
2016-03-03 05:32:52 +03:00
|
|
|
}
|
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
te, err := c.tokenStore.Lookup(ctx, token)
|
2016-03-03 05:32:52 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if te == nil {
|
2017-02-17 07:09:39 +03:00
|
|
|
return nil, &logical.StatusBadRequest{Err: "invalid token"}
|
2016-03-03 05:32:52 +03:00
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
tokenNS, err := NamespaceByID(ctx, te.NamespaceID, c)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if tokenNS == nil {
|
|
|
|
return nil, namespace.ErrNoNamespace
|
|
|
|
}
|
2016-03-04 20:04:26 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
var policyCount int
|
|
|
|
policyNames := make(map[string][]string)
|
|
|
|
policyNames[tokenNS.ID] = te.Policies
|
|
|
|
policyCount += len(te.Policies)
|
|
|
|
|
2021-10-07 20:36:22 +03:00
|
|
|
entity, identityPolicies, err := c.fetchEntityAndDerivedPolicies(ctx, tokenNS, te.EntityID, te.NoIdentityPolicies)
|
2017-11-03 18:20:10 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2018-04-24 01:00:02 +03:00
|
|
|
if entity != nil && entity.Disabled {
|
2018-06-19 19:57:19 +03:00
|
|
|
c.logger.Warn("permission denied as the entity on the token is disabled")
|
|
|
|
return nil, logical.ErrPermissionDenied
|
|
|
|
}
|
2018-09-04 21:18:59 +03:00
|
|
|
if te.EntityID != "" && entity == nil {
|
2018-06-19 19:57:19 +03:00
|
|
|
c.logger.Warn("permission denied as the entity on the token is invalid")
|
2018-04-24 01:00:02 +03:00
|
|
|
return nil, logical.ErrPermissionDenied
|
|
|
|
}
|
2017-11-03 18:20:10 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
for nsID, nsPolicies := range identityPolicies {
|
|
|
|
policyNames[nsID] = append(policyNames[nsID], nsPolicies...)
|
|
|
|
policyCount += len(nsPolicies)
|
|
|
|
}
|
|
|
|
|
2021-10-07 20:36:22 +03:00
|
|
|
// Add capabilities of the inline policy if it's set
|
|
|
|
policies := make([]*Policy, 0)
|
|
|
|
if te.InlinePolicy != "" {
|
|
|
|
inlinePolicy, err := ParseACLPolicy(tokenNS, te.InlinePolicy)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
policies = append(policies, inlinePolicy)
|
|
|
|
policyCount++
|
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
if policyCount == 0 {
|
2016-03-04 21:21:07 +03:00
|
|
|
return []string{DenyCapability}, nil
|
2016-03-04 20:04:26 +03:00
|
|
|
}
|
|
|
|
|
2018-09-27 01:10:36 +03:00
|
|
|
// Construct the corresponding ACL object. ACL construction should be
|
|
|
|
// performed on the token's namespace.
|
|
|
|
tokenCtx := namespace.ContextWithNamespace(ctx, tokenNS)
|
2021-10-07 20:36:22 +03:00
|
|
|
acl, err := c.policyStore.ACL(tokenCtx, entity, policyNames, policies...)
|
2016-03-04 20:04:26 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
capabilities := acl.Capabilities(ctx, path)
|
2016-03-18 19:40:17 +03:00
|
|
|
sort.Strings(capabilities)
|
|
|
|
return capabilities, nil
|
2016-03-03 05:32:52 +03:00
|
|
|
}
|