365 lines
14 KiB
Python
365 lines
14 KiB
Python
import logging
|
|
|
|
from collections import namedtuple, defaultdict
|
|
from functools import partial
|
|
|
|
from flask_principal import identity_loaded, Permission, Identity, identity_changed
|
|
|
|
|
|
from app import app, superusers
|
|
from auth import scopes
|
|
from data import model
|
|
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
_ResourceNeed = namedtuple('resource', ['type', 'namespace', 'name', 'role'])
|
|
_RepositoryNeed = partial(_ResourceNeed, 'repository')
|
|
_NamespaceWideNeed = namedtuple('namespacewide', ['type', 'namespace', 'role'])
|
|
_OrganizationNeed = partial(_NamespaceWideNeed, 'organization')
|
|
_OrganizationRepoNeed = partial(_NamespaceWideNeed, 'organizationrepo')
|
|
_TeamTypeNeed = namedtuple('teamwideneed', ['type', 'orgname', 'teamname', 'role'])
|
|
_TeamNeed = partial(_TeamTypeNeed, 'orgteam')
|
|
_UserTypeNeed = namedtuple('userspecificneed', ['type', 'username', 'role'])
|
|
_UserNeed = partial(_UserTypeNeed, 'user')
|
|
_SuperUserNeed = partial(namedtuple('superuserneed', ['type']), 'superuser')
|
|
|
|
|
|
REPO_ROLES = [None, 'read', 'write', 'admin']
|
|
TEAM_ROLES = [None, 'member', 'creator', 'admin']
|
|
USER_ROLES = [None, 'read', 'admin']
|
|
|
|
TEAM_ORGWIDE_REPO_ROLES = {
|
|
'admin': 'admin',
|
|
'creator': None,
|
|
'member': None,
|
|
}
|
|
|
|
SCOPE_MAX_REPO_ROLES = defaultdict(lambda: None)
|
|
SCOPE_MAX_REPO_ROLES.update({
|
|
scopes.READ_REPO: 'read',
|
|
scopes.WRITE_REPO: 'write',
|
|
scopes.ADMIN_REPO: 'admin',
|
|
scopes.DIRECT_LOGIN: 'admin',
|
|
})
|
|
|
|
SCOPE_MAX_TEAM_ROLES = defaultdict(lambda: None)
|
|
SCOPE_MAX_TEAM_ROLES.update({
|
|
scopes.CREATE_REPO: 'creator',
|
|
scopes.DIRECT_LOGIN: 'admin',
|
|
scopes.ORG_ADMIN: 'admin',
|
|
})
|
|
|
|
SCOPE_MAX_USER_ROLES = defaultdict(lambda: None)
|
|
SCOPE_MAX_USER_ROLES.update({
|
|
scopes.READ_USER: 'read',
|
|
scopes.DIRECT_LOGIN: 'admin',
|
|
scopes.ADMIN_USER: 'admin',
|
|
})
|
|
|
|
def repository_read_grant(namespace, repository):
|
|
return _RepositoryNeed(namespace, repository, 'read')
|
|
|
|
|
|
def repository_write_grant(namespace, repository):
|
|
return _RepositoryNeed(namespace, repository, 'write')
|
|
|
|
|
|
def repository_admin_grant(namespace, repository):
|
|
return _RepositoryNeed(namespace, repository, 'admin')
|
|
|
|
|
|
class QuayDeferredPermissionUser(Identity):
|
|
def __init__(self, uuid, auth_type, auth_scopes, user=None):
|
|
super(QuayDeferredPermissionUser, self).__init__(uuid, auth_type)
|
|
|
|
self._namespace_wide_loaded = set()
|
|
self._repositories_loaded = set()
|
|
self._personal_loaded = False
|
|
|
|
self._scope_set = auth_scopes
|
|
self._user_object = user
|
|
|
|
@staticmethod
|
|
def for_id(uuid, auth_scopes=None):
|
|
auth_scopes = auth_scopes if auth_scopes is not None else {scopes.DIRECT_LOGIN}
|
|
return QuayDeferredPermissionUser(uuid, 'user_uuid', auth_scopes)
|
|
|
|
@staticmethod
|
|
def for_user(user, auth_scopes=None):
|
|
auth_scopes = auth_scopes if auth_scopes is not None else {scopes.DIRECT_LOGIN}
|
|
return QuayDeferredPermissionUser(user.uuid, 'user_uuid', auth_scopes, user=user)
|
|
|
|
def _translate_role_for_scopes(self, cardinality, max_roles, role):
|
|
if self._scope_set is None:
|
|
return role
|
|
|
|
max_for_scopes = max({cardinality.index(max_roles[scope]) for scope in self._scope_set})
|
|
|
|
if max_for_scopes < cardinality.index(role):
|
|
logger.debug('Translated permission %s -> %s', role, cardinality[max_for_scopes])
|
|
return cardinality[max_for_scopes]
|
|
else:
|
|
return role
|
|
|
|
def _team_role_for_scopes(self, role):
|
|
return self._translate_role_for_scopes(TEAM_ROLES, SCOPE_MAX_TEAM_ROLES, role)
|
|
|
|
def _repo_role_for_scopes(self, role):
|
|
return self._translate_role_for_scopes(REPO_ROLES, SCOPE_MAX_REPO_ROLES, role)
|
|
|
|
def _user_role_for_scopes(self, role):
|
|
return self._translate_role_for_scopes(USER_ROLES, SCOPE_MAX_USER_ROLES, role)
|
|
|
|
def _populate_user_provides(self, user_object):
|
|
""" Populates the provides that naturally apply to a user, such as being the admin of
|
|
their own namespace.
