Files
kopia/cli/command_acl_delete.go
Jarek Kowalski cbcd59f18e Added repository user authorization support + server flag refactoring + refresh (#890)
* nit: replaced harcoded string constants with named constants

* acl: added management of ACL entries

* auth: implemented DefaultAuthorizer which uses ACLs if any entries are found in the system and falls back to LegacyAuthorizer if not

* cli: switch to DefaultAuthorizer when starting server

* cli: added ACL management

* server: refactored authenticator + added refresh

Authenticator is now an interface which also supports Refresh.

* authz: refactored authorizer to be an interface + added Refresh()

* server: refresh authentication and authorizer

* e2e tests for ACLs

* server: handling of SIGHUP to refresh authn/authz caches

* server: reorganized flags to specify auth options:

- removed '--allow-repository-users' - it's always on
- one of --without-password, --server-password or --random-password
  can be specified to specify password for the UI user
- htpasswd-file - can be specified to provide password for UI or remote
  users

* cli: moved 'kopia user' to 'kopia server user'

* server: allow all UI actions if no authenticator is set

* acl: removed priority until we have a better understood use case for it

* acl: added validation of allowed labels when adding ACL entries

* site: added docs for ACLs
2021-03-18 23:03:27 -07:00

67 lines
1.4 KiB
Go

package cli
import (
"context"
"github.com/pkg/errors"
"github.com/kopia/kopia/internal/acl"
"github.com/kopia/kopia/repo"
)
var (
aclRemoveCommand = aclCommands.Command("delete", "Delete ACL entry").Alias("rm").Alias("remove")
aclRemoveIDs = aclRemoveCommand.Arg("id", "Entry ID").Strings()
aclRemoveAll = aclRemoveCommand.Flag("all", "Remove all ACL entries").Bool()
aclRemoveConfirm = aclRemoveCommand.Flag("delete", "Really delete").Bool()
)
func dryRunDelete(ctx context.Context, e *acl.Entry) {
log(ctx).Infof("would delete entry %v, pass --delete to actually delete", e.ManifestID)
}
func shouldRemoveACLEntry(ctx context.Context, e *acl.Entry) bool {
if *aclRemoveAll {
if !*aclRemoveConfirm {
dryRunDelete(ctx, e)
return false
}
return true
}
for _, tr := range *aclRemoveIDs {
if tr == string(e.ManifestID) {
if !*aclRemoveConfirm {
dryRunDelete(ctx, e)
return false
}
return true
}
}
return false
}
func runACLRemove(ctx context.Context, rep repo.RepositoryWriter) error {
entries, err := acl.LoadEntries(ctx, rep, nil)
if err != nil {
return errors.Wrap(err, "unable to load entries")
}
for _, e := range entries {
if shouldRemoveACLEntry(ctx, e) {
if err := rep.DeleteManifest(ctx, e.ManifestID); err != nil {
return errors.Wrap(err, "unable to delete manifest")
}
}
}
return nil
}
func init() {
aclRemoveCommand.Action(repositoryWriterAction(runACLRemove))
}