-
-
Notifications
You must be signed in to change notification settings - Fork 31.4k
/
Copy pathpermission.h
99 lines (80 loc) · 3.52 KB
/
permission.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
#ifndef SRC_PERMISSION_PERMISSION_H_
#define SRC_PERMISSION_PERMISSION_H_
#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
#include "debug_utils.h"
#include "node_options.h"
#include "permission/child_process_permission.h"
#include "permission/fs_permission.h"
#include "permission/inspector_permission.h"
#include "permission/permission_base.h"
#include "permission/wasi_permission.h"
#include "permission/worker_permission.h"
#include "v8.h"
#include <string_view>
#include <unordered_map>
namespace node {
class Environment;
namespace fs {
class FSReqBase;
}
namespace permission {
#define THROW_IF_INSUFFICIENT_PERMISSIONS(env, perm_, resource_, ...) \
do { \
if (!env->permission()->is_granted(env, perm_, resource_)) [[unlikely]] { \
node::permission::Permission::ThrowAccessDenied( \
(env), perm_, resource_); \
return __VA_ARGS__; \
} \
} while (0)
#define ASYNC_THROW_IF_INSUFFICIENT_PERMISSIONS( \
env, wrap, perm_, resource_, ...) \
do { \
if (!env->permission()->is_granted(env, perm_, resource_)) [[unlikely]] { \
node::permission::Permission::AsyncThrowAccessDenied( \
(env), wrap, perm_, resource_); \
return __VA_ARGS__; \
} \
} while (0)
class Permission {
public:
Permission();
FORCE_INLINE bool is_granted(Environment* env,
const PermissionScope permission,
const std::string_view& res = "") const {
if (!enabled_) [[likely]] {
return true;
}
return is_scope_granted(env, permission, res);
}
FORCE_INLINE bool enabled() const { return enabled_; }
static PermissionScope StringToPermission(const std::string& perm);
static const char* PermissionToString(PermissionScope perm);
static void ThrowAccessDenied(Environment* env,
PermissionScope perm,
const std::string_view& res);
static void AsyncThrowAccessDenied(Environment* env,
fs::FSReqBase* req_wrap,
PermissionScope perm,
const std::string_view& res);
// CLI Call
void Apply(Environment* env,
const std::vector<std::string>& allow,
PermissionScope scope);
void EnablePermissions();
private:
COLD_NOINLINE bool is_scope_granted(Environment* env,
const PermissionScope permission,
const std::string_view& res = "") const {
auto perm_node = nodes_.find(permission);
if (perm_node != nodes_.end()) {
return perm_node->second->is_granted(env, permission, res);
}
return false;
}
std::unordered_map<PermissionScope, std::shared_ptr<PermissionBase>> nodes_;
bool enabled_;
};
} // namespace permission
} // namespace node
#endif // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
#endif // SRC_PERMISSION_PERMISSION_H_