You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@servicecomb.apache.org by ti...@apache.org on 2021/05/25 11:47:31 UTC
[servicecomb-service-center] branch master updated: Edit rbac apis
(#1002)
This is an automated email from the ASF dual-hosted git repository.
tianxiaoliang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/servicecomb-service-center.git
The following commit(s) were added to refs/heads/master by this push:
new a22c06a Edit rbac apis (#1002)
a22c06a is described below
commit a22c06a5461e356d938c80c6f10eb615c349566f
Author: humingcheng <hu...@163.com>
AuthorDate: Tue May 25 19:47:23 2021 +0800
Edit rbac apis (#1002)
* Fix rbac API error
* Compatible to old version account
---
datasource/etcd/account.go | 21 +++++++
datasource/etcd/role.go | 5 ++
docs/openapi/v4.yaml | 16 +++---
go.mod | 4 +-
go.sum | 2 +
pkg/rbacframe/api.go | 89 -----------------------------
pkg/rbacframe/api_test.go | 55 ------------------
pkg/rbacframe/error.go | 31 ----------
server/plugin/auth/buildin/buidlin_test.go | 6 +-
server/plugin/auth/buildin/buildin.go | 29 ++++++----
server/resource/v4/auth_resource.go | 3 -
server/resource/v4/rbac_resource_test.go | 3 +-
server/resource/v4/role_resource.go | 3 +-
server/service/rbac/authr_plugin.go | 17 ++++--
server/service/rbac/dao/account_dao_test.go | 7 +--
server/service/rbac/password.go | 3 +-
server/service/rbac/permission.go | 5 +-
server/service/rbac/rbac.go | 5 +-
server/service/rbac/rbac_test.go | 5 +-
19 files changed, 85 insertions(+), 224 deletions(-)
diff --git a/datasource/etcd/account.go b/datasource/etcd/account.go
index 064760c..99bb296 100644
--- a/datasource/etcd/account.go
+++ b/datasource/etcd/account.go
@@ -19,6 +19,8 @@ import (
"context"
"encoding/json"
"fmt"
+ "strconv"
+ "time"
"github.com/apache/servicecomb-service-center/datasource"
"github.com/apache/servicecomb-service-center/datasource/etcd/client"
@@ -27,6 +29,7 @@ import (
"github.com/apache/servicecomb-service-center/pkg/log"
"github.com/apache/servicecomb-service-center/pkg/privacy"
"github.com/apache/servicecomb-service-center/pkg/util"
+
"github.com/go-chassis/cari/rbac"
)
@@ -55,7 +58,11 @@ func (ds *DataSource) CreateAccount(ctx context.Context, a *rbac.Account) error
log.Error("pwd hash failed", err)
return err
}
+ a.Role = ""
+ a.CurrentPassword = ""
a.ID = util.GenerateUUID()
+ a.CreateTime = strconv.FormatInt(time.Now().Unix(), 10)
+ a.UpdateTime = a.CreateTime
value, err := json.Marshal(a)
if err != nil {
log.Errorf(err, "account info is invalid")
@@ -96,8 +103,20 @@ func (ds *DataSource) GetAccount(ctx context.Context, name string) (*rbac.Accoun
log.Errorf(err, "account info format invalid")
return nil, err
}
+ ds.compatibleOldVersionAccount(account)
return account, nil
}
+
+func (ds *DataSource) compatibleOldVersionAccount(a *rbac.Account) {
+ // old version use Role, now use Roles
+ // Role/Roles will not exist at the same time
+ if len(a.Role) == 0 {
+ return
+ }
+ a.Roles = []string{a.Role}
+ a.Role = ""
+}
+
func (ds *DataSource) ListAccount(ctx context.Context) ([]*rbac.Account, int64, error) {
resp, err := client.Instance().Do(ctx, client.GET,
client.WithStrKey(path.GenerateRBACAccountKey("")), client.WithPrefix())
@@ -113,6 +132,7 @@ func (ds *DataSource) ListAccount(ctx context.Context) ([]*rbac.Account, int64,
continue //do not fail if some account is invalid
}
a.Password = ""
+ ds.compatibleOldVersionAccount(a)
