1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
|
package tvm
import (
"encoding/json"
"github.com/ydb-platform/ydb/library/go/core/xerrors"
)
func (r *Roles) GetRolesForService(t *CheckedServiceTicket) *ConsumerRoles {
return r.tvmRoles[t.SrcID]
}
func (r *Roles) GetRolesForUser(t *CheckedUserTicket, uid *UID) (*ConsumerRoles, error) {
if t.Env != BlackboxProdYateam {
return nil, xerrors.Errorf("user ticket must be from ProdYateam, got from %s", t.Env)
}
if uid == nil {
if t.DefaultUID == 0 {
return nil, xerrors.Errorf("default uid is 0 - it cannot have any role")
}
uid = &t.DefaultUID
} else {
found := false
for _, u := range t.UIDs {
if u == *uid {
found = true
break
}
}
if !found {
return nil, xerrors.Errorf("'uid' must be in user ticket but it is not: %d", *uid)
}
}
return r.userRoles[*uid], nil
}
func (r *Roles) GetRaw() []byte {
return r.raw
}
func (r *Roles) GetMeta() Meta {
return r.meta
}
func (r *Roles) CheckServiceRole(t *CheckedServiceTicket, roleName string, opts *CheckServiceOptions) bool {
roles := r.GetRolesForService(t)
if !roles.HasRole(roleName) {
return false
}
if opts != nil && opts.Entity != nil {
e := roles.GetEntitiesForRole(roleName)
if e == nil {
return false
}
if !e.ContainsExactEntity(opts.Entity) {
return false
}
}
return true
}
func (r *Roles) CheckUserRole(t *CheckedUserTicket, roleName string, opts *CheckUserOptions) (bool, error) {
var uid *UID
if opts != nil && opts.UID != 0 {
uid = &opts.UID
}
roles, err := r.GetRolesForUser(t, uid)
if err != nil {
return false, err
}
if !roles.HasRole(roleName) {
return false, nil
}
if opts != nil && opts.Entity != nil {
e := roles.GetEntitiesForRole(roleName)
if e == nil {
return false, nil
}
if !e.ContainsExactEntity(opts.Entity) {
return false, nil
}
}
return true, nil
}
func (r *ConsumerRoles) HasRole(roleName string) bool {
if r == nil {
return false
}
_, ok := r.roles[roleName]
return ok
}
func (r *ConsumerRoles) GetRoles() EntitiesByRoles {
if r == nil {
return nil
}
return r.roles
}
func (r *ConsumerRoles) GetEntitiesForRole(roleName string) *Entities {
if r == nil {
return nil
}
return r.roles[roleName]
}
func (r *ConsumerRoles) DebugPrint() string {
tmp := make(map[string][]Entity)
for k, v := range r.roles {
if v != nil {
tmp[k] = v.subtree.entities
} else {
tmp[k] = nil
}
}
res, err := json.MarshalIndent(tmp, "", " ")
if err != nil {
panic(err)
}
return string(res)
}
func (e *Entities) ContainsExactEntity(entity Entity) bool {
if e == nil {
return false
}
return e.subtree.containsExactEntity(entity)
}
func (e *Entities) GetEntitiesWithAttrs(entityPart Entity) []Entity {
if e == nil {
return nil
}
return e.subtree.getEntitiesWithAttrs(entityPart)
}
|