1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
|
package tvm
import (
"encoding/json"
"a.yandex-team.ru/library/go/core/xerrors"
)
func (r *Roles) GetRolesForService(t *CheckedServiceTicket) *ConsumerRoles {
return r.tvmRoles[t.SrcID]
}
func (r *Roles) GetRolesForUser(t *CheckedUserTicket, uid *UID) (*ConsumerRoles, error) {
if t.Env != BlackboxProdYateam {
return nil, xerrors.Errorf("user ticket must be from ProdYateam, got from %s", t.Env)
}
if uid == nil {
if t.DefaultUID == 0 {
return nil, xerrors.Errorf("default uid is 0 - it cannot have any role")
}
uid = &t.DefaultUID
} else {
found := false
for _, u := range t.UIDs {
if u == *uid {
found = true
break
}
}
if !found {
return nil, xerrors.Errorf("'uid' must be in user ticket but it is not: %d", *uid)
}
}
return r.userRoles[*uid], nil
}
func (r *Roles) GetRaw() []byte {
return r.raw
}
func (r *Roles) GetMeta() Meta {
return r.meta
}
func (r *Roles) CheckServiceRole(t *CheckedServiceTicket, roleName string, opts *CheckServiceOptions) bool {
e := r.GetRolesForService(t).GetEntitiesForRole(roleName)
if e == nil {
return false
}
if opts != nil {
if opts.Entity != nil && !e.ContainsExactEntity(opts.Entity) {
return false
}
}
return true
}
func (r *Roles) CheckUserRole(t *CheckedUserTicket, roleName string, opts *CheckUserOptions) (bool, error) {
var uid *UID
if opts != nil && opts.UID != 0 {
uid = &opts.UID
}
roles, err := r.GetRolesForUser(t, uid)
if err != nil {
return false, err
}
e := roles.GetEntitiesForRole(roleName)
if e == nil {
return false, nil
}
if opts != nil {
if opts.Entity != nil && !e.ContainsExactEntity(opts.Entity) {
return false, nil
}
}
return true, nil
}
func (r *ConsumerRoles) HasRole(roleName string) bool {
return r.GetEntitiesForRole(roleName) != nil
}
func (r *ConsumerRoles) GetRoles() EntitiesByRoles {
if r == nil {
return nil
}
return r.roles
}
func (r *ConsumerRoles) GetEntitiesForRole(roleName string) *Entities {
if r == nil {
return nil
}
return r.roles[roleName]
}
func (r *ConsumerRoles) DebugPrint() string {
tmp := make(map[string][]Entity)
for k, v := range r.roles {
tmp[k] = v.subtree.entities
}
res, err := json.MarshalIndent(tmp, "", " ")
if err != nil {
panic(err)
}
return string(res)
}
func (e *Entities) ContainsExactEntity(entity Entity) bool {
if e == nil {
return false
}
return e.subtree.containsExactEntity(entity)
}
func (e *Entities) GetEntitiesWithAttrs(entityPart Entity) []Entity {
if e == nil {
return nil
}
return e.subtree.getEntitiesWithAttrs(entityPart)
}
|
