Skip to content

Commit

Permalink
broker,service,team,quota: propagate context
Browse files Browse the repository at this point in the history
  • Loading branch information
@wpjunior
wpjunior committed Sep 21, 2020
1 parent 09164a1 commit 28bb369
Show file tree
Hide file tree
Showing 66 changed files with 864 additions and 664 deletions.
16 changes: 9 additions & 7 deletions api/app.go
View file
Expand Up @@ -305,15 +305,15 @@ type inputApp struct {
PlanOverride appTypes.PlanOverride
}

func autoTeamOwner(t auth.Token, perm *permission.PermissionScheme) (string, error) {
func autoTeamOwner(ctx stdContext.Context, t auth.Token, perm *permission.PermissionScheme) (string, error) {
team, err := permission.TeamForPermission(t, perm)
if err == nil {
return team, nil
}
if err != permission.ErrTooManyTeams {
return "", err
}
teams, listErr := servicemanager.Team.List()
teams, listErr := servicemanager.Team.List(ctx)
if listErr != nil {
return "", listErr
}
Expand Down Expand Up @@ -356,7 +356,7 @@ func createApp(w http.ResponseWriter, r *http.Request, t auth.Token) (err error)
tags, _ := InputValues(r, "tag")
a.Tags = append(a.Tags, tags...) // for compatibility
if a.TeamOwner == "" {
a.TeamOwner, err = autoTeamOwner(t, permission.PermAppCreate)
a.TeamOwner, err = autoTeamOwner(ctx, t, permission.PermAppCreate)
if err != nil {
return err
}
Expand Down Expand Up @@ -766,6 +766,7 @@ func setNodeStatus(w http.ResponseWriter, r *http.Request, t auth.Token) error {
// 404: App or team not found
// 409: Grant already exists
func grantAppAccess(w http.ResponseWriter, r *http.Request, t auth.Token) (err error) {
ctx := r.Context()
appName := r.URL.Query().Get(":app")
teamName := r.URL.Query().Get(":team")
a, err := getAppFromContext(appName, r)
Expand All @@ -789,7 +790,7 @@ func grantAppAccess(w http.ResponseWriter, r *http.Request, t auth.Token) (err e
return err
}
defer func() { evt.Done(err) }()
team, err := servicemanager.Team.FindByName(teamName)
team, err := servicemanager.Team.FindByName(ctx, teamName)
if err != nil {
return &errors.HTTP{Code: http.StatusNotFound, Message: "Team not found"}
}
Expand All @@ -809,6 +810,7 @@ func grantAppAccess(w http.ResponseWriter, r *http.Request, t auth.Token) (err e
// 403: Forbidden
// 404: App or team not found
func revokeAppAccess(w http.ResponseWriter, r *http.Request, t auth.Token) (err error) {
ctx := r.Context()
appName := r.URL.Query().Get(":app")
teamName := r.URL.Query().Get(":team")
a, err := getAppFromContext(appName, r)
Expand All @@ -832,7 +834,7 @@ func revokeAppAccess(w http.ResponseWriter, r *http.Request, t auth.Token) (err
return err
}
defer func() { evt.Done(err) }()
team, err := servicemanager.Team.FindByName(teamName)
team, err := servicemanager.Team.FindByName(ctx, teamName)
if err != nil || team == nil {
return &errors.HTTP{Code: http.StatusNotFound, Message: "Team not found"}
}
Expand Down Expand Up @@ -1285,7 +1287,7 @@ func getServiceInstance(ctx stdContext.Context, serviceName, instanceName, appNa
return nil, nil, err
}
defer conn.Close()
instance, err := getServiceInstanceOrError(serviceName, instanceName)
instance, err := getServiceInstanceOrError(ctx, serviceName, instanceName)
if err != nil {
return nil, nil, err
}
Expand Down Expand Up @@ -1426,7 +1428,7 @@ func unbindServiceInstance(w http.ResponseWriter, r *http.Request, t auth.Token)
return permission.ErrUnauthorized
}
if force {
s, errGet := service.Get(instance.ServiceName)
s, errGet := service.Get(ctx, instance.ServiceName)
if errGet != nil {
return errGet
}
Expand Down
21 changes: 12 additions & 9 deletions api/auth.go
View file
Expand Up @@ -266,7 +266,7 @@ func updateTeam(w http.ResponseWriter, r *http.Request, t auth.Token) error {
if !allowed {
return permission.ErrUnauthorized
}
_, err := servicemanager.Team.FindByName(name)
_, err := servicemanager.Team.FindByName(ctx, name)
if err != nil {
if err == authTypes.ErrTeamNotFound {
return &errors.HTTP{Code: http.StatusNotFound, Message: err.Error()}
Expand All @@ -285,13 +285,13 @@ func updateTeam(w http.ResponseWriter, r *http.Request, t auth.Token) error {
}
defer func() { evt.Done(err) }()
if changeRequest.NewName == "" {
return servicemanager.Team.Update(name, changeRequest.Tags)
return servicemanager.Team.Update(ctx, name, changeRequest.Tags)
}
u, err := t.User()
if err != nil {
return err
}
err = servicemanager.Team.Create(changeRequest.NewName, changeRequest.Tags, u)
err = servicemanager.Team.Create(ctx, changeRequest.NewName, changeRequest.Tags, u)
if err != nil {
return err
}
Expand All @@ -300,7 +300,7 @@ func updateTeam(w http.ResponseWriter, r *http.Request, t auth.Token) error {
if err == nil {
return
}
rollbackErr := servicemanager.Team.Remove(changeRequest.NewName)
rollbackErr := servicemanager.Team.Remove(ctx, changeRequest.NewName)
if rollbackErr != nil {
log.Errorf("error rolling back team creation from %v to %v", name, changeRequest.NewName)
}
Expand All @@ -319,7 +319,7 @@ func updateTeam(w http.ResponseWriter, r *http.Request, t auth.Token) error {
}
toRollback = append(toRollback, fn)
}
return servicemanager.Team.Remove(name)
return servicemanager.Team.Remove(ctx, name)
}

