Introduce Policies-Service (#5716)

* add policies service add policies proxy middleware add policies event service add policies grpc service prepare ci and git environments (ci, make, readme, doc) * add webfinger to the drone conf * fix docs remove not used virus scan postprocessing step * relocate example rego file implicitly enable and disable proxy and postprocessing policy checking by setting the query. update configuration descriptions * move policies update readme * use converter func to convert pp environment to actual environment expose and test custom rego functions add engine unit tests add opa unit tests update policies readme Co-authored-by: Martin <github@diemattels.at> * relocate sample policies to the deployments folder change and document policies service port * update index.md and small fix * add health command add version command add debug server --------- Co-authored-by: Martin <github@diemattels.at>
2023-03-14 16:08:22 +01:00
parent d06d2012be
commit f38a9f4385
48 changed files with 3106 additions and 284 deletions
@@ -0,0 +1,62 @@
+package middleware
+
+import (
+	"net/http"
+
+	revactx "github.com/cs3org/reva/v2/pkg/ctx"
+	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+	"github.com/owncloud/ocis/v2/ocis-pkg/service/grpc"
+	pMessage "github.com/owncloud/ocis/v2/protogen/gen/ocis/messages/policies/v0"
+	pService "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/policies/v0"
+)
+
+// Policies verifies if a request is granted or not.
+func Policies(logger log.Logger, qs string) func(next http.Handler) http.Handler {
+	pClient := pService.NewPoliciesProviderService("com.owncloud.api.policies", grpc.DefaultClient())
+
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if qs == "" {
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			req := &pService.EvaluateRequest{
+				Query: qs,
+				Environment: &pMessage.Environment{
+					Request: &pMessage.Request{
+						Method: r.Method,
+						Path:   r.URL.Path,
+					},
+					Stage: pMessage.Stage_STAGE_HTTP,
+				},
+			}
+
+			if user, ok := revactx.ContextGetUser(r.Context()); ok {
+				req.Environment.User = &pMessage.User{
+					Id: &pMessage.User_ID{
+						OpaqueId: user.GetId().GetOpaqueId(),
+					},
+					Username:    user.GetUsername(),
+					Mail:        user.GetMail(),
+					DisplayName: user.GetDisplayName(),
+					Groups:      user.GetGroups(),
+				}
+			}
+
+			rsp, err := pClient.Evaluate(r.Context(), req)
+			if err != nil {
+				logger.Err(err).Msg("error evaluating request")
+				w.WriteHeader(http.StatusInternalServerError)
+				return
+			}
+
+			if !rsp.Result {
+				w.WriteHeader(http.StatusForbidden)
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}