10628909244

Committed 30 Aug 2024 07:49AM UTC coverage: 53.672% (-0.004%) from 53.676%

Build # 10628909244

Build Type

push

github

Committed by

web-flow

Commit Message

build(deps): bump github/codeql-action from 3.26.5 to 3.26.6 (#4324)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.26.5 to 3.26.6.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/2c779ab0d...4dd16135b)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Run Details

13266 of 24717 relevant lines covered (53.67%)

45.06 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

69.85

/internal/authz/authz.go

//
// Copyright 2023 Stacklok, Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Package authz provides the authorization utilities for minder
package authz

import (
        "context"
        _ "embed"
        "encoding/json"
        "errors"
        "fmt"
        "net/http"
        "strings"

        "github.com/google/uuid"
        fgasdk "github.com/openfga/go-sdk"
        fgaclient "github.com/openfga/go-sdk/client"
        "github.com/openfga/go-sdk/credentials"
        "github.com/rs/zerolog"
        "k8s.io/client-go/transport"

        "github.com/stacklok/minder/internal/auth/jwt"
        srvconfig "github.com/stacklok/minder/internal/config/server"
        minderv1 "github.com/stacklok/minder/pkg/api/protobuf/go/minder/v1"
)

var (
        // ErrStoreNotFound denotes the error where the store wasn't found via the
        // given configuration.
        ErrStoreNotFound = errors.New("Store not found")

        //go:embed model/minder.generated.json
        authzModel string
)

// ClientWrapper is a wrapper for the OpenFgaClient.
// It is used to provide a common interface for the client and a way to
// refresh authentication to the authz provider when needed.
type ClientWrapper struct {
        cfg *srvconfig.AuthzConfig
        cli *fgaclient.OpenFgaClient
        l   *zerolog.Logger
}

var _ Client = &ClientWrapper{}

// NewAuthzClient returns a new AuthzClientWrapper
func NewAuthzClient(cfg *srvconfig.AuthzConfig, l *zerolog.Logger) (Client, error) {
        if err := cfg.Validate(); err != nil {
                return nil, err
        }

        cliWrap := &ClientWrapper{
                cfg: cfg,
                l:   l,
        }

        if err := cliWrap.initAuthzClient(); err != nil {
                return nil, err
        }

        return cliWrap, nil
}

// initAuthzClient initializes the authz client based on the configuration.
// Note that this assumes the configuration has already been validated.
func (a *ClientWrapper) initAuthzClient() error {
        clicfg := &fgaclient.ClientConfiguration{
                ApiUrl: a.cfg.ApiUrl,
                Credentials: &credentials.Credentials{
                        // We use our own bearer auth round tripper so we can refresh the token
                        Method: credentials.CredentialsMethodNone,
                },
        }

        if a.cfg.StoreID != "" {
                clicfg.StoreId = a.cfg.StoreID
        }

        if a.cfg.Auth.Method == "token" {
                rt, err := transport.NewBearerAuthWithRefreshRoundTripper("", a.cfg.Auth.Token.TokenPath, http.DefaultTransport)
                if err != nil {
                        return fmt.Errorf("failed to create bearer auth round tripper: %w", err)
                }

                clicfg.HTTPClient = &http.Client{
                        Transport: rt,
                }
        }

        cli, err := fgaclient.NewSdkClient(clicfg)
        if err != nil {
                return fmt.Errorf("failed to create SDK client: %w", err)
        }

        a.cli = cli
        return nil
}

// PrepareForRun initializes the authz client based on the configuration.
// This is handy when migrations have already been done and helps us auto-discover
// the store ID and model.
func (a *ClientWrapper) PrepareForRun(ctx context.Context) error {
        storeID, err := a.findStoreByName(ctx)
        if err != nil {
                return fmt.Errorf("unable to find authz store: %w", err)
        }

        err = a.cli.SetStoreId(storeID)
        if err != nil {
                return fmt.Errorf("unable to store authz ID: %w", err)
        }

        modelID, err := a.findLatestModel(ctx)
        if err != nil {
                return fmt.Errorf("unable to find authz model: %w", err)
        }

        if err := a.cli.SetAuthorizationModelId(modelID); err != nil {
                return fmt.Errorf("unable to set authz model: %w", err)
        }

        return nil
}

// StoreIDProvided returns true if the store ID was provided in the configuration
func (a *ClientWrapper) StoreIDProvided() bool {
        return a.cfg.StoreID != ""
}

