perms+subservers: register subserver whitelisted urls with perms manager

Author: ellemouton

itest/litd_mode_integrated_test.go

@@ -1278,13 +1278,21 @@ func bakeSuperMacaroon(cfg *LitNodeConfig, readOnly bool) (string, error) {
 		return "", err
 	}
 
-	permsMgr.RegisterSubServer(subservers.LOOP, loop.RequiredPermissions)
-	permsMgr.RegisterSubServer(subservers.POOL, pool.RequiredPermissions)
-	permsMgr.RegisterSubServer(subservers.TAP, tap.RequiredPermissions)
 	permsMgr.RegisterSubServer(
-		subservers.FARADAY, faraday.RequiredPermissions,
+		subservers.LOOP, loop.RequiredPermissions, nil,
+	)
+	permsMgr.RegisterSubServer(
+		subservers.POOL, pool.RequiredPermissions, nil,
+	)
+	permsMgr.RegisterSubServer(
+		subservers.TAP, tap.RequiredPermissions, nil,
+	)
+	permsMgr.RegisterSubServer(
+		subservers.FARADAY, faraday.RequiredPermissions, nil,
+	)
+	permsMgr.RegisterSubServer(
+		subservers.TAP, tap.RequiredPermissions, nil,
 	)
-	permsMgr.RegisterSubServer(subservers.TAP, tap.RequiredPermissions)
 
 	superMacPermissions := permsMgr.ActivePermissions(readOnly)
 	nullID := [4]byte{}
@@ -1300,13 +1308,13 @@ func bakeSuperMacaroon(cfg *LitNodeConfig, readOnly bool) (string, error) {
 	// it's valid.
 	superMacBytes, _ := hex.DecodeString(superMacHex)
 
-	tempFile, err := ioutil.TempFile("", "lit-super-macaroon")
+	tempFile, err := os.CreateTemp("", "lit-super-macaroon")
 	if err != nil {
 		_ = os.Remove(tempFile.Name())
 		return "", err
 	}
 
-	err = ioutil.WriteFile(tempFile.Name(), superMacBytes, 0644)
+	err = os.WriteFile(tempFile.Name(), superMacBytes, 0644)
 	if err != nil {
 		_ = os.Remove(tempFile.Name())
 		return "", err

perms/manager.go

@@ -116,7 +116,7 @@ func (pm *Manager) IsWhiteListedURL(url string) bool {
 // RegisterSubServer adds the permissions of a given sub-server to the set
 // managed by the Manager.
 func (pm *Manager) RegisterSubServer(name string,
-	permissions map[string][]bakery.Op) {
+	permissions map[string][]bakery.Op, whiteListURLs map[string]struct{}) {
 
 	pm.permsMu.Lock()
 	defer pm.permsMu.Unlock()
@@ -126,6 +126,15 @@ func (pm *Manager) RegisterSubServer(name string,
 	for uri, ops := range permissions {
 		pm.perms[uri] = ops
 	}
+
+	for url := range whiteListURLs {
+		pm.perms[url] = nil
+
+		if pm.fixedPerms[name] == nil {
+			pm.fixedPerms[name] = make(map[string][]bakery.Op)
+		}
+		pm.fixedPerms[name][url] = []bakery.Op{}
+	}
 }
 
 // OnLNDBuildTags should be called once a list of LND build tags has been

subservers/manager.go

@@ -54,7 +54,9 @@ func (s *Manager) AddServer(ss SubServer) {
 		quit:      make(chan struct{}),
 	})
 
-	s.permsMgr.RegisterSubServer(ss.Name(), ss.Permissions())
+	s.permsMgr.RegisterSubServer(
+		ss.Name(), ss.Permissions(), ss.WhiteListedURLs(),
+	)
 }
 
 // StartIntegratedServers starts all the manager's sub-servers that should be