chore: Implement standard rbac.Subject to be reused everywhere #5881
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
An rbac subject is created in multiple spots because of the way we expand roles, scopes, etc. This difference in use creates a list of arguments which is unwieldy. Use of the expander interface lets us conform to a single subject in every case
Emyrk
commented
Jan 26, 2023
Comment on lines
+22
to
+27
| type Subject struct { | ||
| ID string | ||
| Roles ExpandableRoles | ||
| Groups []string | ||
| Scope ExpandableScope | ||
| } |
There was a problem hiding this comment.
This is the added type shared by all callers now.
Emyrk
commented
Jan 26, 2023
Comment on lines
+46
to
+47
| Authorize(ctx context.Context, subject Subject, action Action, object Object) error | ||
| Prepare(ctx context.Context, subject Subject, action Action, objectType string) (PreparedAuthorized, error) |
There was a problem hiding this comment.
This is the interface of the package changing to use less arguments.
Emyrk
commented
Jan 26, 2023
| return err | ||
| } | ||
| err := a.authorize(ctx, subject, action, object) | ||
| span.SetAttributes(attribute.Bool("authorized", err == nil)) |
There was a problem hiding this comment.
This is better than an event, learned I can add attributes to a span after I started it. So it allows filtering the parent span on this attribute, which is what I want.
johnstcn
reviewed
Jan 26, 2023
| @@ -217,7 +219,7 @@ func (api *API) checkAuthorization(rw http.ResponseWriter, r *http.Request) { | |||
| obj = dbObj.RBACObject() | |||
| } | |||
|
|
|||
| err := api.Authorizer.ByRoleName(ctx, auth.ID.String(), auth.Roles, auth.Scope.ToRBAC(), auth.Groups, rbac.Action(v.Action), obj) | |||
| err := api.Authorizer.Authorize(ctx, auth.Actor, rbac.Action(v.Action), obj) | |||
There was a problem hiding this comment.
This is so much nicer and more readable ❤️
johnstcn
reviewed
Jan 26, 2023
|
|
||
| // SafeScopeName prevent nil pointer dereference. | ||
| func (s Subject) SafeScopeName() string { | ||
| if s.Scope == nil { |
There was a problem hiding this comment.
Looking at RegoAuthorizer.Authorize, wouldn't this be a developer error?
There was a problem hiding this comment.
It would be a developer error.
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is purely a type refactor, and does not change any behavior
What this does
Before this PR, the rbac package expected the caller to hold the various
Subjectfields, and pass them in as individual arguments:(subjectID string, roleNames ExpandableRoles, scope ScopeName, groups []string). This was ok in the beginning when it was just(ID, Roles), but it has grown toscopeandgroupsas well.This change ensures all subject fields are tightly coupled, and less likely to be mistakenly used. It also simplifies using
rbacsince the arguments are nowAutorize(ctx, subject, action, object).The only downside is that logging still requires poking into the subject struct. But usage of the rbac package now takes less arguments.
What this enables
For
authquerierinterface we wanted to enable the use of aSystemactor. This actor needs to have custom roles that should not be available to the user. This newSubjectstruct accepts both user defined roles,RoleNamesand explicitRoles.This allows us to create custom roles that will never be returned via an api or any other exporting of roles (docs, enums, etc).
Minor bonus, this allows unit tests to call the
Authorizedirectly as it was using explicit Roles.