// MigrateUp runs the authz migrations. For OpenFGA this means creating the store
// and writing the authz model.
func (a *ClientWrapper) MigrateUp(ctx context.Context) error {
        if !a.StoreIDProvided() {
                if err := a.ensureAuthzStore(ctx); err != nil {
                        return err
                }
        }

        m, err := a.writeModel(ctx)
        if err != nil {
                return fmt.Errorf("error while writing authz model: %w", err)
        }

        a.l.Printf("Wrote authz model %s\n", m)

        return nil
}

func (a *ClientWrapper) ensureAuthzStore(ctx context.Context) error {
        storeName := a.cfg.StoreName
        storeID, err := a.findStoreByName(ctx)
        if err != nil && !errors.Is(err, ErrStoreNotFound) {
                return err
        } else if errors.Is(err, ErrStoreNotFound) {
                a.l.Printf("Creating authz store %s\n", storeName)
                id, err := a.createStore(ctx)
                if err != nil {
                        return err
                }
                a.l.Printf("Created authz store %s/%s\n", id, storeName)
                err = a.cli.SetStoreId(id)
                if err != nil {
                        return fmt.Errorf("unable to store authz ID: %w", err)
                }
                return nil
        }

        a.l.Printf("Not creating store. Found store with name '%s' and ID '%s'.\n",
                storeName, storeID)

        err = a.cli.SetStoreId(storeID)
        if err != nil {
                return fmt.Errorf("unable to store authz ID: %w", err)
        }
        return nil
}

// findStoreByName returns the store ID for the configured store name
func (a *ClientWrapper) findStoreByName(ctx context.Context) (string, error) {
        stores, err := a.cli.ListStores(ctx).Execute()
        if err != nil {
                return "", fmt.Errorf("error while listing authz stores: %w", err)
        }

        // TODO: We might want to handle pagination here.
        for _, store := range stores.Stores {
                if store.Name == a.cfg.StoreName {
                        return store.Id, nil
                }
        }

        return "", ErrStoreNotFound
}

// createStore creates a new store with the configured name
func (a *ClientWrapper) createStore(ctx context.Context) (string, error) {
        st, err := a.cli.CreateStore(ctx).Body(fgaclient.ClientCreateStoreRequest{
                Name: a.cfg.StoreName,
        }).Execute()
        if err != nil {
                return "", fmt.Errorf("error while creating authz store: %w", err)
        }

        return st.Id, nil
}

// findLatestModel returns the latest authz model ID
func (a *ClientWrapper) findLatestModel(ctx context.Context) (string, error) {
        resp, err := a.cli.ReadLatestAuthorizationModel(ctx).Execute()
        if err != nil {
                return "", fmt.Errorf("error while reading authz model: %w", err)
        }

        return resp.AuthorizationModel.Id, nil
}

// writeModel writes the authz model to the configured store
func (a *ClientWrapper) writeModel(ctx context.Context) (string, error) {
        var body fgasdk.WriteAuthorizationModelRequest
        if err := json.Unmarshal([]byte(authzModel), &body); err != nil {
                return "", fmt.Errorf("failed to unmarshal authz model: %w", err)
        }

        data, err := a.cli.WriteAuthorizationModel(ctx).Body(body).Execute()
        if err != nil {
                return "", fmt.Errorf("error while writing authz model: %w", err)
        }

        return data.GetAuthorizationModelId(), nil
}

// Check checks if the user is authorized to perform the given action on the
// given project.
func (a *ClientWrapper) Check(ctx context.Context, action string, project uuid.UUID) error {
        // TODO: set ClientCheckOptions like in
        // https://openfga.dev/docs/getting-started/perform-check#02-calling-check-api
        options := fgaclient.ClientCheckOptions{}
        userString := getUserForTuple(jwt.GetUserSubjectFromContext(ctx))
        body := fgaclient.ClientCheckRequest{
                User:     userString,
                Relation: action,
                Object:   getProjectForTuple(project),
        }
        result, err := a.cli.Check(ctx).Options(options).Body(body).Execute()
        if err != nil {
                return fmt.Errorf("OpenFGA error for %s: %w", userString, err)
        }
        if result.Allowed != nil && *result.Allowed {
                return nil
        }
        return ErrNotAuthorized
}

// Write persists the given role for the given user and project
func (a *ClientWrapper) Write(ctx context.Context, user string, role Role, project uuid.UUID) error {
        return a.write(ctx, fgasdk.TupleKey{
                User:     getUserForTuple(user),
                Relation: role.String(),
                Object:   getProjectForTuple(project),
        })
}

