sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

no need to introduce dedicated roles

Browse Source 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
This commit is contained in:
Jörn Friedrich Dreyer
2024-08-13 16:10:19 +02:00
parent 8da4e265bd
commit 99c6b6648e
4 changed files with 289 additions and 318 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/graph/pkg/unifiedrole/unifiedrole.go
+16 -44
View File
@@ -156,6 +156,14 @@ func NewViewerUnifiedRole() *libregraph.UnifiedRoleDefinition {
AllowedResourceActions: convert(r),
Condition: proto.String(UnifiedRoleConditionFolder),
},
{
AllowedResourceActions: convert(r),
Condition: proto.String(UnifiedRoleConditionFileFederatedUser),
},
{
AllowedResourceActions: convert(r),
Condition: proto.String(UnifiedRoleConditionFolderFederatedUser),
},
},
LibreGraphWeight: proto.Int32(0),
}
@@ -190,6 +198,10 @@ func NewEditorUnifiedRole() *libregraph.UnifiedRoleDefinition {
AllowedResourceActions: convert(r),
Condition: proto.String(UnifiedRoleConditionFolder),
},
{
AllowedResourceActions: convert(r),
Condition: proto.String(UnifiedRoleConditionFolderFederatedUser),
},
},
LibreGraphWeight: proto.Int32(0),
}
@@ -224,6 +236,10 @@ func NewFileEditorUnifiedRole() *libregraph.UnifiedRoleDefinition {
AllowedResourceActions: convert(r),
Condition: proto.String(UnifiedRoleConditionFile),
},
{
AllowedResourceActions: convert(r),
Condition: proto.String(UnifiedRoleConditionFileFederatedUser),
},
},
LibreGraphWeight: proto.Int32(0),
}
@@ -284,48 +300,6 @@ func NewSecureViewerUnifiedRole() *libregraph.UnifiedRoleDefinition {
}
}
// NewFederatedViewerUnifiedRole creates a federated viewer role
func NewFederatedViewerUnifiedRole() *libregraph.UnifiedRoleDefinition {
r := conversions.NewViewerRole()
return &libregraph.UnifiedRoleDefinition{
Id: proto.String(UnifiedRoleFederatedViewerID),
Description: proto.String("View and download."),
DisplayName: displayName(r),
RolePermissions: []libregraph.UnifiedRolePermission{
{
AllowedResourceActions: convert(r),
Condition: proto.String(UnifiedRoleConditionFileFederatedUser),
},
{
AllowedResourceActions: convert(r),
Condition: proto.String(UnifiedRoleConditionFolderFederatedUser),
},
},
LibreGraphWeight: proto.Int32(0),
}
}
// NewFederatedEditorUnifiedRole creates a federated editor role
func NewFederatedEditorUnifiedRole() *libregraph.UnifiedRoleDefinition {
r := conversions.NewEditorRole()
return &libregraph.UnifiedRoleDefinition{
Id: proto.String(UnifiedRoleFederatedEditorID),
Description: proto.String("View, download and edit."),
DisplayName: displayName(r),
RolePermissions: []libregraph.UnifiedRolePermission{
{
AllowedResourceActions: convert(r),
Condition: proto.String(UnifiedRoleConditionFileFederatedUser),
},
{
AllowedResourceActions: convert(r),
Condition: proto.String(UnifiedRoleConditionFolderFederatedUser),
},
},
LibreGraphWeight: proto.Int32(0),
}
}
// NewUnifiedRoleFromID returns a unified role definition from the provided id
func NewUnifiedRoleFromID(id string) (*libregraph.UnifiedRoleDefinition, error) {
for _, definition := range GetBuiltinRoleDefinitionList() {
@@ -349,8 +323,6 @@ func GetBuiltinRoleDefinitionList() []*libregraph.UnifiedRoleDefinition {
NewEditorLiteUnifiedRole(),
NewManagerUnifiedRole(),
NewSecureViewerUnifiedRole(),
NewFederatedViewerUnifiedRole(),
NewFederatedEditorUnifiedRole(),
}
}
services/graph/pkg/unifiedrole/unifiedrole_test.go
+19 -7
View File
@@ -155,22 +155,34 @@ var _ = Describe("unifiedroles", func() {
),
Entry(
"FederatedViewerUnifiedRole | share",
rolesToAction(unifiedrole.NewFederatedViewerUnifiedRole()),
"ViewerUnifiedRole | share",
rolesToAction(unifiedrole.NewViewerUnifiedRole()),
unifiedrole.UnifiedRoleConditionFile,
true,
[]*libregraph.UnifiedRoleDefinition{
unifiedrole.NewFederatedViewerUnifiedRole(),
unifiedrole.NewViewerUnifiedRole(),
},
),
Entry(
"FederatedEditorUnifiedRole | share",
rolesToAction(unifiedrole.NewFederatedEditorUnifiedRole()),
"EditorUnifiedRole | share folder",
rolesToAction(unifiedrole.NewEditorUnifiedRole()),
unifiedrole.UnifiedRoleConditionFolder,
true,
[]*libregraph.UnifiedRoleDefinition{
unifiedrole.NewViewerUnifiedRole(),
unifiedrole.NewEditorUnifiedRole(),
},
),
Entry(
"EditorUnifiedRole | share file",
rolesToAction(unifiedrole.NewEditorUnifiedRole()),