|
|
"""
|
|
|
|
# Add the user specific permissions, only for non-oauth permission
|
|
user_grant = _UserNeed(user_object.username, self._user_role_for_scopes('admin'))
|
|
logger.debug('User permission: {0}'.format(user_grant))
|
|
self.provides.add(user_grant)
|
|
|
|
# Every user is the admin of their own 'org'
|
|
user_namespace = _OrganizationNeed(user_object.username, self._team_role_for_scopes('admin'))
|
|
logger.debug('User namespace permission: {0}'.format(user_namespace))
|
|
self.provides.add(user_namespace)
|
|
|
|
# Org repo roles can differ for scopes
|
|
user_repos = _OrganizationRepoNeed(user_object.username, self._repo_role_for_scopes('admin'))
|
|
logger.debug('User namespace repo permission: {0}'.format(user_repos))
|
|
self.provides.add(user_repos)
|
|
|
|
if ((scopes.SUPERUSER in self._scope_set or scopes.DIRECT_LOGIN in self._scope_set) and
|
|
superusers.is_superuser(user_object.username)):
|
|
logger.debug('Adding superuser to user: %s', user_object.username)
|
|
self.provides.add(_SuperUserNeed())
|
|
|
|
def _populate_namespace_wide_provides(self, user_object, namespace_filter):
|
|
""" Populates the namespace-wide provides for a particular user under a particular namespace.
|
|
This method does *not* add any provides for specific repositories.
|
|
"""
|
|
|
|
for team in model.permission.get_org_wide_permissions(user_object, org_filter=namespace_filter):
|
|
team_org_grant = _OrganizationNeed(team.organization.username,
|
|
self._team_role_for_scopes(team.role.name))
|
|
logger.debug('Organization team added permission: {0}'.format(team_org_grant))
|
|
self.provides.add(team_org_grant)
|
|
|
|
team_repo_role = TEAM_ORGWIDE_REPO_ROLES[team.role.name]
|
|
org_repo_grant = _OrganizationRepoNeed(team.organization.username,
|
|
self._repo_role_for_scopes(team_repo_role))
|
|
logger.debug('Organization team added repo permission: {0}'.format(org_repo_grant))
|
|
self.provides.add(org_repo_grant)
|
|
|
|
team_grant = _TeamNeed(team.organization.username, team.name,
|
|
self._team_role_for_scopes(team.role.name))
|
|
logger.debug('Team added permission: {0}'.format(team_grant))
|
|
self.provides.add(team_grant)
|
|
|
|
def _populate_repository_provides(self, user_object, namespace_filter, repository_name):
|
|
""" Populates the repository-specific provides for a particular user and repository. """
|
|
|
|
if namespace_filter and repository_name:
|
|
permissions = model.permission.get_user_repository_permissions(user_object, namespace_filter,
|
|
repository_name)
|
|
else:
|
|
permissions = model.permission.get_all_user_repository_permissions(user_object)
|
|
|
|
for perm in permissions:
|
|
repo_grant = _RepositoryNeed(perm.repository.namespace_user.username, perm.repository.name,
|
|
self._repo_role_for_scopes(perm.role.name))
|
|
logger.debug('User added permission: {0}'.format(repo_grant))
|
|
self.provides.add(repo_grant)
|
|
|
|
def can(self, permission):
|
|
logger.debug('Loading user permissions after deferring for: %s', self.id)
|
|
user_object = self._user_object or model.user.get_user_by_uuid(self.id)
|
|
if user_object is None:
|
|
return super(QuayDeferredPermissionUser, self).can(permission)