// Adopt writes a relationship between the parent and child projects
func (a *ClientWrapper) Adopt(ctx context.Context, parent, child uuid.UUID) error {
        return a.write(ctx, fgasdk.TupleKey{
                User:     getProjectForTuple(parent),
                Relation: "parent",
                Object:   getProjectForTuple(child),
        })
}

func (a *ClientWrapper) write(ctx context.Context, t fgasdk.TupleKey) error {
        resp, err := a.cli.WriteTuples(ctx).Options(fgaclient.ClientWriteOptions{}).
                Body([]fgasdk.TupleKey{t}).Execute()
        if err != nil && strings.Contains(err.Error(), "already exists") {
                return nil
        } else if err != nil {
                return fmt.Errorf("unable to persist authorization tuple: %w", err)
        }

        for _, w := range resp.Writes {
                if w.Error != nil {
                        return fmt.Errorf("unable to persist authorization tuple: %w", w.Error)
                }
        }

        return nil
}

// Delete removes the given role for the given user and project
func (a *ClientWrapper) Delete(ctx context.Context, user string, role Role, project uuid.UUID) error {
        return a.doDelete(ctx, getUserForTuple(user), role.String(), getProjectForTuple(project))
}

// Orphan removes the relationship between the parent and child projects
func (a *ClientWrapper) Orphan(ctx context.Context, parent, child uuid.UUID) error {
        return a.doDelete(ctx, getProjectForTuple(parent), "parent", getProjectForTuple(child))
}

// doDelete wraps the OpenFGA DeleteTuples call and handles edge cases as needed. It takes
// the user, role, and project as tuple-formatted strings.
func (a *ClientWrapper) doDelete(ctx context.Context, user string, role string, project string) error {
        resp, err := a.cli.DeleteTuples(ctx).Options(fgaclient.ClientWriteOptions{}).Body([]fgasdk.TupleKeyWithoutCondition{
                {
                        User:     user,
                        Relation: role,
                        Object:   project,
                },
        }).Execute()
        if err != nil && strings.Contains(err.Error(), "cannot delete a tuple which does not exist") {
                return nil
        } else if err != nil {
                return fmt.Errorf("unable to remove authorization tuple: %w", err)
        }

        for _, w := range resp.Deletes {
                if w.Error != nil {
                        return fmt.Errorf("unable to remove authorization tuple: %w", w.Error)
                }
        }

        return nil
}

// DeleteUser removes all tuples for the given user
func (a *ClientWrapper) DeleteUser(ctx context.Context, user string) error {
        for role := range AllRolesDescriptions {
                listresp, err := a.cli.ListObjects(ctx).Body(fgaclient.ClientListObjectsRequest{
                        Type:     "project",
                        Relation: role.String(),
                        User:     getUserForTuple(user),
                }).Execute()
                if err != nil {
                        return fmt.Errorf("unable to list authorization tuples: %w", err)
                }

                for _, obj := range listresp.GetObjects() {
                        if err := a.doDelete(ctx, getUserForTuple(user), role.String(), obj); err != nil {
                                return err
                        }
                }
        }

        return nil
}

// AssignmentsToProject lists the current role assignments that are scoped to a project
func (a *ClientWrapper) AssignmentsToProject(ctx context.Context, project uuid.UUID) ([]*minderv1.RoleAssignment, error) {
        o := getProjectForTuple(project)
        prjStr := project.String()

        var pagesize int32 = 50
        var contTok *string = nil

        assignments := []*minderv1.RoleAssignment{}

        for {
                resp, err := a.cli.Read(ctx).Options(fgaclient.ClientReadOptions{
                        PageSize:          &pagesize,
                        ContinuationToken: contTok,
                }).Body(fgaclient.ClientReadRequest{
                        Object: &o,
                }).Execute()
                if err != nil {
                        return nil, fmt.Errorf("unable to read authorization tuples: %w", err)
                }

                for _, t := range resp.GetTuples() {
                        k := t.GetKey()
                        r, err := ParseRole(k.GetRelation())
                        if err != nil {
                                a.l.Err(err).Msg("Found invalid role in authz store")
                                continue
                        }
                        assignments = append(assignments, &minderv1.RoleAssignment{
                                Subject: getUserFromTuple(k.GetUser()),
                                Role:    r.String(),
                                Project: &prjStr,
                        })
                }

                if resp.GetContinuationToken() == "" {
                        break
                }

                contTok = &resp.ContinuationToken
        }

        return assignments, nil
}

// ProjectsForUser lists the projects that the given user has access to
func (a *ClientWrapper) ProjectsForUser(ctx context.Context, sub string) ([]uuid.UUID, error) {
        u := getUserForTuple(sub)

        var pagesize int32 = 50
        var contTok *string = nil

        projs := map[string]any{}
        projectObj := "project:"

        for {
                resp, err := a.cli.Read(ctx).Options(fgaclient.ClientReadOptions{
                        PageSize:          &pagesize,
                        ContinuationToken: contTok,
                }).Body(fgaclient.ClientReadRequest{
                        User:   &u,
                        Object: &projectObj,
                }).Execute()
                if err != nil {
                        return nil, fmt.Errorf("unable to read authorization tuples: %w", err)
                }

                for _, t := range resp.GetTuples() {
                        k := t.GetKey()

