zentralopensource / zentral / 39417527296

91%

Build Type

push

github

Committed by np5

Commit Message

turbo: type the scheduling actions, and retire their permissions

createOneTimeJob, updateOneTimeJob and deleteOneTimeJob, and
createRecurringJob, updateRecurringJob and deleteRecurringJob, are typed
PBAC actions now.

A create action takes the CONFIGURATION as its resource, because the
schedule does not exist yet. An update or a delete action takes the
SCHEDULE. A schedule is a member of its configuration, so one policy on a
configuration covers the six actions. A schedule also carries the job that
it runs, so an update or a delete policy can read resource.job. The six
actions have the JOB as an entity in context.job, so one policy can name
them all:

  forbid (
    principal,
    action in [Turbo::Action::"createOneTimeJob",
               Turbo::Action::"updateOneTimeJob",
               Turbo::Action::"deleteOneTimeJob"],
    resource
  ) when { context.job.kind == "file_export" };

An entity, not a kind string: context.job.kind gives what a job_kind key
gives, and a policy can read any attribute that the job declares later,
with no change to the actions. The values of the kind stay declared on the
kind attribute of Turbo::Job.

Every kind is covered, not only the sysdiagnose and the file export. A
script runs any code as root, and add_onetimejob did not tell it from an
mSCP check. The two schedule models are covered in one step: with only the
one-time jobs typed, a role with turbo.add_recurringjob could still
schedule a recurring script in a configuration that a policy refused.

The add, change and delete permissions of the two schedule models map to
no action now (JobScope.pbac_excluded_default_permissions), so nothing can
ask these actions through has_perm with System::"any" and an empty context.
The view permissions stay: a typed view action must scope a list, which
means a policy filters a queryset instead of a decision on one request.
That is separate work, and a test keeps them mapped. Only our own servers
have the Turbo module, so no role ... (continued)

Coverage Stats

202 of 202 new or added lines in 11 files covered. (100.0%)

3 existing lines in 2 files now uncovered.

53422 of 58695 relevant lines covered (91.02%)

0.91 hits per line