-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #25 from sev-2/feature/storage-acl
feature : add storage acl
- Loading branch information
Showing
24 changed files
with
918 additions
and
252 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| package generator | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "strings" | ||
| "unicode" | ||
|
|
||
| "github.com/sev-2/raiden/pkg/supabase" | ||
| "github.com/sev-2/raiden/pkg/supabase/objects" | ||
| ) | ||
|
|
||
| type Rls struct { | ||
| CanWrite []string | ||
| CanRead []string | ||
| } | ||
|
|
||
| func BuildRlsTag(rlsList objects.Policies, name string, rlsType supabase.RlsType) string { | ||
| var rls Rls | ||
|
|
||
| var readUsingTag, writeCheckTag, writeUsingTag string | ||
| for _, v := range rlsList { | ||
| switch v.Command { | ||
| case objects.PolicyCommandSelect: | ||
| if v.Name == supabase.GetPolicyName(objects.PolicyCommandSelect, strings.ToLower(string(rlsType)), name) { | ||
| rls.CanRead = append(rls.CanRead, v.Roles...) | ||
| if v.Definition != "" { | ||
| readUsingTag = v.Definition | ||
| } | ||
| } | ||
| case objects.PolicyCommandInsert, objects.PolicyCommandUpdate, objects.PolicyCommandDelete: | ||
| if v.Name == supabase.GetPolicyName(objects.PolicyCommandInsert, strings.ToLower(string(rlsType)), name) { | ||
| if len(rls.CanWrite) == 0 { | ||
| rls.CanWrite = append(rls.CanWrite, v.Roles...) | ||
| } | ||
|
|
||
| if len(writeCheckTag) == 0 && v.Check != nil { | ||
| writeCheckTag = *v.Check | ||
| } | ||
| } | ||
|
|
||
| if v.Name == supabase.GetPolicyName(objects.PolicyCommandUpdate, strings.ToLower(string(rlsType)), name) && len(rls.CanWrite) == 0 { | ||
| if len(rls.CanWrite) == 0 { | ||
| rls.CanWrite = append(rls.CanWrite, v.Roles...) | ||
| } | ||
|
|
||
| if len(writeCheckTag) == 0 && v.Check != nil { | ||
| writeCheckTag = *v.Check | ||
| } | ||
|
|
||
| if len(writeUsingTag) == 0 && v.Definition != "" { | ||
| writeUsingTag = v.Definition | ||
| } | ||
| } | ||
|
|
||
| if v.Name == supabase.GetPolicyName(objects.PolicyCommandDelete, strings.ToLower(string(rlsType)), name) && len(rls.CanWrite) == 0 { | ||
| if len(rls.CanWrite) == 0 { | ||
| rls.CanWrite = append(rls.CanWrite, v.Roles...) | ||
| } | ||
|
|
||
| if len(writeUsingTag) == 0 && v.Definition != "" { | ||
| writeUsingTag = v.Definition | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| rlsTag := fmt.Sprintf("read:%q write:%q", strings.Join(rls.CanRead, ","), strings.Join(rls.CanWrite, ",")) | ||
| if len(readUsingTag) > 0 { | ||
| cleanTag := strings.TrimLeft(strings.TrimRight(readUsingTag, ")"), "(") | ||
| if rlsType == supabase.RlsTypeStorage { | ||
| cleanTag = cleanupRlsTagStorage(name, cleanTag) | ||
| } | ||
|
|
||
| if cleanTag != "" { | ||
| rlsTag = fmt.Sprintf("%s readUsing:%q", rlsTag, cleanTag) | ||
| } | ||
| } | ||
|
|
||
| if len(writeCheckTag) > 0 { | ||
| cleanTag := strings.TrimLeft(strings.TrimRight(writeCheckTag, ")"), "(") | ||
| if rlsType == supabase.RlsTypeStorage { | ||
| cleanTag = cleanupRlsTagStorage(name, cleanTag) | ||
| } | ||
|
|
||
| if cleanTag != "" { | ||
| rlsTag = fmt.Sprintf("%s writeCheck:%q", rlsTag, cleanTag) | ||
| } | ||
| } | ||
|
|
||
| if len(writeUsingTag) > 0 { | ||
| cleanTag := strings.TrimLeft(strings.TrimRight(writeUsingTag, ")"), "(") | ||
| if rlsType == supabase.RlsTypeStorage { | ||