                        projs[k.GetObject()] = struct{}{}
                }

                if resp.GetContinuationToken() == "" {
                        break
                }

                contTok = &resp.ContinuationToken
        }

        out := []uuid.UUID{}
        for proj := range projs {
                u, err := uuid.Parse(getProjectFromTuple(proj))
                if err != nil {
                        continue
                }

                out = append(out, u)

                children, err := a.traverseProjectsForParent(ctx, u)
                if err != nil {
                        return nil, err
                }

                out = append(out, children...)
        }

        return out, nil
}

// traverseProjectsForParent is a recursive function that traverses the project
// hierarchy to find all projects that the parent project has access to.
func (a *ClientWrapper) traverseProjectsForParent(ctx context.Context, parent uuid.UUID) ([]uuid.UUID, error) {
        projects := []uuid.UUID{}

        resp, err := a.cli.ListObjects(ctx).Body(fgaclient.ClientListObjectsRequest{
                User:     getProjectForTuple(parent),
                Relation: "parent",
                Type:     "project",
        }).Execute()

        if err != nil {
                return nil, fmt.Errorf("unable to read authorization tuples: %w", err)
        }

        for _, obj := range resp.GetObjects() {
                u, err := uuid.Parse(getProjectFromTuple(obj))
                if err != nil {
                        continue
                }
                projects = append(projects, u)
        }

        for _, proj := range projects {
                children, err := a.traverseProjectsForParent(ctx, proj)
                if err != nil {
                        return nil, err
                }
                projects = append(projects, children...)
        }

        return projects, nil
}

func getUserForTuple(user string) string {
        return "user:" + user
}

func getProjectForTuple(project uuid.UUID) string {
        return "project:" + project.String()
}

func getUserFromTuple(user string) string {
        return strings.TrimPrefix(user, "user:")
}

func getProjectFromTuple(project string) string {
        return strings.TrimPrefix(project, "project:")
}

