marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#583: Added granular multi-org control and read-only user

Browse Source
This commit is contained in:
frikky
2021-11-23 00:26:53 +01:00
parent 623a365030
commit f4b86abda7
5 changed files with 104 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/go-app/main.go
+22 -1
View File
@@ -2853,7 +2853,7 @@ func echoOpenapiData(resp http.ResponseWriter, request *http.Request) {
}
// Just here to verify that the user is logged in
_, err := shuffle.HandleApiAuthentication(resp, request)
user, err := shuffle.HandleApiAuthentication(resp, request)
if err != nil {
log.Printf("Api authentication failed in validate swagger: %s", err)
resp.WriteHeader(401)
@@ -2861,6 +2861,13 @@ func echoOpenapiData(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to echo OpenAPI data: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
body, err := ioutil.ReadAll(request.Body)
if err != nil {
log.Printf("Bodyreader err: %s", err)
@@ -3335,6 +3342,13 @@ func verifySwagger(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to check swagger doc: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
body, err := ioutil.ReadAll(request.Body)
if err != nil {
resp.WriteHeader(401)
@@ -5571,6 +5585,13 @@ func makeWorkflowPublic(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access publish workflow: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
location := strings.Split(request.URL.String(), "/")
var fileId string
if location[1] == "api" {