Skip to content

Commit 8e884df

Browse files
DiamondJosephDiamondJoseph
committed
Implement working tiled authentication
1 parent 173bf73 commit 8e884df

File tree

4 files changed

+92
-30
lines changed

4 files changed

+92
-30
lines changed

‎policy/diamond/policy/session/session.rego‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,11 @@ write_to_beamline_visit if {
5656
matches_beamline
5757
}
5858

59-
user_sessions contains session if {
60-
subject := token.claims.fedid
59+
user_sessions contains user_session if {
6160
some session in data.diamond.data.sessions
62-
access_session(subject, session.proposal_number, session.visit_number)
61+
access_session(token.claims.fedid, session.proposal_number, session.visit_number)
62+
user_session := sprintf(
63+
`{"proposal": %d, "visit": %d, "beamline": "%s"}`,
64+
[session.proposal_number, session.visit_number, session.beamline],
65+
)
6366
}

‎policy/diamond/policy/session/session_test.rego‎

Lines changed: 62 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package diamond.policy.session_test
22

33
import data.diamond.policy.session
4-
import data.diamond.policy.token
54
import rego.v1
65

76
diamond_data := {
@@ -21,6 +20,16 @@ diamond_data := {
2120
"proposals": [],
2221
"sessions": [],
2322
},
23+
"desmond": {
24+
"permissions": [],
25+
"proposals": [2],
26+
"sessions": [13],
27+
},
28+
"edna": {
29+
"permissions": [],
30+
"proposals": [2],
31+
"sessions": [13, 14],
32+
},
2433
"oscar": {
2534
"permissions": [],
2635
"proposals": [],
@@ -38,12 +47,28 @@ diamond_data := {
3847
"proposal_number": 1,
3948
"visit_number": 2,
4049
},
50+
"13": {
51+
"beamline": "b07",
52+
"proposal_number": 2,
53+
"visit_number": 1,
54+
},
55+
"14": {
56+
"beamline": "b07",
57+
"proposal_number": 2,
58+
"visit_number": 2,
59+
},
4160
},
42-
"proposals": {"1": {"sessions": {
43-
"1": 11,
44-
"2": 12,
45-
}}},
46-
"beamlines": {"i03": {"sessions": [11]}, "b07": {"sessions": [12]}},
61+
"proposals": {
62+
"1": {"sessions": {
63+
"1": 11,
64+
"2": 12,
65+
}},
66+
"2": {"sessions": {
67+
"1": 13,
68+
"2": 14,
69+
}},
70+
},
71+
"beamlines": {"i03": {"sessions": [11]}, "b07": {"sessions": [12, 13, 14]}},
4772
"admin": {"b07_admin": ["b07"]},
4873
}
4974