// title: team create
Expand All @@ -332,6 +332,7 @@ func updateTeam(w http.ResponseWriter, r *http.Request, t auth.Token) error {
// 401: Unauthorized
// 409: Team already exists
func createTeam(w http.ResponseWriter, r *http.Request, t auth.Token) error {
ctx := r.Context()
allowed := permission.Check(t, permission.PermTeamCreate)
if !allowed {
return permission.ErrUnauthorized
Expand All @@ -357,7 +358,7 @@ func createTeam(w http.ResponseWriter, r *http.Request, t auth.Token) error {
if err != nil {
return err
}
err = servicemanager.Team.Create(team.Name, team.Tags, u)
err = servicemanager.Team.Create(ctx, team.Name, team.Tags, u)
switch err {
case authTypes.ErrInvalidTeamName:
return &errors.HTTP{Code: http.StatusBadRequest, Message: err.Error()}
Expand All @@ -379,6 +380,7 @@ func createTeam(w http.ResponseWriter, r *http.Request, t auth.Token) error {
// 403: Forbidden
// 404: Not found
func removeTeam(w http.ResponseWriter, r *http.Request, t auth.Token) (err error) {
ctx := r.Context()
name := r.URL.Query().Get(":name")
allowed := permission.Check(t, permission.PermTeamDelete,
permission.Context(permTypes.CtxTeam, name),
Expand All @@ -397,7 +399,7 @@ func removeTeam(w http.ResponseWriter, r *http.Request, t auth.Token) (err error
return err
}
defer func() { evt.Done(err) }()
err = servicemanager.Team.Remove(name)
err = servicemanager.Team.Remove(ctx, name)
if err != nil {
if _, ok := err.(*authTypes.ErrTeamStillUsed); ok {
msg := fmt.Sprintf("This team cannot be removed because there are still references to it:\n%s", err)
Expand All @@ -420,8 +422,9 @@ func removeTeam(w http.ResponseWriter, r *http.Request, t auth.Token) (err error
// 204: No content
// 401: Unauthorized
func teamList(w http.ResponseWriter, r *http.Request, t auth.Token) error {
ctx := r.Context()
permsForTeam := permission.PermissionRegistry.PermissionsWithContextType(permTypes.CtxTeam)
teams, err := servicemanager.Team.List()
teams, err := servicemanager.Team.List(ctx)
if err != nil {
return err
}
Expand Down Expand Up @@ -472,7 +475,7 @@ func teamList(w http.ResponseWriter, r *http.Request, t auth.Token) error {
func teamInfo(w http.ResponseWriter, r *http.Request, t auth.Token) error {
ctx := r.Context()
teamName := r.URL.Query().Get(":name")
team, err := servicemanager.Team.FindByName(teamName)
team, err := servicemanager.Team.FindByName(ctx, teamName)
if err != nil {
return &errors.HTTP{Code: http.StatusNotFound, Message: err.Error()}
}
Expand Down
2 changes: 1 addition & 1 deletion api/middleware.go
View file
Expand Up @@ -45,7 +45,7 @@ func validate(token string, r *http.Request) (auth.Token, error) {
if err != nil {
t, err = auth.APIAuth(token)
if err != nil {
t, err = servicemanager.TeamToken.Authenticate(token)
t, err = servicemanager.TeamToken.Authenticate(r.Context(), token)
if err != nil {
return nil, err
}
Expand Down
3 changes: 2 additions & 1 deletion api/middleware_test.go
View file
Expand Up @@ -5,6 +5,7 @@
package api