|
|
|
|
# Add the user-specific provides.
|
|
if not self._personal_loaded:
|
|
self._populate_user_provides(user_object)
|
|
self._personal_loaded = True
|
|
|
|
# If we now have permission, no need to load any more permissions.
|
|
if super(QuayDeferredPermissionUser, self).can(permission):
|
|
return super(QuayDeferredPermissionUser, self).can(permission)
|
|
|
|
# Check for namespace and/or repository permissions.
|
|
perm_namespace = permission.namespace
|
|
perm_repo_name = permission.repo_name
|
|
perm_repository = None
|
|
|
|
if perm_namespace and perm_repo_name:
|
|
perm_repository = '%s/%s' % (perm_namespace, perm_repo_name)
|
|
|
|
if not perm_namespace and not perm_repo_name:
|
|
# Nothing more to load, so just check directly.
|
|
return super(QuayDeferredPermissionUser, self).can(permission)
|
|
|
|
# Lazy-load the repository-specific permissions.
|
|
if perm_repository and perm_repository not in self._repositories_loaded:
|
|
self._populate_repository_provides(user_object, perm_namespace, perm_repo_name)
|
|
self._repositories_loaded.add(perm_repository)
|
|
|
|
# If we now have permission, no need to load any more permissions.
|
|
if super(QuayDeferredPermissionUser, self).can(permission):
|
|
return super(QuayDeferredPermissionUser, self).can(permission)
|
|
|
|
# Lazy-load the namespace-wide-only permissions.
|
|
if perm_namespace and perm_namespace not in self._namespace_wide_loaded:
|
|
self._populate_namespace_wide_provides(user_object, perm_namespace)
|
|
self._namespace_wide_loaded.add(perm_namespace)
|
|
|
|
return super(QuayDeferredPermissionUser, self).can(permission)
|
|
|
|
|
|
class QuayPermission(Permission):
|
|
""" Base for all permissions in Quay. """
|
|
namespace = None
|
|
repo_name = None
|
|
|
|
|
|
class ModifyRepositoryPermission(QuayPermission):
|
|
def __init__(self, namespace, name):
|
|
admin_need = _RepositoryNeed(namespace, name, 'admin')
|
|
write_need = _RepositoryNeed(namespace, name, 'write')
|
|
org_admin_need = _OrganizationRepoNeed(namespace, 'admin')
|
|
org_write_need = _OrganizationRepoNeed(namespace, 'write')
|
|
|
|
self.namespace = namespace
|
|
self.repo_name = name
|
|
|
|
super(ModifyRepositoryPermission, self).__init__(admin_need, write_need, org_admin_need,
|
|
org_write_need)
|
|
|
|
|
|
class ReadRepositoryPermission(QuayPermission):
|
|
def __init__(self, namespace, name):
|
|
admin_need = _RepositoryNeed(namespace, name, 'admin')
|
|
write_need = _RepositoryNeed(namespace, name, 'write')
|
|
read_need = _RepositoryNeed(namespace, name, 'read')
|
|
org_admin_need = _OrganizationRepoNeed(namespace, 'admin')
|
|
org_write_need = _OrganizationRepoNeed(namespace, 'write')
|
|
org_read_need = _OrganizationRepoNeed(namespace, 'read')
|
|
|
|
self.namespace = namespace
|
|
self.repo_name = name
|
|
|
|
super(ReadRepositoryPermission, self).__init__(admin_need, write_need, read_need,
|
|
org_admin_need, org_read_need, org_write_need)
|
|
|
|
|
|
class AdministerRepositoryPermission(QuayPermission):
|
|
def __init__(self, namespace, name):
|
|
admin_need = _RepositoryNeed(namespace, name, 'admin')
|
|
org_admin_need = _OrganizationRepoNeed(namespace, 'admin')
|
|
|
|
self.namespace = namespace
|
|
self.repo_name = name
|
|
|
|
super(AdministerRepositoryPermission, self).__init__(admin_need,
|
|
org_admin_need)
|
|
|
|
|
|
class CreateRepositoryPermission(QuayPermission):
|
