marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#583: Added granular multi-org control and read-only user

Browse Source
This commit is contained in:
frikky
2021-11-23 00:26:53 +01:00
parent 623a365030
commit f4b86abda7
5 changed files with 104 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/go-app/walkoff.go
+58 -3
View File
@@ -676,6 +676,13 @@ func deleteWorkflow(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to stop schedule: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
location := strings.Split(request.URL.String(), "/")
var fileId string
@@ -1036,6 +1043,13 @@ func executeWorkflow(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to run workflow: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
location := strings.Split(request.URL.String(), "/")
var fileId string
@@ -1106,6 +1120,13 @@ func stopSchedule(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to stop schedule: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
location := strings.Split(request.URL.String(), "/")
var fileId string
@@ -1358,6 +1379,13 @@ func scheduleWorkflow(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to schedule workflow: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
location := strings.Split(request.URL.String(), "/")
var fileId string
@@ -1744,7 +1772,7 @@ func validateAppInput(resp http.ResponseWriter, request *http.Request) {
// Just need to be logged in
// FIXME - should have some permissions?
_, err := shuffle.HandleApiAuthentication(resp, request)
user, err := shuffle.HandleApiAuthentication(resp, request)
if err != nil {
log.Printf("Api authentication failed in set new app: %s", err)
resp.WriteHeader(401)
@@ -1752,6 +1780,13 @@ func validateAppInput(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to delete apps: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
filebytes, err := handleGetfile(resp, request)
if err != nil {
resp.WriteHeader(401)
@@ -2237,8 +2272,7 @@ func setNewWorkflowApp(resp http.ResponseWriter, request *http.Request) {
}
// Just need to be logged in
// FIXME - should have some permissions?
_, err := shuffle.HandleApiAuthentication(resp, request)
user, err := shuffle.HandleApiAuthentication(resp, request)
if err != nil {
log.Printf("Api authentication failed in set new app: %s", err)
resp.WriteHeader(401)
@@ -2246,6 +2280,13 @@ func setNewWorkflowApp(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to set new workflowapp: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
body, err := ioutil.ReadAll(request.Body)
if err != nil {
log.Printf("Error with body read: %s", err)
@@ -2470,6 +2511,13 @@ func executeSingleAction(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role == "org-reader" {
log.Printf("[WARNING] Org-reader doesn't have access to execute single action: %s (%s)", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Read only user"}`))
return
}
location := strings.Split(request.URL.String(), "/")
var fileId string
if location[1] == "api" {
@@ -2925,6 +2973,13 @@ func LoadSpecificApps(resp http.ResponseWriter, request *http.Request) {
return
}
if user.Role != "admin" {
log.Printf("[WARNING] Not admin during app loading: %s (%s).", user.Username, user.Id)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false, "reason": "Not admin"}`))
return
}
body, err := ioutil.ReadAll(request.Body)
if err != nil {
log.Printf("Error with body read: %s", err)