marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#583: Added granular multi-org control and read-only user

Browse Source
This commit is contained in:
frikky
2021-11-23 00:26:53 +01:00
parent 623a365030
commit f4b86abda7
5 changed files with 104 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/go-app/main.go
+22 -1
View File
@@ -2853,7 +2853,7 @@ func echoOpenapiData(resp http.ResponseWriter, request *http.Request) {
}
// Just here to verify that the user is logged in
_, err := shuffle.HandleApiAuthentication(resp, request)
user, err := shuffle.HandleApiAuthentication(resp, request)
if err != nil {
log.Printf("Api authentication failed in validate swagger: %s", err)
resp.WriteHeader(401)
@@ -2861,6 +2861,13 @@ func echoOpenapiData(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to echo OpenAPI data: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
body, err := ioutil.ReadAll(request.Body)
if err != nil {
log.Printf("Bodyreader err: %s", err)
@@ -3335,6 +3342,13 @@ func verifySwagger(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to check swagger doc: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
body, err := ioutil.ReadAll(request.Body)
if err != nil {
resp.WriteHeader(401)
@@ -5571,6 +5585,13 @@ func makeWorkflowPublic(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access publish workflow: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
location := strings.Split(request.URL.String(), "/")
var fileId string
if location[1] == "api" {
backend/go-app/walkoff.go
+58 -3
View File
@@ -676,6 +676,13 @@ func deleteWorkflow(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to stop schedule: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
location := strings.Split(request.URL.String(), "/")
var fileId string
@@ -1036,6 +1043,13 @@ func executeWorkflow(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to run workflow: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
location := strings.Split(request.URL.String(), "/")
var fileId string
@@ -1106,6 +1120,13 @@ func stopSchedule(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to stop schedule: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
location := strings.Split(request.URL.String(), "/")
var fileId string
@@ -1358,6 +1379,13 @@ func scheduleWorkflow(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to schedule workflow: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
location := strings.Split(request.URL.String(), "/")
var fileId string
@@ -1744,7 +1772,7 @@ func validateAppInput(resp http.ResponseWriter, request *http.Request) {
// Just need to be logged in
// FIXME - should have some permissions?
_, err := shuffle.HandleApiAuthentication(resp, request)
user, err := shuffle.HandleApiAuthentication(resp, request)
if err != nil {
log.Printf("Api authentication failed in set new app: %s", err)
resp.WriteHeader(401)
@@ -1752,6 +1780,13 @@ func validateAppInput(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to delete apps: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
filebytes, err := handleGetfile(resp, request)
if err != nil {
resp.WriteHeader(401)
@@ -2237,8 +2272,7 @@ func setNewWorkflowApp(resp http.ResponseWriter, request *http.Request) {
}
// Just need to be logged in
// FIXME - should have some permissions?
_, err := shuffle.HandleApiAuthentication(resp, request)
user, err := shuffle.HandleApiAuthentication(resp, request)
if err != nil {
log.Printf("Api authentication failed in set new app: %s", err)
resp.WriteHeader(401)
@@ -2246,6 +2280,13 @@ func setNewWorkflowApp(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to set new workflowapp: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
body, err := ioutil.ReadAll(request.Body)
if err != nil {
log.Printf("Error with body read: %s", err)
@@ -2470,6 +2511,13 @@ func executeSingleAction(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to execute single action: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
location := strings.Split(request.URL.String(), "/")
var fileId string
if location[1] == "api" {
@@ -2925,6 +2973,13 @@ func LoadSpecificApps(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role != "admin" {
log.Printf("[WARNING] Not admin during app loading: %s (%s).", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Not admin"}`))
return
}
body, err := ioutil.ReadAll(request.Body)
if err != nil {
log.Printf("Error with body read: %s", err)
frontend/package.json
+1 -1
View File
@@ -17,7 +17,7 @@
"babel-eslint": "^10.1.0",
"class-transformer": "^0.4.0",
"create-react-app": "^4.0.3",
"cytoscape": "^3.20.0",
"cytoscape": "^3.15.1",
"cytoscape-clipboard": "^2.2.1",
"cytoscape-cxtmenu": "^3.1.1",
"cytoscape-edgehandles": "^3.6.0",
frontend/src/views/Admin.jsx
+11 -2
View File
@@ -2834,7 +2834,7 @@ const Admin = (props) => {
}}
value={"admin"}
>
Admin
Org Admin
</MenuItem>
<MenuItem
style={{
@@ -2843,7 +2843,16 @@ const Admin = (props) => {
}}
value={"user"}
>
User
Org User
</MenuItem>
<MenuItem
style={{
backgroundColor: theme.palette.inputColor,
color: "white",
}}
value={"org-reader"}
>
Org Reader
</MenuItem>
</Select>
}
frontend/src/views/Workflows.jsx
+12 -2
View File
@@ -1194,7 +1194,7 @@ const Workflows = (props) => {
.then((response) => {
if (response.status !== 200) {
console.log("Status not 200 for setting workflows :O!");
alert.error("Failed deleting workflow");
alert.error("Failed deleting workflow. Do you have access?");
} else {
alert.success("Deleted workflow " + id);
}
@@ -1302,7 +1302,7 @@ const Workflows = (props) => {
style={{ backgroundColor: inputColor, color: "white" }}
onClick={() => {
setModalOpen(true);
setEditingWorkflow(data);
setEditingWorkflow(JSON.parse(JSON.stringify(data)));
setNewWorkflowName(data.name);
setNewWorkflowDescription(data.description);
setDefaultReturnValue(data.default_return_value);
@@ -1728,6 +1728,16 @@ const Workflows = (props) => {
return response.json();
})
.then((responseJson) => {
if (responseJson.success === false) {
if (responseJson.reason !== undefined) {
alert.error("Error setting workflow: ", responseJson.reason)
} else {
alert.error("Error setting workflow.")
}
return
}
if (method === "POST" && redirect) {
window.location.pathname = "/workflows/" + responseJson["id"];
setModalOpen(false);