unifiedrole.UnifiedRoleConditionFile,
true,
[]*libregraph.UnifiedRoleDefinition{
unifiedrole.NewFederatedViewerUnifiedRole(),
unifiedrole.NewFederatedEditorUnifiedRole(),
unifiedrole.NewViewerUnifiedRole(),
unifiedrole.NewFileEditorUnifiedRole(),
},
),
services/storage-users/pkg/revaconfig/drivers.go
+6
View File
@@ -146,6 +146,12 @@ func OwnCloudSQL(cfg *config.Config) map[string]interface{} {
"dbport": cfg.Drivers.OwnCloudSQL.DBPort,
"dbname": cfg.Drivers.OwnCloudSQL.DBName,
"userprovidersvc": cfg.Drivers.OwnCloudSQL.UsersProviderEndpoint,
"tokens": map[string]interface{}{
"download_endpoint": cfg.DataServerURL,
"datagateway_endpoint": cfg.DataGatewayURL,
"transfer_shared_secret": cfg.Commons.TransferSecret,
"transfer_expires": cfg.TransferExpires,
},
}
}
tests/acceptance/features/apiGraph/roleManagementEndpoint.feature
+248 -267
View File
@@ -14,8 +14,8 @@ Feature: permissions role definitions
"""
{
"type": "array",
"maxItems": 10,
"minItems": 10,
"maxItems": 8,
"minItems": 8,
"uniqueItems": true,
"items": {
"oneOf": [
@@ -43,8 +43,8 @@ Feature: permissions role definitions
},
"rolePermissions": {
"type": "array",
"maxItems": 2,
"minItems": 2,
"maxItems": 4,
"minItems": 4,
"uniqueItems": true,
"items": {
"oneOf": [
@@ -91,6 +91,50 @@ Feature: permissions role definitions
"const": "exists @Resource.Folder"
}
}
},
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const": "exists @Resource.File \u0026\u0026 @Subject.UserType==\"Federated\""
}
}
},
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const": "exists @Resource.Folder \u0026\u0026 @Subject.UserType==\"Federated\""
}
}
}
]
}
@@ -174,35 +218,66 @@ Feature: permissions role definitions
},
"rolePermissions": {
"type": "array",
"maxItems": 1,
"minItems": 1,
"maxItems": 2,
"minItems": 2,
"uniqueItems": true,
"items": {
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/children/create",
"libre.graph/driveItem/standard/delete",
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/upload/create",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/path/update",
"libre.graph/driveItem/deleted/update",
"libre.graph/driveItem/basic/read"
]
"oneOf": [
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/children/create",
"libre.graph/driveItem/standard/delete",
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/upload/create",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/path/update",
"libre.graph/driveItem/deleted/update",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const": "exists @Resource.Folder"
}
}
},
"condition": {
"const": "exists @Resource.Folder"
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/children/create",
"libre.graph/driveItem/standard/delete",
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/upload/create",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/path/update",
"libre.graph/driveItem/deleted/update",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const": "exists @Resource.Folder \u0026\u0026 @Subject.UserType==\"Federated\""
}
}
}
}
]
}
}
}
@@ -291,32 +366,60 @@ Feature: permissions role definitions
},
"rolePermissions": {
"type": "array",
"maxItems": 1,
"minItems": 1,
"maxItems": 2,
"minItems": 2,
"uniqueItems": true,
"items": {
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/upload/create",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/deleted/update",
"libre.graph/driveItem/basic/read"
]
"oneOf": [
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/upload/create",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/deleted/update",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const":"exists @Resource.File"
}
}
},
"condition": {
"const":"exists @Resource.File"
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/upload/create",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/deleted/update",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const":"exists @Resource.File \u0026\u0026 @Subject.UserType==\"Federated\""
}
}
}
}
]
}
}
}
@@ -510,172 +613,6 @@ Feature: permissions role definitions
}
}
}
},
{
"type": "object",
"required": [
"@libre.graph.weight",
"description",
"displayName",
"id",
"rolePermissions"
],
"properties": {
"@libre.graph.weight": {
"const": 0
},
"description": {
"const": "View and download."
