|
| 1 | +// |
| 2 | +// Copyright 2024 The Chainloop Authors. |
| 3 | +// |
| 4 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +// you may not use this file except in compliance with the License. |
| 6 | +// You may obtain a copy of the License at |
| 7 | +// |
| 8 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +// |
| 10 | +// Unless required by applicable law or agreed to in writing, software |
| 11 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +// See the License for the specific language governing permissions and |
| 14 | +// limitations under the License. |
| 15 | + |
| 16 | +// Authorization package |
| 17 | +package authz |
| 18 | + |
| 19 | +import ( |
| 20 | + "errors" |
| 21 | + "fmt" |
| 22 | + |
| 23 | + _ "embed" |
| 24 | + |
| 25 | + "github.com/casbin/casbin/v2" |
| 26 | + "github.com/casbin/casbin/v2/model" |
| 27 | + "github.com/casbin/casbin/v2/persist" |
| 28 | + fileadapter "github.com/casbin/casbin/v2/persist/file-adapter" |
| 29 | + entadapter "github.com/casbin/ent-adapter" |
| 30 | + "github.com/chainloop-dev/chainloop/app/controlplane/internal/conf" |
| 31 | +) |
| 32 | + |
| 33 | +const ( |
| 34 | + // Actions |
| 35 | + ActionRead = "read" |
| 36 | + ActionList = "list" |
| 37 | + ActionUpdate = "update" |
| 38 | + ActionDelete = "delete" |
| 39 | + |
| 40 | + // Resources |
| 41 | + ResourceWorkflowContract = "workflow_contract" |
| 42 | + ResourceCASArtifact = "cas_artifact" |
| 43 | + ResourceReferrer = "referrer" |
| 44 | +) |
| 45 | + |
| 46 | +// resource, action tuple |
| 47 | +type Policy struct { |
| 48 | + Resource string |
| 49 | + Action string |
| 50 | +} |
| 51 | + |
| 52 | +var ( |
| 53 | + PolicyWorkflowContractList = &Policy{ResourceWorkflowContract, ActionList} |
| 54 | + PolicyWorkflowContractRead = &Policy{ResourceWorkflowContract, ActionRead} |
| 55 | + PolicyWorkflowContractUpdate = &Policy{ResourceWorkflowContract, ActionUpdate} |
| 56 | + PolicyArtifactDownload = &Policy{ResourceCASArtifact, ActionRead} |
| 57 | + PolicyReferrerRead = &Policy{ResourceReferrer, ActionRead} |
| 58 | +) |
| 59 | + |
| 60 | +type SubjectAPIToken struct { |
| 61 | + ID string |
| 62 | +} |
| 63 | + |
| 64 | +func (t *SubjectAPIToken) String() string { |
| 65 | + return fmt.Sprintf("api-token:%s", t.ID) |
| 66 | +} |
| 67 | + |
| 68 | +//go:embed model.conf |
| 69 | +var modelFile []byte |
| 70 | + |
| 71 | +type Enforcer struct { |
| 72 | + *casbin.Enforcer |
| 73 | +} |
| 74 | + |
| 75 | +func (e *Enforcer) AddPolicies(sub *SubjectAPIToken, policies ...*Policy) error { |
| 76 | + if len(policies) == 0 { |
| 77 | + return errors.New("no policies to add") |
| 78 | + } |
| 79 | + |
| 80 | + if sub == nil { |
| 81 | + return errors.New("no subject provided") |
| 82 | + } |
| 83 | + |
| 84 | + for _, p := range policies { |
| 85 | + casbinPolicy := []string{sub.String(), p.Resource, p.Action} |
| 86 | + // Add policies one by one to skip existing ones. |
| 87 | + // This is because the bulk method AddPoliciesEx does not work well with the ent adapter |
| 88 | + if _, err := e.AddPolicy(casbinPolicy); err != nil { |
| 89 | + return fmt.Errorf("failed to add policy: %w", err) |
| 90 | + } |
| 91 | + } |
| 92 | + |
| 93 | + return nil |
| 94 | +} |
| 95 | + |
| 96 | +// Remove all the policies for the given subject |
| 97 | +func (e *Enforcer) ClearPolicies(sub *SubjectAPIToken) error { |
| 98 | + if sub == nil { |
| 99 | + return errors.New("no subject provided") |
| 100 | + } |
| 101 | + |
| 102 | + // Get all the policies for the subject |
| 103 | + policies := e.GetFilteredPolicy(0, sub.String()) |
| 104 | + |
| 105 | + if _, err := e.Enforcer.RemovePolicies(policies); err != nil { |
| 106 | + return fmt.Errorf("failed to remove policies: %w", err) |
| 107 | + } |
| 108 | + |
| 109 | + return nil |
| 110 | +} |
| 111 | + |
| 112 | +// NewDatabaseEnforcer creates a new casbin authorization enforcer |
| 113 | +// based on a database backend as policies storage backend |
| 114 | +func NewDatabaseEnforcer(c *conf.Data_Database) (*Enforcer, error) { |
| 115 | + // policy storage in database |
| 116 | + a, err := entadapter.NewAdapter(c.Driver, c.Source) |
| 117 | + if err != nil { |
| 118 | + return nil, fmt.Errorf("failed to create adapter: %w", err) |
| 119 | + } |
| 120 | + |
| 121 | + e, err := newEnforcer(a) |
| 122 | + if err != nil { |
| 123 | + return nil, fmt.Errorf("failed to create enforcer: %w", err) |
| 124 | + } |
| 125 | + |
| 126 | + return e, nil |
| 127 | +} |
| 128 | + |
| 129 | +// NewFileAdapter creates a new casbin authorization enforcer |
| 130 | +// based on a CSV file as policies storage backend |
| 131 | +func NewFiletypeEnforcer(path string) (*Enforcer, error) { |
| 132 | + // policy storage in filesystem |
| 133 | + a := fileadapter.NewAdapter(path) |
| 134 | + e, err := newEnforcer(a) |
| 135 | + if err != nil { |
| 136 | + return nil, fmt.Errorf("failed to create enforcer: %w", err) |
| 137 | + } |
| 138 | + |
| 139 | + return e, nil |
| 140 | +} |
| 141 | + |
| 142 | +// NewEnforcer creates a new casbin authorization enforcer for the policies stored |
| 143 | +// in the database and the model defined in model.conf |
| 144 | +func newEnforcer(a persist.Adapter) (*Enforcer, error) { |
| 145 | + // load model defined in model.conf |
| 146 | + m, err := model.NewModelFromString(string(modelFile)) |
| 147 | + if err != nil { |
| 148 | + return nil, fmt.Errorf("failed to create model: %w", err) |
| 149 | + } |
| 150 | + |
| 151 | + // create enforcer for authorization |
| 152 | + enforcer, err := casbin.NewEnforcer(m, a) |
| 153 | + if err != nil { |
| 154 | + return nil, fmt.Errorf("failed to create enforcer: %w", err) |
| 155 | + } |
| 156 | + |
| 157 | + return &Enforcer{enforcer}, nil |
| 158 | +} |
0 commit comments