mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-02-01 01:41:21 -05:00
f38a9f4385
* add policies service add policies proxy middleware add policies event service add policies grpc service prepare ci and git environments (ci, make, readme, doc) * add webfinger to the drone conf * fix docs remove not used virus scan postprocessing step * relocate example rego file implicitly enable and disable proxy and postprocessing policy checking by setting the query. update configuration descriptions * move policies update readme * use converter func to convert pp environment to actual environment expose and test custom rego functions add engine unit tests add opa unit tests update policies readme Co-authored-by: Martin <github@diemattels.at> * relocate sample policies to the deployments folder change and document policies service port * update index.md and small fix * add health command add version command add debug server --------- Co-authored-by: Martin <github@diemattels.at>
63 lines
1.6 KiB
Go
63 lines
1.6 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
revactx "github.com/cs3org/reva/v2/pkg/ctx"
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/log"
|
|
"github.com/owncloud/ocis/v2/ocis-pkg/service/grpc"
|
|
pMessage "github.com/owncloud/ocis/v2/protogen/gen/ocis/messages/policies/v0"
|
|
pService "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/policies/v0"
|
|
)
|
|
|
|
// Policies verifies if a request is granted or not.
|
|
func Policies(logger log.Logger, qs string) func(next http.Handler) http.Handler {
|
|
pClient := pService.NewPoliciesProviderService("com.owncloud.api.policies", grpc.DefaultClient())
|
|
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if qs == "" {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
req := &pService.EvaluateRequest{
|
|
Query: qs,
|
|
Environment: &pMessage.Environment{
|
|
Request: &pMessage.Request{
|
|
Method: r.Method,
|
|
Path: r.URL.Path,
|
|
},
|
|
Stage: pMessage.Stage_STAGE_HTTP,
|
|
},
|
|
}
|
|
|
|
if user, ok := revactx.ContextGetUser(r.Context()); ok {
|
|
req.Environment.User = &pMessage.User{
|
|
Id: &pMessage.User_ID{
|
|
OpaqueId: user.GetId().GetOpaqueId(),
|
|
},
|
|
Username: user.GetUsername(),
|
|
Mail: user.GetMail(),
|
|
DisplayName: user.GetDisplayName(),
|
|
Groups: user.GetGroups(),
|
|
}
|
|
}
|
|
|
|
rsp, err := pClient.Evaluate(r.Context(), req)
|
|
if err != nil {
|
|
logger.Err(err).Msg("error evaluating request")
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
if !rsp.Result {
|
|
w.WriteHeader(http.StatusForbidden)
|
|
return
|
|
}
|
|
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|