},
"displayName": {
"const": "Can view"
},
"id": {
"const": "be531789-063c-48bf-a9fe-857e6fbee7da"
},
"rolePermissions": {
"type": "array",
"maxItems": 2,
"minItems": 2,
"uniqueItems": true,
"items": {
"oneOf": [
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const": "exists @Resource.File \u0026\u0026 @Subject.UserType==\"Federated\""
}
}
},
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const": "exists @Resource.Folder \u0026\u0026 @Subject.UserType==\"Federated\""
}
}
}
]
}
}
}
},
{
"type": "object",
"required": [
"@libre.graph.weight",
"description",
"displayName",
"id",
"rolePermissions"
],
"properties": {
"@libre.graph.weight": {
"const": 0
},
"description": {
"const": "View, download and edit."
},
"displayName": {
"const": "Can edit"
},
"id": {
"const": "36279a93-e4e3-4bbb-8a23-53b05b560963"
},
"rolePermissions": {
"type": "array",
"maxItems": 2,
"minItems": 2,
"uniqueItems": true,
"items": {
"oneOf": [
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/children/create",
"libre.graph/driveItem/standard/delete",
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/upload/create",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/path/update",
"libre.graph/driveItem/deleted/update",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const": "exists @Resource.File \u0026\u0026 @Subject.UserType==\"Federated\""
}
}
},
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/children/create",
"libre.graph/driveItem/standard/delete",
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/upload/create",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/path/update",
"libre.graph/driveItem/deleted/update",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const": "exists @Resource.Folder \u0026\u0026 @Subject.UserType==\"Federated\""
}
}
}
]
}
}
}
}
]
}
@@ -710,60 +647,104 @@ Feature: permissions role definitions
"id": {
"const": "b1e2218d-eef8-4d4c-b82d-0f1a1b48f3b5"
},
"rolePermissions": {
"type": "array",
"maxItems": 2,
"minItems": 2,
"uniqueItems": true,
"items": {
"oneOf": [
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/basic/read"
]
"rolePermissions": {
"type": "array",
"maxItems": 4,
"minItems": 4,
"uniqueItems": true,
"items": {
"oneOf": [
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const": "exists @Resource.File"
}
}
},
"condition": {
"const": "exists @Resource.File"
}
}
},
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/basic/read"
]
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const": "exists @Resource.Folder"
}
}
},
"condition": {
"const": "exists @Resource.Folder"
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const": "exists @Resource.File \u0026\u0026 @Subject.UserType==\"Federated\""
}
}
},
{
"type": "object",
"required": [
"allowedResourceActions",
"condition"
],
"properties": {
"allowedResourceActions": {
"const": [
"libre.graph/driveItem/path/read",
"libre.graph/driveItem/quota/read",
"libre.graph/driveItem/content/read",
"libre.graph/driveItem/children/read",
"libre.graph/driveItem/deleted/read",
"libre.graph/driveItem/basic/read"
]
},
"condition": {
"const": "exists @Resource.Folder \u0026\u0026 @Subject.UserType==\"Federated\""
}
}
}
}
]
}
]
}
}
}
}
}
"""