import (
stdContext "context"
"fmt"
"net/http"
"net/http/httptest"
Expand Down Expand Up @@ -266,7 +267,7 @@ func (s *S) TestAuthTokenMiddlewareWithAPIToken(c *check.C) {
}

func (s *S) TestAuthTokenMiddlewareWithTeamToken(c *check.C) {
token, err := servicemanager.TeamToken.Create(authTypes.TeamTokenCreateArgs{
token, err := servicemanager.TeamToken.Create(stdContext.TODO(), authTypes.TeamTokenCreateArgs{
Team: s.team.Name,
}, s.token)
c.Assert(err, check.IsNil)
Expand Down
6 changes: 4 additions & 2 deletions api/permission.go
View file
Expand Up @@ -697,6 +697,7 @@ func roleUpdate(w http.ResponseWriter, r *http.Request, t auth.Token) error {
// 401: Unauthorized
// 404: Role or team token not found
func assignRoleToToken(w http.ResponseWriter, r *http.Request, t auth.Token) error {
ctx := r.Context()
if !permission.Check(t, permission.PermRoleUpdateAssign) {
return permission.ErrUnauthorized
}
Expand All @@ -718,7 +719,7 @@ func assignRoleToToken(w http.ResponseWriter, r *http.Request, t auth.Token) err
if err != nil {
return err
}
err = servicemanager.TeamToken.AddRole(tokenID, roleName, contextValue)
err = servicemanager.TeamToken.AddRole(ctx, tokenID, roleName, contextValue)
if err == authTypes.ErrTeamTokenNotFound {
w.WriteHeader(http.StatusNotFound)
return nil
Expand All @@ -735,6 +736,7 @@ func assignRoleToToken(w http.ResponseWriter, r *http.Request, t auth.Token) err
// 401: Unauthorized
// 404: Role or team token not found
func dissociateRoleFromToken(w http.ResponseWriter, r *http.Request, t auth.Token) error {
ctx := r.Context()
if !permission.Check(t, permission.PermRoleUpdateDissociate) {
return permission.ErrUnauthorized
}
Expand All @@ -756,7 +758,7 @@ func dissociateRoleFromToken(w http.ResponseWriter, r *http.Request, t auth.Toke
if err != nil {
return err
}
err = servicemanager.TeamToken.RemoveRole(tokenID, roleName, contextValue)
err = servicemanager.TeamToken.RemoveRole(ctx, tokenID, roleName, contextValue)
if err == authTypes.ErrTeamTokenNotFound {
w.WriteHeader(http.StatusNotFound)
return nil
Expand Down
26 changes: 13 additions & 13 deletions api/permission_test.go
View file
Expand Up @@ -1012,7 +1012,7 @@ func (s *S) TestRoleUpdateSingleField(c *check.C) {
func (s *S) TestAssignRoleToTeamToken(c *check.C) {
_, err := permission.NewRole("newrole", "app", "")
c.Assert(err, check.IsNil)
teamToken, err := servicemanager.TeamToken.Create(authTypes.TeamTokenCreateArgs{
teamToken, err := servicemanager.TeamToken.Create(context.TODO(), authTypes.TeamTokenCreateArgs{
Team: s.team.Name,
}, s.token)
c.Assert(err, check.IsNil)
Expand All @@ -1032,7 +1032,7 @@ func (s *S) TestAssignRoleToTeamToken(c *check.C) {
server := RunServer(true)
server.ServeHTTP(recorder, req)
c.Assert(recorder.Code, check.Equals, http.StatusOK)
t, err := servicemanager.TeamToken.FindByTokenID(teamToken.TokenID)
t, err := servicemanager.TeamToken.FindByTokenID(context.TODO(), teamToken.TokenID)
c.Assert(err, check.IsNil)
c.Assert(t.Roles, check.DeepEquals, []authTypes.RoleInstance{
{Name: "newrole", ContextValue: "myapp"},
Expand All @@ -1050,7 +1050,7 @@ func (s *S) TestAssignRoleToTeamToken(c *check.C) {
}