| cleanTag = cleanupRlsTagStorage(name, cleanTag) | ||
| } | ||
|
|
||
| if cleanTag != "" { | ||
| rlsTag = fmt.Sprintf("%s writeUsing:%q", rlsTag, cleanTag) | ||
| } | ||
| } | ||
|
|
||
| return rlsTag | ||
| } | ||
|
|
||
| func cleanupRlsTagStorage(name, tag string) string { | ||
| // clean storage identifier | ||
| cleanTag := strings.Replace(tag, fmt.Sprintf("bucket_id = '%s'", name), "", 1) | ||
| cleanTag = strings.Replace(cleanTag, "AND", "", 1) | ||
| cleanTag = strings.Replace(cleanTag, "OR", "", 1) | ||
| cleanTag = strings.TrimLeftFunc(cleanTag, unicode.IsSpace) | ||
| return cleanTag | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| package generator_test | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "testing" | ||
|
|
||
| "github.com/sev-2/raiden/pkg/generator" | ||
| "github.com/sev-2/raiden/pkg/supabase" | ||
| "github.com/sev-2/raiden/pkg/supabase/objects" | ||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| const dummyPolicies = ` | ||
| [ | ||
| { | ||
| "id": 30023, | ||
| "schema": "storage", | ||
| "table": "objects", | ||
| "table_id": 29647, | ||
| "name": "enable select access for storage my-storage", | ||
| "action": "PERMISSIVE", | ||
| "roles": [ | ||
| "admin_scouter", | ||
| "anon", | ||
| "authenticated" | ||
| ], | ||
| "command": "SELECT", | ||
| "definition": "(bucket_id = 'my-storage'::text)", | ||
| "check": null | ||
| }, | ||
| { | ||
| "id": 30022, | ||
| "schema": "storage", | ||
| "table": "objects", | ||
| "table_id": 29647, | ||
| "name": "enable update access for storage my-storage", | ||
| "action": "PERMISSIVE", | ||
| "roles": [ | ||
| "admin_scouter", | ||
| "authenticated" | ||
| ], | ||
| "command": "UPDATE", | ||
| "definition": "(bucket_id = 'my-storage'::text)", | ||
| "check": null | ||
| }, | ||
| { | ||
| "id": 30021, | ||
| "schema": "storage", | ||
| "table": "objects", | ||
| "table_id": 29647, | ||
| "name": "enable delete access for storage my-storage", | ||
| "action": "PERMISSIVE", | ||
| "roles": [ | ||
| "admin_scouter", | ||
| "authenticated" | ||
| ], | ||
| "command": "DELETE", | ||
| "definition": "(bucket_id = 'my-storage'::text)", | ||
| "check": null | ||
| }, | ||
| { | ||
| "id": 30020, | ||
| "schema": "storage", | ||
| "table": "objects", | ||
| "table_id": 29647, | ||
| "name": "enable insert access for storage my-storage", | ||
| "action": "PERMISSIVE", | ||
| "roles": [ | ||
| "admin_scouter", | ||
| "authenticated" | ||
| ], | ||
| "command": "INSERT", | ||
| "definition": "", | ||
| "check": "(bucket_id = 'my-storage'::text)" | ||
| } | ||
| ] | ||
| ` | ||
|
|
||
| func TestBuildStorageRlsTag(t *testing.T) { | ||
| var bucket = objects.Bucket{Name: "my-storage"} | ||
|
|
||
| var policies objects.Policies | ||
| err := json.Unmarshal([]byte(dummyPolicies), &policies) | ||
| assert.NoError(t, err) | ||
|
|
||
| storagePolicies := policies.FilterByBucket(bucket) | ||
| rlsTag := generator.BuildRlsTag(storagePolicies, bucket.Name, supabase.RlsTypeStorage) | ||
| expectedTag := `read:"admin_scouter,anon,authenticated" write:"admin_scouter,authenticated" readUsing:"bucket_id = 'my-storage'::text" writeCheck:"bucket_id = 'my-storage'::text" writeUsing:"bucket_id = 'my-storage'::text"` | ||
| assert.Equal(t, expectedTag, rlsTag) | ||
| } |
Oops, something went wrong.