89 lines
2.7 KiB
C#
89 lines
2.7 KiB
C#
// Copyright Epic Games, Inc. All Rights Reserved.
|
|
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Threading.Tasks;
|
|
using EpicGames.Horde.Storage;
|
|
using Jupiter.Common;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.Extensions.Options;
|
|
|
|
namespace Jupiter
|
|
{
|
|
public class NamespaceAccessRequest
|
|
{
|
|
public NamespaceId Namespace { get; init; }
|
|
public JupiterAclAction[] Actions { get; init; } = Array.Empty<JupiterAclAction>();
|
|
}
|
|
|
|
// verifies that you have access to a namespace by checking if you have a corresponding claim to that namespace
|
|
public class NamespaceAuthorizationHandler : AuthorizationHandler<NamespaceAccessRequirement, NamespaceAccessRequest>
|
|
{
|
|
private readonly INamespacePolicyResolver _namespacePolicyResolver;
|
|
private readonly IOptionsMonitor<AuthSettings> _authSettings;
|
|
|
|
public NamespaceAuthorizationHandler(INamespacePolicyResolver namespacePolicyResolver, IOptionsMonitor<AuthSettings> authSettings)
|
|
{
|
|
_namespacePolicyResolver = namespacePolicyResolver;
|
|
_authSettings = authSettings;
|
|
}
|
|
|
|
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, NamespaceAccessRequirement requirement,
|
|
NamespaceAccessRequest accessRequest)
|
|
{
|
|
NamespaceId namespaceName = accessRequest.Namespace;
|
|
if (!_authSettings.CurrentValue.Enabled && !_authSettings.CurrentValue.RequireAcls)
|
|
{
|
|
context.Succeed(requirement);
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
try
|
|
{
|
|
if (accessRequest.Actions.Length == 0)
|
|
{
|
|
throw new Exception("At least 1 AclAction has to be specified for the namespace access request");
|
|
}
|
|
|
|
NamespacePolicy policy = _namespacePolicyResolver.GetPoliciesForNs(namespaceName);
|
|
|
|
List<JupiterAclAction> allowedActions = new List<JupiterAclAction>();
|
|
foreach (AclEntry acl in policy.Acls)
|
|
{
|
|
allowedActions.AddRange(acl.Resolve(context));
|
|
}
|
|
|
|
// the root and namespace acls are combined, namespace acls can not override what we define in the root
|
|
foreach (AclEntry acl in _authSettings.CurrentValue.Acls)
|
|
{
|
|
allowedActions.AddRange(acl.Resolve(context));
|
|
}
|
|
|
|
bool haveAccessToActions = true;
|
|
foreach (JupiterAclAction requiredAction in accessRequest.Actions)
|
|
{
|
|
if (!allowedActions.Contains(requiredAction))
|
|
{
|
|
haveAccessToActions = false;
|
|
}
|
|
}
|
|
if (haveAccessToActions)
|
|
{
|
|
context.Succeed(requirement);
|
|
}
|
|
}
|
|
catch (NamespaceNotFoundException)
|
|
{
|
|
// if the namespace doesn't have a policy setup, e.g. we do not know which claims to require then we can just exit here as the auth will fail
|
|
}
|
|
|
|
return Task.CompletedTask;
|
|
}
|
|
}
|
|
|
|
public class NamespaceAccessRequirement : IAuthorizationRequirement
|
|
{
|
|
public const string Name = "NamespaceAccess";
|
|
}
|
|
}
|