func (s *S) TestAssignRoleToTeamTokenRoleNotFound(c *check.C) {
teamToken, err := servicemanager.TeamToken.Create(authTypes.TeamTokenCreateArgs{
teamToken, err := servicemanager.TeamToken.Create(context.TODO(), authTypes.TeamTokenCreateArgs{
Team: s.team.Name,
}, s.token)
c.Assert(err, check.IsNil)
Expand Down Expand Up @@ -1086,7 +1086,7 @@ func (s *S) TestAssignRoleToTeamTokenRoleNotFound(c *check.C) {
func (s *S) TestAssignRoleToTeamTokenNotAuthorized(c *check.C) {
_, err := permission.NewRole("newrole", "app", "")
c.Assert(err, check.IsNil)
teamToken, err := servicemanager.TeamToken.Create(authTypes.TeamTokenCreateArgs{
teamToken, err := servicemanager.TeamToken.Create(context.TODO(), authTypes.TeamTokenCreateArgs{
Team: s.team.Name,
}, s.token)
c.Assert(err, check.IsNil)
Expand All @@ -1109,11 +1109,11 @@ func (s *S) TestAssignRoleToTeamTokenNotAuthorized(c *check.C) {
func (s *S) TestDissociateRoleFromTeamToken(c *check.C) {
_, err := permission.NewRole("newrole", "app", "")
c.Assert(err, check.IsNil)
teamToken, err := servicemanager.TeamToken.Create(authTypes.TeamTokenCreateArgs{
teamToken, err := servicemanager.TeamToken.Create(context.TODO(), authTypes.TeamTokenCreateArgs{
Team: s.team.Name,
}, s.token)
c.Assert(err, check.IsNil)
err = servicemanager.TeamToken.AddRole(teamToken.TokenID, "newrole", "myapp")
err = servicemanager.TeamToken.AddRole(context.TODO(), teamToken.TokenID, "newrole", "myapp")
c.Assert(err, check.IsNil)
req, err := http.NewRequest(http.MethodDelete,
fmt.Sprintf("/1.6/roles/newrole/token/%s?context=myapp", teamToken.TokenID),
Expand All @@ -1132,7 +1132,7 @@ func (s *S) TestDissociateRoleFromTeamToken(c *check.C) {
server := RunServer(true)
server.ServeHTTP(recorder, req)
c.Assert(recorder.Code, check.Equals, http.StatusOK)
t, err := servicemanager.TeamToken.FindByTokenID(teamToken.TokenID)
t, err := servicemanager.TeamToken.FindByTokenID(context.TODO(), teamToken.TokenID)
c.Assert(err, check.IsNil)
c.Assert(t.Roles, check.HasLen, 0)
c.Assert(eventtest.EventDesc{
Expand All @@ -1150,11 +1150,11 @@ func (s *S) TestDissociateRoleFromTeamToken(c *check.C) {
func (s *S) TestDissociateRoleFromTeamTokenRoleNotFound(c *check.C) {
_, err := permission.NewRole("newrole", "app", "")
c.Assert(err, check.IsNil)
teamToken, err := servicemanager.TeamToken.Create(authTypes.TeamTokenCreateArgs{
teamToken, err := servicemanager.TeamToken.Create(context.TODO(), authTypes.TeamTokenCreateArgs{
Team: s.team.Name,
}, s.token)
c.Assert(err, check.IsNil)
err = servicemanager.TeamToken.AddRole(teamToken.TokenID, "newrole", "myapp")
err = servicemanager.TeamToken.AddRole(context.TODO(), teamToken.TokenID, "newrole", "myapp")
c.Assert(err, check.IsNil)
req, err := http.NewRequest(http.MethodDelete,