1	//
2	// Copyright 2023 Stacklok, Inc.
3	//
4	// Licensed under the Apache License, Version 2.0 (the "License");
5	// you may not use this file except in compliance with the License.
6	// You may obtain a copy of the License at
7	//
8	// http://www.apache.org/licenses/LICENSE-2.0
9	//
10	// Unless required by applicable law or agreed to in writing, software
11	// distributed under the License is distributed on an "AS IS" BASIS,
12	// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13	// See the License for the specific language governing permissions and
14	// limitations under the License.
15
16	// Package authz provides the authorization utilities for minder
17	package authz
18
19	import (
20	"context"
21	_ "embed"
22	"encoding/json"
23	"errors"
24	"fmt"
25	"net/http"
26	"strings"
27
28	"github.com/google/uuid"
29	fgasdk "github.com/openfga/go-sdk"
30	fgaclient "github.com/openfga/go-sdk/client"
31	"github.com/openfga/go-sdk/credentials"
32	"github.com/rs/zerolog"
33	"k8s.io/client-go/transport"
34
35	"github.com/stacklok/minder/internal/auth/jwt"
36	srvconfig "github.com/stacklok/minder/internal/config/server"
37	minderv1 "github.com/stacklok/minder/pkg/api/protobuf/go/minder/v1"
38	)
39
40	var (
41	// ErrStoreNotFound denotes the error where the store wasn't found via the
42	// given configuration.
43	ErrStoreNotFound = errors.New("Store not found")
44
45	//go:embed model/minder.generated.json
46	authzModel string
47	)
48
49	// ClientWrapper is a wrapper for the OpenFgaClient.
50	// It is used to provide a common interface for the client and a way to
51	// refresh authentication to the authz provider when needed.
52	type ClientWrapper struct {
53	cfg *srvconfig.AuthzConfig
54	cli *fgaclient.OpenFgaClient
55	l *zerolog.Logger
56	}
57
58	var _ Client = &ClientWrapper{}
59
60	// NewAuthzClient returns a new AuthzClientWrapper
61	func NewAuthzClient(cfg srvconfig.AuthzConfig, l zerolog.Logger) (Client, error) {	3✔
62	if err := cfg.Validate(); err != nil {	3✔
63	return nil, err	×
64	}	×
65
66	cliWrap := &ClientWrapper{	3✔
67	cfg: cfg,	3✔
68	l: l,	3✔
69	}	3✔
70		3✔
71	if err := cliWrap.initAuthzClient(); err != nil {	3✔
72	return nil, err	×
73	}	×
74
75	return cliWrap, nil	3✔
76	}
77
78	// initAuthzClient initializes the authz client based on the configuration.
79	// Note that this assumes the configuration has already been validated.
80	func (a *ClientWrapper) initAuthzClient() error {	3✔
81	clicfg := &fgaclient.ClientConfiguration{	3✔
82	ApiUrl: a.cfg.ApiUrl,	3✔
83	Credentials: &credentials.Credentials{	3✔
84	// We use our own bearer auth round tripper so we can refresh the token	3✔
85	Method: credentials.CredentialsMethodNone,	3✔
86	},	3✔
87	}	3✔
88		3✔
89	if a.cfg.StoreID != "" {	3✔
90	clicfg.StoreId = a.cfg.StoreID	×
91	}	×
92
93	if a.cfg.Auth.Method == "token" {	3✔
94	rt, err := transport.NewBearerAuthWithRefreshRoundTripper("", a.cfg.Auth.Token.TokenPath, http.DefaultTransport)	×
95	if err != nil {	×
96	return fmt.Errorf("failed to create bearer auth round tripper: %w", err)	×
97	}	×
98
99	clicfg.HTTPClient = &http.Client{	×
100	Transport: rt,	×
101	}	×
102	}
103
104	cli, err := fgaclient.NewSdkClient(clicfg)	3✔
105	if err != nil {	3✔
106	return fmt.Errorf("failed to create SDK client: %w", err)	×
107	}	×
108
109	a.cli = cli	3✔
110	return nil	3✔
111	}
112
113	// PrepareForRun initializes the authz client based on the configuration.
114	// This is handy when migrations have already been done and helps us auto-discover
115	// the store ID and model.
116	func (a *ClientWrapper) PrepareForRun(ctx context.Context) error {	2✔
117	storeID, err := a.findStoreByName(ctx)	2✔
118	if err != nil {	2✔
119	return fmt.Errorf("unable to find authz store: %w", err)	×
120	}	×
121
122	err = a.cli.SetStoreId(storeID)	2✔
123	if err != nil {	2✔
124	return fmt.Errorf("unable to store authz ID: %w", err)	×
125	}	×
126
127	modelID, err := a.findLatestModel(ctx)	2✔
128	if err != nil {	2✔
129	return fmt.Errorf("unable to find authz model: %w", err)	×
130	}	×
131
132	if err := a.cli.SetAuthorizationModelId(modelID); err != nil {	2✔
133	return fmt.Errorf("unable to set authz model: %w", err)	×
