diff --git a/services/graph/pkg/service/v0/api_driveitem_permissions.go b/services/graph/pkg/service/v0/api_driveitem_permissions.go index 292a098b5..591d72948 100644 --- a/services/graph/pkg/service/v0/api_driveitem_permissions.go +++ b/services/graph/pkg/service/v0/api_driveitem_permissions.go @@ -124,7 +124,7 @@ func (s DriveItemPermissionsService) Invite(ctx context.Context, resourceId *sto cs3ResourcePermissions := unifiedrole.PermissionsToCS3ResourcePermissions(unifiedRolePermissions) permission := &libregraph.Permission{} - if role := unifiedrole.CS3ResourcePermissionsToUnifiedRole(cs3ResourcePermissions, condition); role != nil { + if role := unifiedrole.CS3ResourcePermissionsToUnifiedRole(cs3ResourcePermissions, condition, false); role != nil { permission.Roles = []string{role.GetId()} } diff --git a/services/graph/pkg/service/v0/base.go b/services/graph/pkg/service/v0/base.go index 6c8a58ecd..534cf0321 100644 --- a/services/graph/pkg/service/v0/base.go +++ b/services/graph/pkg/service/v0/base.go @@ -191,7 +191,7 @@ func (g BaseGraphService) cs3SpacePermissionsToLibreGraph(ctx context.Context, s p.SetExpirationDateTime(time.Unix(int64(exp.GetSeconds()), int64(exp.GetNanos()))) } - if role := unifiedrole.CS3ResourcePermissionsToUnifiedRole(perm, unifiedrole.UnifiedRoleConditionDrive); role != nil { + if role := unifiedrole.CS3ResourcePermissionsToUnifiedRole(perm, unifiedrole.UnifiedRoleConditionDrive, false); role != nil { switch apiVersion { case APIVersion_1: if r := unifiedrole.GetLegacyName(*role); r != "" { @@ -459,6 +459,7 @@ func (g BaseGraphService) cs3UserShareToPermission(ctx context.Context, share *c role := unifiedrole.CS3ResourcePermissionsToUnifiedRole( share.GetPermissions().GetPermissions(), roleCondition, + false, ) if role != nil { perm.SetRoles([]string{role.GetId()}) @@ -542,6 +543,7 @@ func (g BaseGraphService) cs3OCMShareToPermission(ctx context.Context, share *oc role := unifiedrole.CS3ResourcePermissionsToUnifiedRole( permissions, roleCondition, + true, ) if role != nil { perm.SetRoles([]string{role.GetId()}) diff --git a/services/graph/pkg/service/v0/utils.go b/services/graph/pkg/service/v0/utils.go index d08a05567..c8a45a85e 100644 --- a/services/graph/pkg/service/v0/utils.go +++ b/services/graph/pkg/service/v0/utils.go @@ -445,7 +445,7 @@ func cs3ReceivedShareToLibreGraphPermissions(ctx context.Context, logger *log.Lo if err != nil { return nil, err } - role := unifiedrole.CS3ResourcePermissionsToUnifiedRole(permissionSet, condition) + role := unifiedrole.CS3ResourcePermissionsToUnifiedRole(permissionSet, condition, false) if role != nil { permission.SetRoles([]string{role.GetId()}) @@ -491,6 +491,17 @@ func roleConditionForResourceType(ri *storageprovider.ResourceInfo) (string, err } } +func federatedRoleConditionForResourceType(ri *storageprovider.ResourceInfo) (string, error) { + switch { + case ri.Type == storageprovider.ResourceType_RESOURCE_TYPE_CONTAINER: + return unifiedrole.UnifiedRoleConditionFolderFederatedUser, nil + case ri.Type == storageprovider.ResourceType_RESOURCE_TYPE_FILE: + return unifiedrole.UnifiedRoleConditionFileFederatedUser, nil + default: + return "", errorcode.New(errorcode.InvalidRequest, "unsupported resource type for federated role") + } +} + // ExtractShareIdFromResourceId is a bit of a hack. // We should not rely on a specific format of the item id. // But currently there is no other way to get the ShareID. @@ -764,36 +775,43 @@ func fillDriveItemPropertiesFromReceivedOCMShare(ctx context.Context, logger *lo func cs3ReceivedOCMShareToLibreGraphPermissions(ctx context.Context, logger *log.Logger, identityCache identity.IdentityCache, receivedShare *ocm.ReceivedShare, - _ *storageprovider.ResourceInfo) (*libregraph.Permission, error) { + resourceInfo *storageprovider.ResourceInfo) (*libregraph.Permission, error) { permission := libregraph.NewPermission() if id := receivedShare.GetId().GetOpaqueId(); id != "" { permission.SetId(id) } + if cTime := receivedShare.GetCtime(); cTime != nil { + permission.SetCreatedDateTime(cs3TimestampToTime(cTime)) + } + if expiration := receivedShare.GetExpiration(); expiration != nil { permission.SetExpirationDateTime(cs3TimestampToTime(expiration)) } - /* - if permissionSet := receivedShare.GetShare().GetPermissions().GetPermissions(); permissionSet != nil { - condition, err := roleConditionForResourceType(resourceInfo) - if err != nil { - return nil, err - } - role := unifiedrole.CS3ResourcePermissionsToUnifiedRole(*permissionSet, condition) - - if role != nil { - permission.SetRoles([]string{role.GetId()}) - } - - actions := unifiedrole.CS3ResourcePermissionsToLibregraphActions(*permissionSet) - - // actions only make sense if no role is set - if role == nil && len(actions) > 0 { - permission.SetLibreGraphPermissionsActions(actions) - } + var permissions *storageprovider.ResourcePermissions + for _, protocol := range receivedShare.GetProtocols() { + if protocol.GetWebdavOptions().GetPermissions() != nil { + permissions = protocol.GetWebdavOptions().GetPermissions().GetPermissions() } - */ + } + condition, err := federatedRoleConditionForResourceType(resourceInfo) + if err != nil { + return nil, err + } + role := unifiedrole.CS3ResourcePermissionsToUnifiedRole( + permissions, + condition, + true, + ) + if role != nil { + permission.SetRoles([]string{role.GetId()}) + } else { + actions := unifiedrole.CS3ResourcePermissionsToLibregraphActions(permissions) + permission.SetLibreGraphPermissionsActions(actions) + permission.SetRoles(nil) + } + switch grantee := receivedShare.GetGrantee(); { case grantee.GetType() == storageprovider.GranteeType_GRANTEE_TYPE_USER: user, err := cs3UserIdToIdentity(ctx, identityCache, grantee.GetUserId()) diff --git a/services/graph/pkg/unifiedrole/unifiedrole.go b/services/graph/pkg/unifiedrole/unifiedrole.go index cd40dcd18..d20d1bd19 100644 --- a/services/graph/pkg/unifiedrole/unifiedrole.go +++ b/services/graph/pkg/unifiedrole/unifiedrole.go @@ -527,28 +527,36 @@ func GetLegacyName(role libregraph.UnifiedRoleDefinition) string { // CS3ResourcePermissionsToUnifiedRole tries to find the UnifiedRoleDefinition that matches the supplied // CS3 ResourcePermissions and constraints. -func CS3ResourcePermissionsToUnifiedRole(p *provider.ResourcePermissions, constraints string) *libregraph.UnifiedRoleDefinition { - actionSet := map[string]struct{}{} - for _, action := range CS3ResourcePermissionsToLibregraphActions(p) { - actionSet[action] = struct{}{} - } +func CS3ResourcePermissionsToUnifiedRole(p *provider.ResourcePermissions, constraints string, listFederatedRoles bool) *libregraph.UnifiedRoleDefinition { + actions := CS3ResourcePermissionsToLibregraphActions(p) var res *libregraph.UnifiedRoleDefinition for _, uRole := range GetBuiltinRoleDefinitionList() { - matchFound := false + definitionMatch := false for _, uPerm := range uRole.GetRolePermissions() { - if uPerm.GetCondition() != constraints { - // the requested constraints don't match, this isn't our role + + // this is a dirty comparison because we are not really parsing the SDDL, but as long as we && the conditions we are good + isFederatedRole := strings.Contains(uPerm.GetCondition(), UnifiedRoleConditionFederatedUser) + switch { + case !strings.Contains(uPerm.GetCondition(), constraints): + continue + case listFederatedRoles && !isFederatedRole: + continue + case !listFederatedRoles && isFederatedRole: continue } // if the actions converted from the ResourcePermissions equal the action the defined for the role, we have match - if resourceActionsEqual(actionSet, uPerm.GetAllowedResourceActions()) { - matchFound = true - break + for i, action := range uPerm.GetAllowedResourceActions() { + if !slices.Contains(actions, action) { + break + } + if i == len(uPerm.GetAllowedResourceActions())-1 { + definitionMatch = true + } } } - if matchFound { + if definitionMatch { res = uRole break } diff --git a/services/graph/pkg/unifiedrole/unifiedrole_test.go b/services/graph/pkg/unifiedrole/unifiedrole_test.go index 145dd66c6..d43898f73 100644 --- a/services/graph/pkg/unifiedrole/unifiedrole_test.go +++ b/services/graph/pkg/unifiedrole/unifiedrole_test.go @@ -19,7 +19,7 @@ var _ = Describe("unifiedroles", func() { func(legacyRole *rConversions.Role, unifiedRole *libregraph.UnifiedRoleDefinition, constraints string) { cs3perm := legacyRole.CS3ResourcePermissions() - r := unifiedrole.CS3ResourcePermissionsToUnifiedRole(cs3perm, constraints) + r := unifiedrole.CS3ResourcePermissionsToUnifiedRole(cs3perm, constraints, false) Expect(r.GetId()).To(Equal(unifiedRole.GetId())) },