@@ -184,8 +209,35 @@ test_session_beamline if {
184209
}
185210

186211
test_user_session_tags if {
187-
session.user_sessions == set() with data.diamond.data as diamond_data with data.diamond.policy.token.claims as {"fedid": "oscar"}
188-
session.user_sessions == {{"proposal_number": 1, "visit_number": 2, "beamline": "b07"}, {"proposal_number": 1, "visit_number": 1, "beamline": "i03"}} with data.diamond.data as diamond_data with data.diamond.policy.token.claims as {"fedid": "alice"}
189-
session.user_sessions == {{"proposal_number": 1, "visit_number": 2, "beamline": "b07"}, {"proposal_number": 1, "visit_number": 1, "beamline": "i03"}} with data.diamond.data as diamond_data with data.diamond.policy.token.claims as {"fedid": "bob"}
190-
session.user_sessions == {{"proposal_number": 1, "visit_number": 2, "beamline": "b07"}, {"proposal_number": 1, "visit_number": 1, "beamline": "i03"}} with data.diamond.data as diamond_data with data.diamond.policy.token.claims as {"fedid": "carol"}
212+
session.user_sessions == set() with data.diamond.data as diamond_data
213+
with data.diamond.policy.token.claims as {"fedid": "oscar"}
214+
session.user_sessions == {
215+
`{"proposal": 1, "visit": 2, "beamline": "b07"}`,
216+
`{"proposal": 1, "visit": 1, "beamline": "i03"}`,
217+
} with data.diamond.data as diamond_data
218+
with data.diamond.policy.token.claims as {"fedid": "alice"}
219+
session.user_sessions == {
220+
`{"proposal": 1, "visit": 2, "beamline": "b07"}`,
221+
`{"proposal": 1, "visit": 1, "beamline": "i03"}`,
222+
`{"proposal": 2, "visit": 1, "beamline": "b07"}`,
223+
`{"proposal": 2, "visit": 2, "beamline": "b07"}`,
224+
} with data.diamond.data as diamond_data
225+
with data.diamond.policy.token.claims as {"fedid": "bob"}
226+
session.user_sessions == {
227+
`{"proposal": 1, "visit": 2, "beamline": "b07"}`,
228+
`{"proposal": 1, "visit": 1, "beamline": "i03"}`,
229+
`{"proposal": 2, "visit": 1, "beamline": "b07"}`,
230+
`{"proposal": 2, "visit": 2, "beamline": "b07"}`,
231+
} with data.diamond.data as diamond_data
232+
with data.diamond.policy.token.claims as {"fedid": "carol"}
233+
session.user_sessions == {
234+
`{"proposal": 2, "visit": 1, "beamline": "b07"}`,
235+
`{"proposal": 2, "visit": 2, "beamline": "b07"}`,
236+
} with data.diamond.data as diamond_data
237+
with data.diamond.policy.token.claims as {"fedid": "desmond"}
238+
session.user_sessions == {
239+
`{"proposal": 2, "visit": 1, "beamline": "b07"}`,
240+
`{"proposal": 2, "visit": 2, "beamline": "b07"}`,
241+
} with data.diamond.data as diamond_data
242+
with data.diamond.policy.token.claims as {"fedid": "edna"}
191243
}

‎policy/diamond/policy/tiled/tiled.rego‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,32 +2,32 @@ package diamond.policy.tiled
22

33
import data.diamond.policy.token
44

5-
read_scopes = {
6-
"read:metadata",
7-
"read:data",
5+
read_scopes := {
6+
"read:metadata",
7+
"read:data",
88
}
99

10-
write_scopes = {
11-
"write:metadata",
12-
"write:data",
13-
"create",
14-
"register",
10+
write_scopes := {
11+
"write:metadata",
12+
"write:data",
13+
"create",
14+
"register",
1515
}
1616

17-
default scopes := set()
18-
19-
scopes_for(claims) := read_scopes & write_scopes if {
20-
"azp" in object.keys(claims)
21-
endswith(claims.azp, "-blueapi")
17+
scopes_for(claims) := read_scopes | write_scopes if {
18+
"azp" in object.keys(claims)
19+
endswith(claims.azp, "-blueapi")
2220
}
2321

2422
scopes_for(claims) := read_scopes if {
25-
"azp" in object.keys(claims)
26-
not endswith(claims.azp, "-blueapi")
23+
"azp" in object.keys(claims)
24+
not endswith(claims.azp, "-blueapi")
2725
}
2826

2927
scopes_for(claims) := read_scopes if {
30-
not "azp" in object.keys(claims)
28+
not "azp" in object.keys(claims)
3129
}
3230

31+
default scopes := set()
32+
3333
scopes := scopes_for(token.claims)

‎policy/diamond/policy/tiled/tiled_test.rego‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,12 @@ test_wrong_azp_read_scopes if {
1515
}
1616

1717
test_blueapi_given_write_scopes if {
18-
tiled.scopes == tiled.read_scopes & tiled.write_scopes with token.claims as {"azp": "foo-blueapi"}
18+
tiled.scopes == {
19+
"read:metadata",
20+
"read:data",
21+
"write:metadata",
22+
"write:data",
23+
"create",
24+
"register",
25+
} with token.claims as {"azp": "foo-blueapi"}
1926
}

0 commit comments

Comments
 (0)