134	}	×
135
136	return nil	2✔
137	}
138
139	// StoreIDProvided returns true if the store ID was provided in the configuration
140	func (a *ClientWrapper) StoreIDProvided() bool {	3✔
141	return a.cfg.StoreID != ""	3✔
142	}	3✔
143
144	// MigrateUp runs the authz migrations. For OpenFGA this means creating the store
145	// and writing the authz model.
146	func (a *ClientWrapper) MigrateUp(ctx context.Context) error {	3✔
147	if !a.StoreIDProvided() {	6✔
148	if err := a.ensureAuthzStore(ctx); err != nil {	3✔
149	return err	×
150	}	×
151	}
152
153	m, err := a.writeModel(ctx)	3✔
154	if err != nil {	3✔
155	return fmt.Errorf("error while writing authz model: %w", err)	×
156	}	×
157
158	a.l.Printf("Wrote authz model %s\n", m)	3✔
159		3✔
160	return nil	3✔
161	}
162
163	func (a *ClientWrapper) ensureAuthzStore(ctx context.Context) error {	3✔
164	storeName := a.cfg.StoreName	3✔
165	storeID, err := a.findStoreByName(ctx)	3✔
166	if err != nil && !errors.Is(err, ErrStoreNotFound) {	3✔
167	return err	×
168	} else if errors.Is(err, ErrStoreNotFound) {	6✔
169	a.l.Printf("Creating authz store %s\n", storeName)	3✔
170	id, err := a.createStore(ctx)	3✔
171	if err != nil {	3✔
172	return err	×
173	}	×
174	a.l.Printf("Created authz store %s/%s\n", id, storeName)	3✔
175	err = a.cli.SetStoreId(id)	3✔
176	if err != nil {	3✔
177	return fmt.Errorf("unable to store authz ID: %w", err)	×
178	}	×
179	return nil	3✔
180	}
181
182	a.l.Printf("Not creating store. Found store with name '%s' and ID '%s'.\n",	×
183	storeName, storeID)	×
184		×
185	err = a.cli.SetStoreId(storeID)	×
186	if err != nil {	×
187	return fmt.Errorf("unable to store authz ID: %w", err)	×
188	}	×
189	return nil	×
190	}
191
192	// findStoreByName returns the store ID for the configured store name
193	func (a *ClientWrapper) findStoreByName(ctx context.Context) (string, error) {	5✔
194	stores, err := a.cli.ListStores(ctx).Execute()	5✔
195	if err != nil {	5✔
196	return "", fmt.Errorf("error while listing authz stores: %w", err)	×
197	}	×
198
199	// TODO: We might want to handle pagination here.
200	for _, store := range stores.Stores {	7✔
201	if store.Name == a.cfg.StoreName {	4✔
202	return store.Id, nil	2✔
203	}	2✔
204	}
205
206	return "", ErrStoreNotFound	3✔
207	}
208
209	// createStore creates a new store with the configured name
210	func (a *ClientWrapper) createStore(ctx context.Context) (string, error) {	3✔
211	st, err := a.cli.CreateStore(ctx).Body(fgaclient.ClientCreateStoreRequest{	3✔
212	Name: a.cfg.StoreName,	3✔
213	}).Execute()	3✔
214	if err != nil {	3✔
215	return "", fmt.Errorf("error while creating authz store: %w", err)	×
216	}	×
217
218	return st.Id, nil	3✔
219	}
220
221	// findLatestModel returns the latest authz model ID
222	func (a *ClientWrapper) findLatestModel(ctx context.Context) (string, error) {	2✔
223	resp, err := a.cli.ReadLatestAuthorizationModel(ctx).Execute()	2✔
224	if err != nil {	2✔
225	return "", fmt.Errorf("error while reading authz model: %w", err)	×
226	}	×
227
228	return resp.AuthorizationModel.Id, nil	2✔
229	}
230
231	// writeModel writes the authz model to the configured store
232	func (a *ClientWrapper) writeModel(ctx context.Context) (string, error) {	3✔
233	var body fgasdk.WriteAuthorizationModelRequest	3✔
234	if err := json.Unmarshal([]byte(authzModel), &body); err != nil {	3✔
235	return "", fmt.Errorf("failed to unmarshal authz model: %w", err)	×
236	}	×
237
238	data, err := a.cli.WriteAuthorizationModel(ctx).Body(body).Execute()	3✔
239	if err != nil {	3✔
240	return "", fmt.Errorf("error while writing authz model: %w", err)	×
241	}	×
242
243	return data.GetAuthorizationModelId(), nil	3✔
244	}
245
246	// Check checks if the user is authorized to perform the given action on the
247	// given project.
248	func (a *ClientWrapper) Check(ctx context.Context, action string, project uuid.UUID) error {	8✔
249	// TODO: set ClientCheckOptions like in	8✔
250	// https://openfga.dev/docs/getting-started/perform-check#02-calling-check-api	8✔
251	options := fgaclient.ClientCheckOptions{}	8✔
252	userString := getUserForTuple(jwt.GetUserSubjectFromContext(ctx))	8✔