|
def __init__(self, namespace):
|
|
admin_org = _OrganizationNeed(namespace, 'admin')
|
|
create_repo_org = _OrganizationNeed(namespace, 'creator')
|
|
|
|
self.namespace = namespace
|
|
|
|
super(CreateRepositoryPermission, self).__init__(admin_org,
|
|
create_repo_org)
|
|
|
|
class SuperUserPermission(QuayPermission):
|
|
def __init__(self):
|
|
need = _SuperUserNeed()
|
|
super(SuperUserPermission, self).__init__(need)
|
|
|
|
|
|
class UserAdminPermission(QuayPermission):
|
|
def __init__(self, username):
|
|
user_admin = _UserNeed(username, 'admin')
|
|
super(UserAdminPermission, self).__init__(user_admin)
|
|
|
|
|
|
class UserReadPermission(QuayPermission):
|
|
def __init__(self, username):
|
|
user_admin = _UserNeed(username, 'admin')
|
|
user_read = _UserNeed(username, 'read')
|
|
super(UserReadPermission, self).__init__(user_read, user_admin)
|
|
|
|
|
|
class AdministerOrganizationPermission(QuayPermission):
|
|
def __init__(self, org_name):
|
|
admin_org = _OrganizationNeed(org_name, 'admin')
|
|
|
|
self.namespace = org_name
|
|
|
|
super(AdministerOrganizationPermission, self).__init__(admin_org)
|
|
|
|
|
|
class OrganizationMemberPermission(QuayPermission):
|
|
def __init__(self, org_name):
|
|
admin_org = _OrganizationNeed(org_name, 'admin')
|
|
repo_creator_org = _OrganizationNeed(org_name, 'creator')
|
|
org_member = _OrganizationNeed(org_name, 'member')
|
|
|
|
self.namespace = org_name
|
|
|
|
super(OrganizationMemberPermission, self).__init__(admin_org, org_member,
|
|
repo_creator_org)
|
|
|
|
|
|
class ViewTeamPermission(QuayPermission):
|
|
def __init__(self, org_name, team_name):
|
|
team_admin = _TeamNeed(org_name, team_name, 'admin')
|
|
team_creator = _TeamNeed(org_name, team_name, 'creator')
|
|
team_member = _TeamNeed(org_name, team_name, 'member')
|
|
admin_org = _OrganizationNeed(org_name, 'admin')
|
|
|
|
self.namespace = org_name
|
|
|
|
super(ViewTeamPermission, self).__init__(team_admin, team_creator,
|
|
team_member, admin_org)
|
|
|
|
|
|
class AlwaysFailPermission(QuayPermission):
|
|
def can(self):
|
|
return False
|
|
|
|
|
|
@identity_loaded.connect_via(app)
|
|
def on_identity_loaded(sender, identity):
|
|
logger.debug('Identity loaded: %s' % identity)
|
|
# We have verified an identity, load in all of the permissions
|
|
|
|
if isinstance(identity, QuayDeferredPermissionUser):
|
|
logger.debug('Deferring permissions for user with uuid: %s', identity.id)
|
|
|
|
elif identity.auth_type == 'user_uuid':
|
|
logger.debug('Switching username permission to deferred object with uuid: %s', identity.id)
|
|
switch_to_deferred = QuayDeferredPermissionUser.for_id(identity.id)
|
|
identity_changed.send(app, identity=switch_to_deferred)
|
|
|
|
elif identity.auth_type == 'token':
|
|
logger.debug('Loading permissions for token: %s', identity.id)
|
|
token_data = model.token.load_token_data(identity.id)
|
|
|
|
repo_grant = _RepositoryNeed(token_data.repository.namespace_user.username,
|
|
token_data.repository.name,
|
|
token_data.role.name)
|
|
logger.debug('Delegate token added permission: %s', repo_grant)
|
|
identity.provides.add(repo_grant)
|
|
|
|
elif identity.auth_type == 'signed_grant' or identity.auth_type == 'signed_jwt':
|
|
logger.debug('Loaded %s identity for: %s', identity.auth_type, identity.id)
|
|
|
|
else:
|
|
logger.error('Unknown identity auth type: %s', identity.auth_type)
|