Refactoring the capabilities function
This commit is contained in:
parent
de5c8199a8
commit
b812ea1203
@ -1,5 +1,7 @@
|
||||
package api
|
||||
|
||||
import "log"
|
||||
|
||||
func (c *Sys) CapabilitiesSelf(path string) ([]string, error) {
|
||||
body := map[string]string{
|
||||
"path": path,
|
||||
@ -16,6 +18,7 @@ func (c *Sys) CapabilitiesSelf(path string) ([]string, error) {
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
log.Printf("capabilities self: resp: %#v\n", resp.Body)
|
||||
var result CapabilitiesResponse
|
||||
err = resp.DecodeJSON(&result)
|
||||
return result.Capabilities, err
|
||||
@ -38,6 +41,7 @@ func (c *Sys) Capabilities(token, path string) ([]string, error) {
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
log.Printf("capabilities: resp: %#v\n", resp.Body)
|
||||
var result CapabilitiesResponse
|
||||
err = resp.DecodeJSON(&result)
|
||||
return result.Capabilities, err
|
||||
|
@ -1,7 +1,6 @@
|
||||
package http
|
||||
|
||||
import (
|
||||
"log"
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
@ -80,7 +79,6 @@ func handleSysCapabilities(core *vault.Core) http.Handler {
|
||||
return
|
||||
}
|
||||
|
||||
log.Printf("path: %s\n", path)
|
||||
if path == "sys/capabilities-self" {
|
||||
// Get the auth for the request so we can access the token directly
|
||||
req := requestAuth(r, &logical.Request{})
|
||||
@ -101,18 +99,6 @@ func handleSysCapabilities(core *vault.Core) http.Handler {
|
||||
}
|
||||
|
||||
respondLogical(w, r, path, false, resp)
|
||||
|
||||
/*
|
||||
capabilities, err := core.Capabilities(data["token"].(string), data["path"].(string))
|
||||
if err != nil {
|
||||
respondErrorStatus(w, err)
|
||||
return
|
||||
}
|
||||
|
||||
respondOk(w, &capabilitiesResponse{
|
||||
Capabilities: capabilities,
|
||||
})
|
||||
*/
|
||||
})
|
||||
|
||||
}
|
||||
|
@ -12,25 +12,6 @@ func (s *StatusBadRequest) Error() string {
|
||||
return s.Err
|
||||
}
|
||||
|
||||
// CapabilitiesAccessor is used to fetch the capabilities of the token
|
||||
// which associated with the given accessor on the given path
|
||||
func (c *Core) CapabilitiesAccessor(accessor, path string) ([]string, error) {
|
||||
if path == "" {
|
||||
return nil, &StatusBadRequest{Err: "missing path"}
|
||||
}
|
||||
|
||||
if accessor == "" {
|
||||
return nil, &StatusBadRequest{Err: "missing accessor"}
|
||||
}
|
||||
|
||||
token, err := c.tokenStore.lookupByAccessor(accessor)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return c.Capabilities(token, path)
|
||||
}
|
||||
|
||||
// Capabilities is used to fetch the capabilities of the given token on the given path
|
||||
func (c *Core) Capabilities(token, path string) ([]string, error) {
|
||||
if path == "" {
|
||||
|
@ -461,67 +461,35 @@ type SystemBackend struct {
|
||||
|
||||
func (b *SystemBackend) handleCapabilities(req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
|
||||
log.Printf("handleCapabilities: request: %#v\n data:%#v\n", req, d)
|
||||
token := d.Get("token").(string)
|
||||
if token == "" {
|
||||
return logical.ErrorResponse("missing token"), nil
|
||||
}
|
||||
|
||||
path := d.Get("path").(string)
|
||||
if path == "" {
|
||||
return logical.ErrorResponse("missing path"), nil
|
||||
}
|
||||
|
||||
te, err := b.Core.tokenStore.Lookup(token)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if te == nil {
|
||||
return logical.ErrorResponse("invalid token"), nil
|
||||
}
|
||||
|
||||
if te.Policies == nil {
|
||||
return &logical.Response{
|
||||
Data: map[string]interface{}{
|
||||
"capabilities": []string{DenyCapability},
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
var policies []*Policy
|
||||
for _, tePolicy := range te.Policies {
|
||||
policy, err := b.Core.policyStore.GetPolicy(tePolicy)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
policies = append(policies, policy)
|
||||
}
|
||||
|
||||
if len(policies) == 0 {
|
||||
return &logical.Response{
|
||||
Data: map[string]interface{}{
|
||||
"capabilities": []string{DenyCapability},
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
acl, err := NewACL(policies)
|
||||
capabilities, err := b.Core.Capabilities(d.Get("token").(string), d.Get("path").(string))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &logical.Response{
|
||||
Data: map[string]interface{}{
|
||||
"capabilities": acl.Capabilities(path),
|
||||
"capabilities": capabilities,
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (b *SystemBackend) handleCapabilitiesAccessor(req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
|
||||
log.Printf("handleCapabilitiesAccessor: request: %#v\n data:%#v\n", req, d)
|
||||
capabilities, err := b.Core.CapabilitiesAccessor(d.Get("accessor").(string), d.Get("path").(string))
|
||||
accessor := d.Get("accessor").(string)
|
||||
if accessor == "" {
|
||||
return nil, &StatusBadRequest{Err: "missing accessor"}
|
||||
}
|
||||
|
||||
token, err := b.Core.tokenStore.lookupByAccessor(accessor)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
capabilities, err := b.Core.Capabilities(token, d.Get("path").(string))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &logical.Response{
|
||||
Data: map[string]interface{}{
|
||||
"capabilities": capabilities,
|
||||
|
Loading…
Reference in New Issue
Block a user