253	body := fgaclient.ClientCheckRequest{	8✔
254	User: userString,	8✔
255	Relation: action,	8✔
256	Object: getProjectForTuple(project),	8✔
257	}	8✔
258	result, err := a.cli.Check(ctx).Options(options).Body(body).Execute()	8✔
259	if err != nil {	8✔
260	return fmt.Errorf("OpenFGA error for %s: %w", userString, err)	×
261	}	×
262	if result.Allowed != nil && *result.Allowed {	12✔
263	return nil	4✔
264	}	4✔
265	return ErrNotAuthorized	4✔
266	}
267
268	// Write persists the given role for the given user and project
269	func (a *ClientWrapper) Write(ctx context.Context, user string, role Role, project uuid.UUID) error {	4✔
270	return a.write(ctx, fgasdk.TupleKey{	4✔
271	User: getUserForTuple(user),	4✔
272	Relation: role.String(),	4✔
273	Object: getProjectForTuple(project),	4✔
274	})	4✔
275	}	4✔
276
277	// Adopt writes a relationship between the parent and child projects
278	func (a *ClientWrapper) Adopt(ctx context.Context, parent, child uuid.UUID) error {	×
279	return a.write(ctx, fgasdk.TupleKey{	×
280	User: getProjectForTuple(parent),	×
281	Relation: "parent",	×
282	Object: getProjectForTuple(child),	×
283	})	×
284	}	×
285
286	func (a *ClientWrapper) write(ctx context.Context, t fgasdk.TupleKey) error {	4✔
287	resp, err := a.cli.WriteTuples(ctx).Options(fgaclient.ClientWriteOptions{}).	4✔
288	Body([]fgasdk.TupleKey{t}).Execute()	4✔
289	if err != nil && strings.Contains(err.Error(), "already exists") {	4✔
290	return nil	×
291	} else if err != nil {	4✔
292	return fmt.Errorf("unable to persist authorization tuple: %w", err)	×
293	}	×
294
295	for _, w := range resp.Writes {	8✔
296	if w.Error != nil {	4✔
297	return fmt.Errorf("unable to persist authorization tuple: %w", w.Error)	×
298	}	×
299	}
300
301	return nil	4✔
302	}
303
304	// Delete removes the given role for the given user and project
305	func (a *ClientWrapper) Delete(ctx context.Context, user string, role Role, project uuid.UUID) error {	1✔
306	return a.doDelete(ctx, getUserForTuple(user), role.String(), getProjectForTuple(project))	1✔
307	}	1✔
308
309	// Orphan removes the relationship between the parent and child projects
310	func (a *ClientWrapper) Orphan(ctx context.Context, parent, child uuid.UUID) error {	×
311	return a.doDelete(ctx, getProjectForTuple(parent), "parent", getProjectForTuple(child))	×
312	}	×
313
314	// doDelete wraps the OpenFGA DeleteTuples call and handles edge cases as needed. It takes
315	// the user, role, and project as tuple-formatted strings.
316	func (a *ClientWrapper) doDelete(ctx context.Context, user string, role string, project string) error {	3✔
317	resp, err := a.cli.DeleteTuples(ctx).Options(fgaclient.ClientWriteOptions{}).Body([]fgasdk.TupleKeyWithoutCondition{	3✔
318	{	3✔
319	User: user,	3✔
320	Relation: role,	3✔
321	Object: project,	3✔
322	},	3✔
323	}).Execute()	3✔
324	if err != nil && strings.Contains(err.Error(), "cannot delete a tuple which does not exist") {	3✔
325	return nil	×
326	} else if err != nil {	3✔
327	return fmt.Errorf("unable to remove authorization tuple: %w", err)	×
328	}	×
329
330	for _, w := range resp.Deletes {	6✔
331	if w.Error != nil {	3✔
332	return fmt.Errorf("unable to remove authorization tuple: %w", w.Error)	×
333	}	×
334	}
335
336	return nil	3✔
337	}
338
339	// DeleteUser removes all tuples for the given user
340	func (a *ClientWrapper) DeleteUser(ctx context.Context, user string) error {	1✔
341	for role := range AllRolesDescriptions {	6✔
342	listresp, err := a.cli.ListObjects(ctx).Body(fgaclient.ClientListObjectsRequest{	5✔
343	Type: "project",	5✔
344	Relation: role.String(),	5✔
345	User: getUserForTuple(user),	5✔
346	}).Execute()	5✔
347	if err != nil {	5✔
348	return fmt.Errorf("unable to list authorization tuples: %w", err)	×
349	}	×
350
351	for _, obj := range listresp.GetObjects() {	7✔
352	if err := a.doDelete(ctx, getUserForTuple(user), role.String(), obj); err != nil {	2✔
353	return err	×
354	}	×
355	}
356	}
357
358	return nil	1✔
359	}
360
361	// AssignmentsToProject lists the current role assignments that are scoped to a project
362	func (a ClientWrapper) AssignmentsToProject(ctx context.Context, project uuid.UUID) ([]minderv1.RoleAssignment, error) {	5✔