accounts = append(accounts, a)
}
return accounts, resp.Count, nil
@@ -132,6 +152,7 @@ func (ds *DataSource) DeleteAccount(ctx context.Context, names []string) (bool,
return true, nil
}
func (ds *DataSource) UpdateAccount(ctx context.Context, name string, account *rbac.Account) error {
+ account.UpdateTime = strconv.FormatInt(time.Now().Unix(), 10)
value, err := json.Marshal(account)
if err != nil {
log.Errorf(err, "account info is invalid")
diff --git a/datasource/etcd/role.go b/datasource/etcd/role.go
index b1835e0..f8f2c47 100644
--- a/datasource/etcd/role.go
+++ b/datasource/etcd/role.go
@@ -21,6 +21,8 @@ import (
"context"
"encoding/json"
"fmt"
+ "strconv"
+ "time"
"github.com/go-chassis/cari/rbac"
@@ -53,6 +55,8 @@ func (ds *DataSource) CreateRole(ctx context.Context, r *rbac.Role) error {
return datasource.ErrRoleDuplicated
}
r.ID = util.GenerateUUID()
+ r.CreateTime = strconv.FormatInt(time.Now().Unix(), 10)
+ r.UpdateTime = r.CreateTime
value, err := json.Marshal(r)
if err != nil {
log.Error("role info is invalid", err)
@@ -123,6 +127,7 @@ func (ds *DataSource) DeleteRole(ctx context.Context, name string) (bool, error)
return resp.Succeeded, nil
}
func (ds *DataSource) UpdateRole(ctx context.Context, name string, role *rbac.Role) error {
+ role.UpdateTime = strconv.FormatInt(time.Now().Unix(), 10)
value, err := json.Marshal(role)
if err != nil {
log.Errorf(err, "role info is invalid")
diff --git a/docs/openapi/v4.yaml b/docs/openapi/v4.yaml
index 5551c18..a84242c 100644
--- a/docs/openapi/v4.yaml
+++ b/docs/openapi/v4.yaml
@@ -2955,10 +2955,10 @@ definitions:
total:
type: integer
description: total accounts
- additionalProperties:
- type: array
- items:
- $ref: '#/definitions/Account'
+ data:
+ type: array
+ items:
+ $ref: '#/definitions/Account'
Account:
type: object
description: user accout information
@@ -3002,10 +3002,10 @@ definitions:
total:
type: integer
description: total roles
- additionalProperties:
- type: array
- items:
- $ref: '#/definitions/Role'
+ data:
+ type: array
+ items:
+ $ref: '#/definitions/Role'
Role:
type: object
description: role permission
diff --git a/go.mod b/go.mod
index d3f52d5..1d807a3 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,8 @@
module github.com/apache/servicecomb-service-center
replace (
- google.golang.org/grpc => google.golang.org/grpc v1.26.0
github.com/apache/thrift => github.com/apache/thrift v0.0.0-20180125231006-3d556248a8b9
+ google.golang.org/grpc => google.golang.org/grpc v1.26.0
)
require (
@@ -15,7 +15,7 @@ require (
github.com/dgrijalva/jwt-go v3.2.0+incompatible
github.com/elithrar/simple-scrypt v1.3.0
github.com/ghodss/yaml v1.0.0
- github.com/go-chassis/cari v0.4.1-0.20210522033018-d228d49d7d61
+ github.com/go-chassis/cari v0.4.1-0.20210525100133-33b23132d6f0
github.com/go-chassis/foundation v0.3.1-0.20210513015331-b54416b66bcd
github.com/go-chassis/go-archaius v1.5.1
github.com/go-chassis/go-chassis/v2 v2.1.2-0.20210310004133-c9bc42149a18
diff --git a/go.sum b/go.sum
index 042672b..766131a 100644
--- a/go.sum
+++ b/go.sum
@@ -203,6 +203,8 @@ github.com/go-chassis/cari v0.3.1-0.20210519092219-69f9f0fc3452 h1:G2Qlpg17t0oUL
github.com/go-chassis/cari v0.3.1-0.20210519092219-69f9f0fc3452/go.mod h1:av/19fqwEP4eOC8unL/z67AAbFDwXUCko6SKa4Avrd8=
github.com/go-chassis/cari v0.4.1-0.20210522033018-d228d49d7d61 h1:gVgeg1lmX1mpra0lyKHiSlc9DImjIDT0vQiSaFHrzMs=
