Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Using new permissions system #111

Merged
merged 12 commits into from Jan 10, 2021
Merged

Using new permissions system #111

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
86d348b
Using new permissions system
kay0u Feb 8, 2020
65e0c8e
better migration to the new permission process
kay0u Mar 30, 2020
e5f2a45
Add public access only if already there
maniackcrudelis Mar 30, 2020
9b1dbbd
Add ynh_permission_has_user helper
maniackcrudelis Mar 30, 2020
c30b9a6
Merge pull request #112 from YunoHost/ynh_permission_has_user
maniackcrudelis Mar 30, 2020
1e2ee09
Update _common.sh
kay0u Oct 2, 2020
9b6cc80
Improve permissions management
kay0u Jan 6, 2021
55fb01f
Merge remote-tracking branch 'origin/master' into permissions
kay0u Jan 6, 2021
f4e7ffa
Typo
kay0u Jan 6, 2021
07539cb
Update manifest.json
kay0u Jan 7, 2021
3c26342
Update scripts/upgrade
alexAubin Jan 10, 2021
bd44d21
Apply suggestions from code review
kay0u Jan 10, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion manifest.json
View file
Open in desktop
Expand Up @@ -15,7 +15,7 @@
"url": "http://example.com"
},
"requirements": {
"yunohost": ">= 3.5"
"yunohost": ">= 4.1.3"
},
"multi_instance": true,
"services": [
Expand Down
24 changes: 15 additions & 9 deletions scripts/install
View file
Open in desktop
Expand Up @@ -72,7 +72,6 @@ ynh_script_progression --message="Storing installation settings..." --time --wei
ynh_app_setting_set --app=$app --key=domain --value=$domain
ynh_app_setting_set --app=$app --key=path --value=$path_url
ynh_app_setting_set --app=$app --key=admin --value=$admin
ynh_app_setting_set --app=$app --key=is_public --value=$is_public
ynh_app_setting_set --app=$app --key=language --value=$language

#=================================================
Expand Down Expand Up @@ -221,7 +220,8 @@ chown -R $app: $final_path

# Set the app as temporarily public for curl call
ynh_script_progression --message="Configuring SSOwat..." --time --weight=1
ynh_app_setting_set --app=$app --key=skipped_uris --value="/"
# Making the app public for curl
ynh_permission_update --permission="main" --add="visitors"
# Reload SSOwat config
yunohost app ssowatconf

Expand All @@ -233,10 +233,7 @@ ynh_script_progression --message="Finalizing installation..." --time --weight=1
ynh_local_curl "/INSTALL_PATH" "key1=value1" "key2=value2" "key3=value3"

# Remove the public access
if [ $is_public -eq 0 ]
then
ynh_app_setting_delete --app=$app --key=skipped_uris
fi
ynh_permission_update --permission="main" --remove="visitors"

#=================================================
# MODIFY A CONFIG FILE
Expand Down Expand Up @@ -346,15 +343,24 @@ ynh_add_fail2ban_config --logpath="/var/log/nginx/${domain}-error.log" --failreg
#=================================================
# SETUP SSOWAT
#=================================================
ynh_script_progression --message="Configuring SSOwat..." --time --weight=1
ynh_script_progression --message="Configuring permissions..." --time --weight=1

# Make app public if necessary
if [ $is_public -eq 1 ]
then
# unprotected_uris allows SSO credentials to be passed anyway.
ynh_app_setting_set --app=$app --key=unprotected_uris --value="/"
# Everyone can access the app.
# The "main" permission is automatically created before the install script.
ynh_permission_update --permission="main" --add="visitors"
fi

# Only the admin can access the admin panel of the app (if the app has an admin panel)
ynh_permission_create --permission="admin" --url="/admin" --allowed=$admin

# Everyone can access to the api part
# We don't want to display the tile in the sso so we put --show_tile="false"
# And we don't want that the YunoHost Admin can remove visitors group to this permission, so we put --protected="true"
ynh_permission_create --permission="api" --url "/api" --allowed="visitors" --show_tile="false" --protected="true"

#=================================================
# RELOAD NGINX
#=================================================
Expand Down
33 changes: 20 additions & 13 deletions scripts/upgrade
View file
Open in desktop
Expand Up @@ -19,7 +19,6 @@ app=$YNH_APP_INSTANCE_NAME
domain=$(ynh_app_setting_get --app=$app --key=domain)
path_url=$(ynh_app_setting_get --app=$app --key=path)
admin=$(ynh_app_setting_get --app=$app --key=admin)
is_public=$(ynh_app_setting_get --app=$app --key=is_public)
final_path=$(ynh_app_setting_get --app=$app --key=final_path)
language=$(ynh_app_setting_get --app=$app --key=language)
db_name=$(ynh_app_setting_get --app=$app --key=db_name)
Expand Down Expand Up @@ -59,6 +58,26 @@ ynh_script_progression --message="Ensuring downward compatibility..." --time --w
# ynh_app_setting_set --app=$app --key=final_path --value=$final_path
#fi

### If nobody installed your app before 4.1,
### then you may safely remove these lines

# Cleaning legacy permissions
if ynh_legacy_permissions_exists; then
ynh_legacy_permissions_delete_all

ynh_app_setting_delete --app=$app --key=is_public
fi

if ! ynh_permission_exists --permission="admin"; then
# Create the required permissions
alexAubin marked this conversation as resolved.
Show resolved Hide resolved
ynh_permission_create --permission="admin" --url="/admin" --allowed=$admin
fi

# Create a permission if needed
if ! ynh_permission_exists --permission="api"; then
ynh_permission_create --permission="api" --url "/api" --allowed="visitors" --show_tile="false" --protected="true"
fi

#=================================================
# BACKUP BEFORE UPGRADE THEN ACTIVE TRAP
#=================================================
Expand Down Expand Up @@ -191,18 +210,6 @@ ynh_script_progression --message="Reconfiguring Fail2Ban..." --time --weight=1
# Create a dedicated Fail2Ban config
ynh_add_fail2ban_config --logpath="/var/log/nginx/${domain}-error.log" --failregex="Regex to match into the log for a failed login"

#=================================================
# SETUP SSOWAT
#=================================================
ynh_script_progression --message="Upgrading SSOwat configuration..." --time --weight=1

# Make app public if necessary
if [ $is_public -eq 1 ]
then
# unprotected_uris allows SSO credentials to be passed anyway
ynh_app_setting_set --app=$app --key=unprotected_uris --value="/"
fi

#=================================================
# RELOAD NGINX
#=================================================
Expand Down