363	o := getProjectForTuple(project)	5✔
364	prjStr := project.String()	5✔
365		5✔
366	var pagesize int32 = 50	5✔
367	var contTok *string = nil	5✔
368		5✔
369	assignments := []*minderv1.RoleAssignment{}	5✔
370		5✔
371	for {	10✔
372	resp, err := a.cli.Read(ctx).Options(fgaclient.ClientReadOptions{	5✔
373	PageSize: &pagesize,	5✔
374	ContinuationToken: contTok,	5✔
375	}).Body(fgaclient.ClientReadRequest{	5✔
376	Object: &o,	5✔
377	}).Execute()	5✔
378	if err != nil {	5✔
379	return nil, fmt.Errorf("unable to read authorization tuples: %w", err)	×
380	}	×
381
382	for _, t := range resp.GetTuples() {	8✔
383	k := t.GetKey()	3✔
384	r, err := ParseRole(k.GetRelation())	3✔
385	if err != nil {	3✔
386	a.l.Err(err).Msg("Found invalid role in authz store")	×
387	continue	×
388	}
389	assignments = append(assignments, &minderv1.RoleAssignment{	3✔
390	Subject: getUserFromTuple(k.GetUser()),	3✔
391	Role: r.String(),	3✔
392	Project: &prjStr,	3✔
393	})	3✔
394	}
395
396	if resp.GetContinuationToken() == "" {	10✔
397	break	5✔
398	}
399
400	contTok = &resp.ContinuationToken	×
401	}
402
403	return assignments, nil	5✔
404	}
405
406	// ProjectsForUser lists the projects that the given user has access to
407	func (a *ClientWrapper) ProjectsForUser(ctx context.Context, sub string) ([]uuid.UUID, error) {	4✔
408	u := getUserForTuple(sub)	4✔
409		4✔
410	var pagesize int32 = 50	4✔
411	var contTok *string = nil	4✔
412		4✔
413	projs := map[string]any{}	4✔
414	projectObj := "project:"	4✔
415		4✔
416	for {	8✔
417	resp, err := a.cli.Read(ctx).Options(fgaclient.ClientReadOptions{	4✔
418	PageSize: &pagesize,	4✔
419	ContinuationToken: contTok,	4✔
420	}).Body(fgaclient.ClientReadRequest{	4✔
421	User: &u,	4✔
422	Object: &projectObj,	4✔
423	}).Execute()	4✔
424	if err != nil {	4✔
425	return nil, fmt.Errorf("unable to read authorization tuples: %w", err)	×
426	}	×
427
428	for _, t := range resp.GetTuples() {	7✔
429	k := t.GetKey()	3✔
430		3✔
431	projs[k.GetObject()] = struct{}{}	3✔
432	}	3✔
433
434	if resp.GetContinuationToken() == "" {	8✔
435	break	4✔
436	}
437
438	contTok = &resp.ContinuationToken	×
439	}
440
441	out := []uuid.UUID{}	4✔
442	for proj := range projs {	7✔
443	u, err := uuid.Parse(getProjectFromTuple(proj))	3✔
444	if err != nil {	3✔
445	continue	×
446	}
447
448	out = append(out, u)	3✔
449		3✔
450	children, err := a.traverseProjectsForParent(ctx, u)	3✔
451	if err != nil {	3✔
452	return nil, err	×
453	}	×
454
455	out = append(out, children...)	3✔
456	}
457
458	return out, nil	4✔
459	}
460
461	// traverseProjectsForParent is a recursive function that traverses the project
462	// hierarchy to find all projects that the parent project has access to.
463	func (a *ClientWrapper) traverseProjectsForParent(ctx context.Context, parent uuid.UUID) ([]uuid.UUID, error) {	3✔
464	projects := []uuid.UUID{}	3✔
465		3✔
466	resp, err := a.cli.ListObjects(ctx).Body(fgaclient.ClientListObjectsRequest{	3✔
467	User: getProjectForTuple(parent),	3✔
468	Relation: "parent",	3✔
469	Type: "project",	3✔
470	}).Execute()	3✔
471		3✔
472	if err != nil {	3✔
473	return nil, fmt.Errorf("unable to read authorization tuples: %w", err)	×
474	}	×
475
476	for _, obj := range resp.GetObjects() {	3✔
477	u, err := uuid.Parse(getProjectFromTuple(obj))	×
478	if err != nil {	×
479	continue	×
480	}
481	projects = append(projects, u)	×
482	}
483
484	for _, proj := range projects {	3✔
485	children, err := a.traverseProjectsForParent(ctx, proj)	×
486	if err != nil {	×
487	return nil, err	×
488	}	×
489	projects = append(projects, children...)	×
490	}
491
492	return projects, nil	3✔
493	}
494
495	func getUserForTuple(user string) string {	24✔
496	return "user:" + user	24✔
497	}	24✔
498
499	func getProjectForTuple(project uuid.UUID) string {	21✔
500	return "project:" + project.String()	21✔
501	}	21✔
502
503	func getUserFromTuple(user string) string {	3✔
504	return strings.TrimPrefix(user, "user:")	3✔
505	}	3✔
506
507	func getProjectFromTuple(project string) string {	3✔
508	return strings.TrimPrefix(project, "project:")	3✔
509	}	3✔

stacklok / minder / 10628909244

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous