forked from hashicorp/vault
-
Notifications
You must be signed in to change notification settings - Fork 0
/
capabilities.go
75 lines (61 loc) · 1.65 KB
/
capabilities.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
package vault
// Struct to identify user input errors.
// This is helpful in responding the appropriate status codes to clients
// from the HTTP endpoints.
type StatusBadRequest struct {
Err string
}
// Implementing error interface
func (s *StatusBadRequest) Error() string {
return s.Err
}
// CapabilitiesAccessor is used to fetch the capabilities of the token
// which associated with the given accessor on the given path
func (c *Core) CapabilitiesAccessor(accessor, path string) ([]string, error) {
if path == "" {
return nil, &StatusBadRequest{Err: "missing path"}
}
if accessor == "" {
return nil, &StatusBadRequest{Err: "missing accessor"}
}
token, err := c.tokenStore.lookupByAccessor(accessor)
if err != nil {
return nil, err
}
return c.Capabilities(token, path)
}
// Capabilities is used to fetch the capabilities of the given token on the given path
func (c *Core) Capabilities(token, path string) ([]string, error) {
if path == "" {
return nil, &StatusBadRequest{Err: "missing path"}
}
if token == "" {
return nil, &StatusBadRequest{Err: "missing token"}
}
te, err := c.tokenStore.Lookup(token)
if err != nil {
return nil, err
}
if te == nil {
return nil, &StatusBadRequest{Err: "invalid token"}
}
if te.Policies == nil {
return []string{DenyCapability}, nil
}
var policies []*Policy
for _, tePolicy := range te.Policies {
policy, err := c.policyStore.GetPolicy(tePolicy)
if err != nil {
return nil, err
}
policies = append(policies, policy)
}
if len(policies) == 0 {
return []string{DenyCapability}, nil
}
acl, err := NewACL(policies)
if err != nil {
return nil, err
}
return acl.Capabilities(path), nil
}