mirror of
https://github.com/kopia/kopia.git
synced 2025-12-23 22:57:50 -05:00
044db7593b
* feat(repository): apply retention policies server-side This allows append-only snapshots where the client can never delete arbitrary manifests and policies are maintained on the server. The client only needs permissions to create snapshots in a given, which automatically gives them permission to invoke the server-side method for their own snapshots only. * Update cli/command_acl_add.go Co-authored-by: Guillaume <Gui13@users.noreply.github.com> * Update internal/server/api_manifest.go Co-authored-by: Guillaume <Gui13@users.noreply.github.com> * Update internal/server/api_manifest.go Co-authored-by: Guillaume <Gui13@users.noreply.github.com> * Update internal/server/grpc_session.go Co-authored-by: Guillaume <Gui13@users.noreply.github.com> --------- Co-authored-by: Guillaume <Gui13@users.noreply.github.com>
51 lines
1.2 KiB
Go
51 lines
1.2 KiB
Go
package cli
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/pkg/errors"
|
|
|
|
"github.com/kopia/kopia/internal/acl"
|
|
"github.com/kopia/kopia/internal/auth"
|
|
"github.com/kopia/kopia/repo"
|
|
)
|
|
|
|
type commandACLEnable struct {
|
|
reset bool
|
|
}
|
|
|
|
func (c *commandACLEnable) setup(svc appServices, parent commandParent) {
|
|
cmd := parent.Command("enable", "Enable ACLs and install default entries")
|
|
cmd.Flag("reset", "Reset all ACLs to default").BoolVar(&c.reset)
|
|
cmd.Action(svc.repositoryWriterAction(c.run))
|
|
}
|
|
|
|
func (c *commandACLEnable) run(ctx context.Context, rep repo.RepositoryWriter) error {
|
|
entries, err := acl.LoadEntries(ctx, rep, nil)
|
|
if err != nil {
|
|
return errors.Wrap(err, "error loading ACL entries")
|
|
}
|
|
|
|
if len(entries) != 0 && !c.reset {
|
|
return errors.Errorf("ACLs already enabled")
|
|
}
|
|
|
|
if c.reset {
|
|
for _, e := range entries {
|
|
log(ctx).Infof("deleting previous ACL entry %v", e.ManifestID)
|
|
|
|
if err := rep.DeleteManifest(ctx, e.ManifestID); err != nil {
|
|
return errors.Wrap(err, "unable to delete previous ACL")
|
|
}
|
|
}
|
|
}
|
|
|
|
for _, e := range auth.DefaultACLs {
|
|
if err := acl.AddACL(ctx, rep, e, false); err != nil {
|
|
return errors.Wrap(err, "unable to add default ACL")
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|