Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
refactor(fallback): Add FallbackPermissionsResolver and default imple…
…mentation (#521)
- Loading branch information
Showing
9 changed files
with
139 additions
and
24 deletions.
There are no files selected for viewing
38 changes: 38 additions & 0 deletions
38
.../main/java/com/netflix/spinnaker/fiat/permissions/DefaultFallbackPermissionsResolver.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| package com.netflix.spinnaker.fiat.permissions; | ||
|
|
||
| import static java.util.function.Function.identity; | ||
| import static java.util.stream.Collectors.toMap; | ||
|
|
||
| import com.netflix.spinnaker.fiat.model.Authorization; | ||
| import com.netflix.spinnaker.fiat.model.resources.Permissions; | ||
| import java.util.Arrays; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
| import javax.annotation.Nonnull; | ||
|
|
||
| public class DefaultFallbackPermissionsResolver implements FallbackPermissionsResolver { | ||
|
|
||
| private final Authorization fallbackFrom; | ||
| private final Authorization fallbackTo; | ||
|
|
||
| public DefaultFallbackPermissionsResolver(Authorization fallbackFrom, Authorization fallbackTo) { | ||
| this.fallbackFrom = fallbackFrom; | ||
| this.fallbackTo = fallbackTo; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean shouldResolve(@Nonnull Permissions permissions) { | ||
| return permissions.isRestricted() && unpackPermissions(permissions).get(fallbackFrom).isEmpty(); | ||
| } | ||
|
|
||
| @Override | ||
| public Permissions resolve(@Nonnull Permissions permissions) { | ||
| Map<Authorization, List<String>> authorizations = unpackPermissions(permissions); | ||
| authorizations.put(fallbackFrom, authorizations.get(fallbackTo)); | ||
| return Permissions.Builder.factory(authorizations).build(); | ||
| } | ||
|
|
||
| private Map<Authorization, List<String>> unpackPermissions(Permissions permissions) { | ||
| return Arrays.stream(Authorization.values()).collect(toMap(identity(), permissions::get)); | ||
| } | ||
| } |
28 changes: 28 additions & 0 deletions
28
...les/src/main/java/com/netflix/spinnaker/fiat/permissions/FallbackPermissionsResolver.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| package com.netflix.spinnaker.fiat.permissions; | ||
|
|
||
| import com.netflix.spinnaker.fiat.model.resources.Permissions; | ||
| import javax.annotation.Nonnull; | ||
|
|
||
| /** | ||
| * Resolve permissions. This is useful if you do not have a way to configure a particular permission | ||
| * and so want to apply one permission group type to another. | ||
| */ | ||
| public interface FallbackPermissionsResolver { | ||
|
|
||
| /** | ||
| * Determine if resolving fallback permissions is necessary - typically checking if permissions | ||
| * are restricted. | ||
| * | ||
| * @param permissions | ||
| * @return boolean | ||
| */ | ||
| boolean shouldResolve(@Nonnull Permissions permissions); | ||
|
|
||
| /** | ||
| * Resolve fallback permissions. | ||
| * | ||
| * @param permissions | ||
| * @return The resolved Permissions | ||
| */ | ||
| Permissions resolve(@Nonnull Permissions permissions); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
36 changes: 36 additions & 0 deletions
36
...oovy/com/netflix/spinnaker/fiat/permissions/DefaultFallbackPermissionsResolverSpec.groovy
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| package com.netflix.spinnaker.fiat.permissions | ||
|
|
||
| import com.netflix.spinnaker.fiat.model.Authorization | ||
| import com.netflix.spinnaker.fiat.model.resources.Permissions | ||
| import spock.lang.Specification | ||
| import spock.lang.Unroll | ||
|
|
||
| class DefaultFallbackPermissionsResolverSpec extends Specification { | ||
| private static final Authorization R = Authorization.READ | ||
| private static final Authorization W = Authorization.WRITE | ||
| private static final Authorization E = Authorization.EXECUTE | ||
| private static final Authorization C = Authorization.CREATE | ||
|
|
||
| def makePerms(Map<Authorization, List<String>> auths) { | ||
| return Permissions.Builder.factory(auths).build() | ||
| } | ||
|
|
||
| @Unroll | ||
| def "should add fallback permissions based on fallbackTo value" () { | ||
| setup: | ||
| FallbackPermissionsResolver fallbackResolver = new DefaultFallbackPermissionsResolver(fallbackFrom, fallbackTo) | ||
|
|
||
| when: | ||
| def result = fallbackResolver.resolve(makePerms(givenPermissions)) | ||
|
|
||
| then: | ||
| makePerms(expectedPermissions) == result | ||
|
|
||
| where: | ||
| fallbackFrom || fallbackTo || givenPermissions || expectedPermissions | ||
| E || R || [:] || [:] | ||
| E || R || [(R): ['r']] || [(R): ['r'], (E): ['r']] | ||
| E || W || [(R): ['r'], (W): ['w']] || [(R): ['r'], (W): ['w'], (E): ['w']] | ||
| C || W || [(R): ['r'], (W): ['w']] || [(R): ['r'], (W): ['w'], (C): ['w']] | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters