2022-05-17 18:43:19 +00:00
|
|
|
package coderd
|
|
|
|
|
|
|
|
import (
|
|
|
|
"net/http"
|
|
|
|
|
|
|
|
"golang.org/x/xerrors"
|
|
|
|
|
|
|
|
"cdr.dev/slog"
|
|
|
|
|
|
|
|
"github.com/coder/coder/coderd/httpapi"
|
|
|
|
"github.com/coder/coder/coderd/httpmw"
|
|
|
|
"github.com/coder/coder/coderd/rbac"
|
|
|
|
)
|
|
|
|
|
2022-05-26 03:14:08 +00:00
|
|
|
func AuthorizeFilter[O rbac.Objecter](api *API, r *http.Request, action rbac.Action, objects []O) []O {
|
2022-06-01 14:07:50 +00:00
|
|
|
roles := httpmw.AuthorizationUserRoles(r)
|
2022-05-24 13:43:34 +00:00
|
|
|
return rbac.Filter(r.Context(), api.Authorizer, roles.ID.String(), roles.Roles, action, objects)
|
|
|
|
}
|
|
|
|
|
2022-05-26 03:14:08 +00:00
|
|
|
func (api *API) Authorize(rw http.ResponseWriter, r *http.Request, action rbac.Action, object rbac.Objecter) bool {
|
2022-06-01 14:07:50 +00:00
|
|
|
roles := httpmw.AuthorizationUserRoles(r)
|
2022-05-24 13:43:34 +00:00
|
|
|
err := api.Authorizer.ByRoleName(r.Context(), roles.ID.String(), roles.Roles, action, object.RBACObject())
|
2022-05-17 18:43:19 +00:00
|
|
|
if err != nil {
|
2022-06-03 21:48:09 +00:00
|
|
|
httpapi.Forbidden(rw)
|
2022-05-17 18:43:19 +00:00
|
|
|
|
|
|
|
// Log the errors for debugging
|
|
|
|
internalError := new(rbac.UnauthorizedError)
|
|
|
|
logger := api.Logger
|
|
|
|
if xerrors.As(err, internalError) {
|
|
|
|
logger = api.Logger.With(slog.F("internal", internalError.Internal()))
|
|
|
|
}
|
|
|
|
// Log information for debugging. This will be very helpful
|
|
|
|
// in the early days
|
|
|
|
logger.Warn(r.Context(), "unauthorized",
|
|
|
|
slog.F("roles", roles.Roles),
|
|
|
|
slog.F("user_id", roles.ID),
|
|
|
|
slog.F("username", roles.Username),
|
|
|
|
slog.F("route", r.URL.Path),
|
|
|
|
slog.F("action", action),
|
|
|
|
slog.F("object", object),
|
|
|
|
)
|
|
|
|
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
return true
|
|
|
|
}
|