From 99c6b6648ecdfb06416744a76e1d190d383c0a04 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rn=20Friedrich=20Dreyer?= Date: Tue, 13 Aug 2024 12:23:54 +0200 Subject: [PATCH] no need to introduce dedicated roles MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jörn Friedrich Dreyer --- services/graph/pkg/unifiedrole/unifiedrole.go | 60 +- .../graph/pkg/unifiedrole/unifiedrole_test.go | 26 +- .../storage-users/pkg/revaconfig/drivers.go | 6 + .../apiGraph/roleManagementEndpoint.feature | 515 +++++++++--------- 4 files changed, 289 insertions(+), 318 deletions(-) diff --git a/services/graph/pkg/unifiedrole/unifiedrole.go b/services/graph/pkg/unifiedrole/unifiedrole.go index 333ac2730..cd40dcd18 100644 --- a/services/graph/pkg/unifiedrole/unifiedrole.go +++ b/services/graph/pkg/unifiedrole/unifiedrole.go @@ -156,6 +156,14 @@ func NewViewerUnifiedRole() *libregraph.UnifiedRoleDefinition { AllowedResourceActions: convert(r), Condition: proto.String(UnifiedRoleConditionFolder), }, + { + AllowedResourceActions: convert(r), + Condition: proto.String(UnifiedRoleConditionFileFederatedUser), + }, + { + AllowedResourceActions: convert(r), + Condition: proto.String(UnifiedRoleConditionFolderFederatedUser), + }, }, LibreGraphWeight: proto.Int32(0), } @@ -190,6 +198,10 @@ func NewEditorUnifiedRole() *libregraph.UnifiedRoleDefinition { AllowedResourceActions: convert(r), Condition: proto.String(UnifiedRoleConditionFolder), }, + { + AllowedResourceActions: convert(r), + Condition: proto.String(UnifiedRoleConditionFolderFederatedUser), + }, }, LibreGraphWeight: proto.Int32(0), } @@ -224,6 +236,10 @@ func NewFileEditorUnifiedRole() *libregraph.UnifiedRoleDefinition { AllowedResourceActions: convert(r), Condition: proto.String(UnifiedRoleConditionFile), }, + { + AllowedResourceActions: convert(r), + Condition: proto.String(UnifiedRoleConditionFileFederatedUser), + }, }, LibreGraphWeight: proto.Int32(0), } @@ -284,48 +300,6 @@ func NewSecureViewerUnifiedRole() *libregraph.UnifiedRoleDefinition { } } -// NewFederatedViewerUnifiedRole creates a federated viewer role -func NewFederatedViewerUnifiedRole() *libregraph.UnifiedRoleDefinition { - r := conversions.NewViewerRole() - return &libregraph.UnifiedRoleDefinition{ - Id: proto.String(UnifiedRoleFederatedViewerID), - Description: proto.String("View and download."), - DisplayName: displayName(r), - RolePermissions: []libregraph.UnifiedRolePermission{ - { - AllowedResourceActions: convert(r), - Condition: proto.String(UnifiedRoleConditionFileFederatedUser), - }, - { - AllowedResourceActions: convert(r), - Condition: proto.String(UnifiedRoleConditionFolderFederatedUser), - }, - }, - LibreGraphWeight: proto.Int32(0), - } -} - -// NewFederatedEditorUnifiedRole creates a federated editor role -func NewFederatedEditorUnifiedRole() *libregraph.UnifiedRoleDefinition { - r := conversions.NewEditorRole() - return &libregraph.UnifiedRoleDefinition{ - Id: proto.String(UnifiedRoleFederatedEditorID), - Description: proto.String("View, download and edit."), - DisplayName: displayName(r), - RolePermissions: []libregraph.UnifiedRolePermission{ - { - AllowedResourceActions: convert(r), - Condition: proto.String(UnifiedRoleConditionFileFederatedUser), - }, - { - AllowedResourceActions: convert(r), - Condition: proto.String(UnifiedRoleConditionFolderFederatedUser), - }, - }, - LibreGraphWeight: proto.Int32(0), - } -} - // NewUnifiedRoleFromID returns a unified role definition from the provided id func NewUnifiedRoleFromID(id string) (*libregraph.UnifiedRoleDefinition, error) { for _, definition := range GetBuiltinRoleDefinitionList() { @@ -349,8 +323,6 @@ func GetBuiltinRoleDefinitionList() []*libregraph.UnifiedRoleDefinition { NewEditorLiteUnifiedRole(), NewManagerUnifiedRole(), NewSecureViewerUnifiedRole(), - NewFederatedViewerUnifiedRole(), - NewFederatedEditorUnifiedRole(), } } diff --git a/services/graph/pkg/unifiedrole/unifiedrole_test.go b/services/graph/pkg/unifiedrole/unifiedrole_test.go index e91955090..145dd66c6 100644 --- a/services/graph/pkg/unifiedrole/unifiedrole_test.go +++ b/services/graph/pkg/unifiedrole/unifiedrole_test.go @@ -155,22 +155,34 @@ var _ = Describe("unifiedroles", func() { ), Entry( - "FederatedViewerUnifiedRole | share", - rolesToAction(unifiedrole.NewFederatedViewerUnifiedRole()), + "ViewerUnifiedRole | share", + rolesToAction(unifiedrole.NewViewerUnifiedRole()), unifiedrole.UnifiedRoleConditionFile, true, []*libregraph.UnifiedRoleDefinition{ - unifiedrole.NewFederatedViewerUnifiedRole(), + unifiedrole.NewViewerUnifiedRole(), }, ), + Entry( - "FederatedEditorUnifiedRole | share", - rolesToAction(unifiedrole.NewFederatedEditorUnifiedRole()), + "EditorUnifiedRole | share folder", + rolesToAction(unifiedrole.NewEditorUnifiedRole()), + unifiedrole.UnifiedRoleConditionFolder, + true, + []*libregraph.UnifiedRoleDefinition{ + unifiedrole.NewViewerUnifiedRole(), + unifiedrole.NewEditorUnifiedRole(), + }, + ), + + Entry( + "EditorUnifiedRole | share file", + rolesToAction(unifiedrole.NewEditorUnifiedRole()), unifiedrole.UnifiedRoleConditionFile, true, []*libregraph.UnifiedRoleDefinition{ - unifiedrole.NewFederatedViewerUnifiedRole(), - unifiedrole.NewFederatedEditorUnifiedRole(), + unifiedrole.NewViewerUnifiedRole(), + unifiedrole.NewFileEditorUnifiedRole(), }, ), diff --git a/services/storage-users/pkg/revaconfig/drivers.go b/services/storage-users/pkg/revaconfig/drivers.go index 2df72cb48..a8907e100 100644 --- a/services/storage-users/pkg/revaconfig/drivers.go +++ b/services/storage-users/pkg/revaconfig/drivers.go @@ -146,6 +146,12 @@ func OwnCloudSQL(cfg *config.Config) map[string]interface{} { "dbport": cfg.Drivers.OwnCloudSQL.DBPort, "dbname": cfg.Drivers.OwnCloudSQL.DBName, "userprovidersvc": cfg.Drivers.OwnCloudSQL.UsersProviderEndpoint, + "tokens": map[string]interface{}{ + "download_endpoint": cfg.DataServerURL, + "datagateway_endpoint": cfg.DataGatewayURL, + "transfer_shared_secret": cfg.Commons.TransferSecret, + "transfer_expires": cfg.TransferExpires, + }, } } diff --git a/tests/acceptance/features/apiGraph/roleManagementEndpoint.feature b/tests/acceptance/features/apiGraph/roleManagementEndpoint.feature index 743ba56e7..876130687 100644 --- a/tests/acceptance/features/apiGraph/roleManagementEndpoint.feature +++ b/tests/acceptance/features/apiGraph/roleManagementEndpoint.feature @@ -14,8 +14,8 @@ Feature: permissions role definitions """ { "type": "array", - "maxItems": 10, - "minItems": 10, + "maxItems": 8, + "minItems": 8, "uniqueItems": true, "items": { "oneOf": [ @@ -43,8 +43,8 @@ Feature: permissions role definitions }, "rolePermissions": { "type": "array", - "maxItems": 2, - "minItems": 2, + "maxItems": 4, + "minItems": 4, "uniqueItems": true, "items": { "oneOf": [ @@ -91,6 +91,50 @@ Feature: permissions role definitions "const": "exists @Resource.Folder" } } + }, + { + "type": "object", + "required": [ + "allowedResourceActions", + "condition" + ], + "properties": { + "allowedResourceActions": { + "const": [ + "libre.graph/driveItem/path/read", + "libre.graph/driveItem/quota/read", + "libre.graph/driveItem/content/read", + "libre.graph/driveItem/children/read", + "libre.graph/driveItem/deleted/read", + "libre.graph/driveItem/basic/read" + ] + }, + "condition": { + "const": "exists @Resource.File \u0026\u0026 @Subject.UserType==\"Federated\"" + } + } + }, + { + "type": "object", + "required": [ + "allowedResourceActions", + "condition" + ], + "properties": { + "allowedResourceActions": { + "const": [ + "libre.graph/driveItem/path/read", + "libre.graph/driveItem/quota/read", + "libre.graph/driveItem/content/read", + "libre.graph/driveItem/children/read", + "libre.graph/driveItem/deleted/read", + "libre.graph/driveItem/basic/read" + ] + }, + "condition": { + "const": "exists @Resource.Folder \u0026\u0026 @Subject.UserType==\"Federated\"" + } + } } ] } @@ -174,35 +218,66 @@ Feature: permissions role definitions }, "rolePermissions": { "type": "array", - "maxItems": 1, - "minItems": 1, + "maxItems": 2, + "minItems": 2, "uniqueItems": true, "items": { - "type": "object", - "required": [ - "allowedResourceActions", - "condition" - ], - "properties": { - "allowedResourceActions": { - "const": [ - "libre.graph/driveItem/children/create", - "libre.graph/driveItem/standard/delete", - "libre.graph/driveItem/path/read", - "libre.graph/driveItem/quota/read", - "libre.graph/driveItem/content/read", - "libre.graph/driveItem/upload/create", - "libre.graph/driveItem/children/read", - "libre.graph/driveItem/deleted/read", - "libre.graph/driveItem/path/update", - "libre.graph/driveItem/deleted/update", - "libre.graph/driveItem/basic/read" - ] + "oneOf": [ + { + "type": "object", + "required": [ + "allowedResourceActions", + "condition" + ], + "properties": { + "allowedResourceActions": { + "const": [ + "libre.graph/driveItem/children/create", + "libre.graph/driveItem/standard/delete", + "libre.graph/driveItem/path/read", + "libre.graph/driveItem/quota/read", + "libre.graph/driveItem/content/read", + "libre.graph/driveItem/upload/create", + "libre.graph/driveItem/children/read", + "libre.graph/driveItem/deleted/read", + "libre.graph/driveItem/path/update", + "libre.graph/driveItem/deleted/update", + "libre.graph/driveItem/basic/read" + ] + }, + "condition": { + "const": "exists @Resource.Folder" + } + } }, - "condition": { - "const": "exists @Resource.Folder" + { + "type": "object", + "required": [ + "allowedResourceActions", + "condition" + ], + "properties": { + "allowedResourceActions": { + "const": [ + "libre.graph/driveItem/children/create", + "libre.graph/driveItem/standard/delete", + "libre.graph/driveItem/path/read", + "libre.graph/driveItem/quota/read", + "libre.graph/driveItem/content/read", + "libre.graph/driveItem/upload/create", + "libre.graph/driveItem/children/read", + "libre.graph/driveItem/deleted/read", + "libre.graph/driveItem/path/update", + "libre.graph/driveItem/deleted/update", + "libre.graph/driveItem/basic/read" + ] + }, + "condition": { + "const": "exists @Resource.Folder \u0026\u0026 @Subject.UserType==\"Federated\"" + } + } } - } + ] } } } @@ -291,32 +366,60 @@ Feature: permissions role definitions }, "rolePermissions": { "type": "array", - "maxItems": 1, - "minItems": 1, + "maxItems": 2, + "minItems": 2, "uniqueItems": true, "items": { - "type": "object", - "required": [ - "allowedResourceActions", - "condition" - ], - "properties": { - "allowedResourceActions": { - "const": [ - "libre.graph/driveItem/path/read", - "libre.graph/driveItem/quota/read", - "libre.graph/driveItem/content/read", - "libre.graph/driveItem/upload/create", - "libre.graph/driveItem/children/read", - "libre.graph/driveItem/deleted/read", - "libre.graph/driveItem/deleted/update", - "libre.graph/driveItem/basic/read" - ] + "oneOf": [ + { + "type": "object", + "required": [ + "allowedResourceActions", + "condition" + ], + "properties": { + "allowedResourceActions": { + "const": [ + "libre.graph/driveItem/path/read", + "libre.graph/driveItem/quota/read", + "libre.graph/driveItem/content/read", + "libre.graph/driveItem/upload/create", + "libre.graph/driveItem/children/read", + "libre.graph/driveItem/deleted/read", + "libre.graph/driveItem/deleted/update", + "libre.graph/driveItem/basic/read" + ] + }, + "condition": { + "const":"exists @Resource.File" + } + } }, - "condition": { - "const":"exists @Resource.File" + { + "type": "object", + "required": [ + "allowedResourceActions", + "condition" + ], + "properties": { + "allowedResourceActions": { + "const": [ + "libre.graph/driveItem/path/read", + "libre.graph/driveItem/quota/read", + "libre.graph/driveItem/content/read", + "libre.graph/driveItem/upload/create", + "libre.graph/driveItem/children/read", + "libre.graph/driveItem/deleted/read", + "libre.graph/driveItem/deleted/update", + "libre.graph/driveItem/basic/read" + ] + }, + "condition": { + "const":"exists @Resource.File \u0026\u0026 @Subject.UserType==\"Federated\"" + } + } } - } + ] } } } @@ -510,172 +613,6 @@ Feature: permissions role definitions } } } - }, - { - "type": "object", - "required": [ - "@libre.graph.weight", - "description", - "displayName", - "id", - "rolePermissions" - ], - "properties": { - "@libre.graph.weight": { - "const": 0 - }, - "description": { - "const": "View and download." - }, - "displayName": { - "const": "Can view" - }, - "id": { - "const": "be531789-063c-48bf-a9fe-857e6fbee7da" - }, - "rolePermissions": { - "type": "array", - "maxItems": 2, - "minItems": 2, - "uniqueItems": true, - "items": { - "oneOf": [ - { - "type": "object", - "required": [ - "allowedResourceActions", - "condition" - ], - "properties": { - "allowedResourceActions": { - "const": [ - "libre.graph/driveItem/path/read", - "libre.graph/driveItem/quota/read", - "libre.graph/driveItem/content/read", - "libre.graph/driveItem/children/read", - "libre.graph/driveItem/deleted/read", - "libre.graph/driveItem/basic/read" - ] - }, - "condition": { - "const": "exists @Resource.File \u0026\u0026 @Subject.UserType==\"Federated\"" - } - } - }, - { - "type": "object", - "required": [ - "allowedResourceActions", - "condition" - ], - "properties": { - "allowedResourceActions": { - "const": [ - "libre.graph/driveItem/path/read", - "libre.graph/driveItem/quota/read", - "libre.graph/driveItem/content/read", - "libre.graph/driveItem/children/read", - "libre.graph/driveItem/deleted/read", - "libre.graph/driveItem/basic/read" - ] - }, - "condition": { - "const": "exists @Resource.Folder \u0026\u0026 @Subject.UserType==\"Federated\"" - } - } - } - ] - } - } - } - }, - { - "type": "object", - "required": [ - "@libre.graph.weight", - "description", - "displayName", - "id", - "rolePermissions" - ], - "properties": { - "@libre.graph.weight": { - "const": 0 - }, - "description": { - "const": "View, download and edit." - }, - "displayName": { - "const": "Can edit" - }, - "id": { - "const": "36279a93-e4e3-4bbb-8a23-53b05b560963" - }, - "rolePermissions": { - "type": "array", - "maxItems": 2, - "minItems": 2, - "uniqueItems": true, - "items": { - "oneOf": [ - { - "type": "object", - "required": [ - "allowedResourceActions", - "condition" - ], - "properties": { - "allowedResourceActions": { - "const": [ - "libre.graph/driveItem/children/create", - "libre.graph/driveItem/standard/delete", - "libre.graph/driveItem/path/read", - "libre.graph/driveItem/quota/read", - "libre.graph/driveItem/content/read", - "libre.graph/driveItem/upload/create", - "libre.graph/driveItem/children/read", - "libre.graph/driveItem/deleted/read", - "libre.graph/driveItem/path/update", - "libre.graph/driveItem/deleted/update", - "libre.graph/driveItem/basic/read" - ] - }, - "condition": { - "const": "exists @Resource.File \u0026\u0026 @Subject.UserType==\"Federated\"" - } - } - }, - { - "type": "object", - "required": [ - "allowedResourceActions", - "condition" - ], - "properties": { - "allowedResourceActions": { - "const": [ - "libre.graph/driveItem/children/create", - "libre.graph/driveItem/standard/delete", - "libre.graph/driveItem/path/read", - "libre.graph/driveItem/quota/read", - "libre.graph/driveItem/content/read", - "libre.graph/driveItem/upload/create", - "libre.graph/driveItem/children/read", - "libre.graph/driveItem/deleted/read", - "libre.graph/driveItem/path/update", - "libre.graph/driveItem/deleted/update", - "libre.graph/driveItem/basic/read" - ] - }, - "condition": { - "const": "exists @Resource.Folder \u0026\u0026 @Subject.UserType==\"Federated\"" - } - } - } - ] - } - } - } } ] } @@ -710,60 +647,104 @@ Feature: permissions role definitions "id": { "const": "b1e2218d-eef8-4d4c-b82d-0f1a1b48f3b5" }, - "rolePermissions": { - "type": "array", - "maxItems": 2, - "minItems": 2, - "uniqueItems": true, - "items": { - "oneOf": [ - { - "type": "object", - "required": [ - "allowedResourceActions", - "condition" - ], - "properties": { - "allowedResourceActions": { - "const": [ - "libre.graph/driveItem/path/read", - "libre.graph/driveItem/quota/read", - "libre.graph/driveItem/content/read", - "libre.graph/driveItem/children/read", - "libre.graph/driveItem/deleted/read", - "libre.graph/driveItem/basic/read" - ] + "rolePermissions": { + "type": "array", + "maxItems": 4, + "minItems": 4, + "uniqueItems": true, + "items": { + "oneOf": [ + { + "type": "object", + "required": [ + "allowedResourceActions", + "condition" + ], + "properties": { + "allowedResourceActions": { + "const": [ + "libre.graph/driveItem/path/read", + "libre.graph/driveItem/quota/read", + "libre.graph/driveItem/content/read", + "libre.graph/driveItem/children/read", + "libre.graph/driveItem/deleted/read", + "libre.graph/driveItem/basic/read" + ] + }, + "condition": { + "const": "exists @Resource.File" + } + } }, - "condition": { - "const": "exists @Resource.File" - } - } - }, - { - "type": "object", - "required": [ - "allowedResourceActions", - "condition" - ], - "properties": { - "allowedResourceActions": { - "const": [ - "libre.graph/driveItem/path/read", - "libre.graph/driveItem/quota/read", - "libre.graph/driveItem/content/read", - "libre.graph/driveItem/children/read", - "libre.graph/driveItem/deleted/read", - "libre.graph/driveItem/basic/read" - ] + { + "type": "object", + "required": [ + "allowedResourceActions", + "condition" + ], + "properties": { + "allowedResourceActions": { + "const": [ + "libre.graph/driveItem/path/read", + "libre.graph/driveItem/quota/read", + "libre.graph/driveItem/content/read", + "libre.graph/driveItem/children/read", + "libre.graph/driveItem/deleted/read", + "libre.graph/driveItem/basic/read" + ] + }, + "condition": { + "const": "exists @Resource.Folder" + } + } }, - "condition": { - "const": "exists @Resource.Folder" + { + "type": "object", + "required": [ + "allowedResourceActions", + "condition" + ], + "properties": { + "allowedResourceActions": { + "const": [ + "libre.graph/driveItem/path/read", + "libre.graph/driveItem/quota/read", + "libre.graph/driveItem/content/read", + "libre.graph/driveItem/children/read", + "libre.graph/driveItem/deleted/read", + "libre.graph/driveItem/basic/read" + ] + }, + "condition": { + "const": "exists @Resource.File \u0026\u0026 @Subject.UserType==\"Federated\"" + } + } + }, + { + "type": "object", + "required": [ + "allowedResourceActions", + "condition" + ], + "properties": { + "allowedResourceActions": { + "const": [ + "libre.graph/driveItem/path/read", + "libre.graph/driveItem/quota/read", + "libre.graph/driveItem/content/read", + "libre.graph/driveItem/children/read", + "libre.graph/driveItem/deleted/read", + "libre.graph/driveItem/basic/read" + ] + }, + "condition": { + "const": "exists @Resource.Folder \u0026\u0026 @Subject.UserType==\"Federated\"" + } + } } - } + ] } - ] - } - } + } } } """