github.com/go-chassis/cari v0.4.1-0.20210522033018-d228d49d7d61/go.mod h1:av/19fqwEP4eOC8unL/z67AAbFDwXUCko6SKa4Avrd8=
+github.com/go-chassis/cari v0.4.1-0.20210525100133-33b23132d6f0 h1:cxI44jhmc1yzyDm6MQ4oYutZroHlaPkpJLrmsLQJybY=
+github.com/go-chassis/cari v0.4.1-0.20210525100133-33b23132d6f0/go.mod h1:av/19fqwEP4eOC8unL/z67AAbFDwXUCko6SKa4Avrd8=
github.com/go-chassis/foundation v0.2.2-0.20201210043510-9f6d3de40234/go.mod h1:2PjwqpVwYEVaAldl5A58a08viH8p27pNeYaiE3ZxOBA=
github.com/go-chassis/foundation v0.2.2/go.mod h1:2PjwqpVwYEVaAldl5A58a08viH8p27pNeYaiE3ZxOBA=
github.com/go-chassis/foundation v0.3.0/go.mod h1:2PjwqpVwYEVaAldl5A58a08viH8p27pNeYaiE3ZxOBA=
diff --git a/pkg/rbacframe/api.go b/pkg/rbacframe/api.go
deleted file mode 100644
index 49a74b0..0000000
--- a/pkg/rbacframe/api.go
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-// Package rbacframe help other component which want to use servicecomb rbac system
-package rbacframe
-
-import (
- "crypto/rsa"
-
- "github.com/go-chassis/cari/rbac"
- "k8s.io/apimachinery/pkg/util/sets"
-
- "github.com/apache/servicecomb-service-center/pkg/util"
- "github.com/go-chassis/go-chassis/v2/security/token"
-)
-
-const (
- ClaimsUser = "account"
- ClaimsRoles = "roles"
-
- RoleAdmin = "admin"
- RoleDeveloper = "developer"
-)
-
-var whiteAPIList = sets.NewString()
-
-func Add2WhiteAPIList(path ...string) {
- whiteAPIList.Insert(path...)
-}
-
-func MustAuth(pattern string) bool {
- if util.IsVersionOrHealthPattern(pattern) {
- return false
- }
- return !whiteAPIList.Has(pattern)
-}
-
-//Authenticate parse a token to claims
-func Authenticate(tokenStr string, pub *rsa.PublicKey) (interface{}, error) {
- claims, err := token.Verify(tokenStr, func(claims interface{}, method token.SigningMethod) (interface{}, error) {
- return pub, nil
- })
- if err != nil {
- return nil, err
- }
- return claims, nil
-}
-
-// GetRolesList return role list string
-func GetRolesList(v interface{}) ([]string, error) {
- s, ok := v.([]interface{})
- if !ok {
- return nil, ErrConvertErr
- }
- rolesList := make([]string, 0)
- for _, v := range s {
- role, ok := v.(string)
- if !ok {
- return nil, ErrConvertErr
- }
- rolesList = append(rolesList, role)
- }
- return rolesList, nil
-}
-
-//BuildResourceList join the resource to an array
-func BuildResourceList(resourceType ...string) []*rbac.Resource {
- rt := make([]*rbac.Resource, len(resourceType))
- for i := 0; i < len(resourceType); i++ {
- rt[i] = &rbac.Resource{
- Type: resourceType[i],
- }
- }
- return rt
-}
diff --git a/pkg/rbacframe/api_test.go b/pkg/rbacframe/api_test.go
deleted file mode 100644
index 7107df4..0000000
--- a/pkg/rbacframe/api_test.go
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package rbacframe_test
-
-import (
- "testing"
-
- "github.com/apache/servicecomb-service-center/pkg/rbacframe"
- "github.com/go-chassis/go-chassis/v2/security/secret"
- "github.com/go-chassis/go-chassis/v2/security/token"
- "github.com/stretchr/testify/assert"
-)
-
-func TestMustAuth(t *testing.T) {
- rbacframe.Add2WhiteAPIList("/test")
- assert.False(t, rbacframe.MustAuth("/test"))
- assert.True(t, rbacframe.MustAuth("/test1"))
- assert.True(t, rbacframe.MustAuth("/auth"))
- assert.False(t, rbacframe.MustAuth("/version"))
- assert.False(t, rbacframe.MustAuth("/v4/a/registry/version"))
- assert.False(t, rbacframe.MustAuth("/health"))
- assert.False(t, rbacframe.MustAuth("/v4/a/registry/health"))
-}
-