fmt.Sprintf("/1.6/roles/rolenotfound/token/%s?context=myapp", teamToken.TokenID),
Expand All @@ -1173,7 +1173,7 @@ func (s *S) TestDissociateRoleFromTeamTokenRoleNotFound(c *check.C) {
server := RunServer(true)
server.ServeHTTP(recorder, req)
c.Assert(recorder.Code, check.Equals, http.StatusNotFound)
t, err := servicemanager.TeamToken.FindByTokenID(teamToken.TokenID)
t, err := servicemanager.TeamToken.FindByTokenID(context.TODO(), teamToken.TokenID)
c.Assert(err, check.IsNil)
c.Assert(t.Roles, check.HasLen, 1)
c.Assert(eventtest.EventDesc{
Expand All @@ -1192,11 +1192,11 @@ func (s *S) TestDissociateRoleFromTeamTokenRoleNotFound(c *check.C) {
func (s *S) TestDissociateRoleFromTeamTokenNotAuthorized(c *check.C) {
_, err := permission.NewRole("newrole", "app", "")
c.Assert(err, check.IsNil)
teamToken, err := servicemanager.TeamToken.Create(authTypes.TeamTokenCreateArgs{
teamToken, err := servicemanager.TeamToken.Create(context.TODO(), authTypes.TeamTokenCreateArgs{
Team: s.team.Name,
}, s.token)
c.Assert(err, check.IsNil)
err = servicemanager.TeamToken.AddRole(teamToken.TokenID, "newrole", "myapp")
err = servicemanager.TeamToken.AddRole(context.TODO(), teamToken.TokenID, "newrole", "myapp")
c.Assert(err, check.IsNil)
req, err := http.NewRequest(http.MethodDelete,
fmt.Sprintf("/1.6/roles/rolenotfound/token/%s?context=myapp", teamToken.TokenID),
Expand All @@ -1213,7 +1213,7 @@ func (s *S) TestDissociateRoleFromTeamTokenNotAuthorized(c *check.C) {
server.ServeHTTP(recorder, req)
c.Assert(recorder.Code, check.Equals, http.StatusForbidden)
c.Assert(recorder.Body.String(), check.Equals, "You don't have permission to do this action\n")
t, err := servicemanager.TeamToken.FindByTokenID(teamToken.TokenID)
t, err := servicemanager.TeamToken.FindByTokenID(context.TODO(), teamToken.TokenID)
c.Assert(err, check.IsNil)
c.Assert(t.Roles, check.HasLen, 1)
}
Expand Down
3 changes: 2 additions & 1 deletion api/quota.go
View file
Expand Up @@ -58,6 +58,7 @@ func getUserQuota(w http.ResponseWriter, r *http.Request, t auth.Token) error {
// 403: Limit lower than allocated value
// 404: User not found
func changeUserQuota(w http.ResponseWriter, r *http.Request, t auth.Token) (err error) {
ctx := r.Context()
email := r.URL.Query().Get(":email")
allowed := permission.Check(t, permission.PermUserUpdateQuota)
if !allowed {
Expand Down Expand Up @@ -90,7 +91,7 @@ func changeUserQuota(w http.ResponseWriter, r *http.Request, t auth.Token) (err
Message: "Invalid limit",
}
}
err = servicemanager.UserQuota.SetLimit(user, limit)
err = servicemanager.UserQuota.SetLimit(ctx, user, limit)
if err == quota.ErrLimitLowerThanAllocated {
return &errors.HTTP{
Code: http.StatusForbidden,
Expand Down

0 comments on commit 28bb369

Please sign in to comment.