-func TestAuthenticate(t *testing.T) {
- pri, pub, err := secret.GenRSAKeyPair(4096)
- assert.NoError(t, err)
-
- to, err := token.Sign(map[string]interface{}{
- rbacframe.ClaimsUser: "root",
- rbacframe.ClaimsRoles: []string{"admin"},
- }, pri, token.WithSigningMethod(token.RS512))
- assert.NoError(t, err)
-
- _, err = rbacframe.Authenticate(to, pub)
- assert.NoError(t, err)
-
- _, err = rbacframe.Authenticate("token", nil)
- assert.Error(t, err)
-}
diff --git a/pkg/rbacframe/error.go b/pkg/rbacframe/error.go
deleted file mode 100644
index 383206e..0000000
--- a/pkg/rbacframe/error.go
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package rbacframe
-
-import (
- "errors"
-)
-
-var (
- ErrInvalidHeader = errors.New("invalid auth header")
- ErrNoHeader = errors.New("should provide Authorization header")
- ErrInvalidCtx = errors.New("invalid context")
-
- ErrConvertErr = errors.New(MsgConvertErr)
- MsgConvertErr = "type convert error"
-)
diff --git a/server/plugin/auth/buildin/buidlin_test.go b/server/plugin/auth/buildin/buidlin_test.go
index b68bf9e..86f58f4 100644
--- a/server/plugin/auth/buildin/buidlin_test.go
+++ b/server/plugin/auth/buildin/buidlin_test.go
@@ -26,13 +26,13 @@ import (
"net/http/httptest"
"testing"
- "github.com/apache/servicecomb-service-center/pkg/rbacframe"
"github.com/apache/servicecomb-service-center/server/config"
"github.com/apache/servicecomb-service-center/server/plugin/auth/buildin"
"github.com/apache/servicecomb-service-center/server/service/rbac"
"github.com/apache/servicecomb-service-center/server/service/rbac/dao"
_ "github.com/apache/servicecomb-service-center/test"
"github.com/astaxie/beego"
+ carirbac "github.com/go-chassis/cari/rbac"
"github.com/go-chassis/go-archaius"
"github.com/go-chassis/go-chassis/v2/security/authr"
"github.com/go-chassis/go-chassis/v2/security/secret"
@@ -76,7 +76,7 @@ func TestTokenAuthenticator_Identify(t *testing.T) {
r := httptest.NewRequest(http.MethodGet, "/any", nil)
err := ta.Identify(r)
t.Log(err)
- assert.Equal(t, rbacframe.ErrNoHeader, err)
+ assert.Equal(t, carirbac.ErrNoHeader, err)
})
t.Run("with wrong auth header should failed", func(t *testing.T) {
@@ -84,7 +84,7 @@ func TestTokenAuthenticator_Identify(t *testing.T) {
r.Header.Set(restful.HeaderAuth, "Bear")
err := ta.Identify(r)
t.Log(err)
- assert.Equal(t, rbacframe.ErrInvalidHeader, err)
+ assert.Equal(t, carirbac.ErrInvalidHeader, err)
})
t.Run("with valid header and invalid token, should failed", func(t *testing.T) {
diff --git a/server/plugin/auth/buildin/buildin.go b/server/plugin/auth/buildin/buildin.go
index 0f0565a..605e9b2 100644
--- a/server/plugin/auth/buildin/buildin.go
+++ b/server/plugin/auth/buildin/buildin.go
@@ -20,11 +20,11 @@ package buildin
import (
"context"
"errors"
+ "github.com/apache/servicecomb-service-center/pkg/util"
"net/http"
"strings"
"github.com/apache/servicecomb-service-center/pkg/plugin"
- "github.com/apache/servicecomb-service-center/pkg/rbacframe"
"github.com/go-chassis/cari/rbac"
errorsEx "github.com/apache/servicecomb-service-center/pkg/errors"
@@ -52,16 +52,16 @@ func (ba *TokenAuthenticator) Identify(req *http.Request) error {
return nil
}
pattern, ok := req.Context().Value(rest.CtxMatchPattern).(string)
- if ok && !rbacframe.MustAuth(pattern) {
+ if ok && !mustAuth(pattern) {
return nil
}
v := req.Header.Get(restful.HeaderAuth)
if v == "" {
- return rbacframe.ErrNoHeader
+ return rbac.ErrNoHeader
}
s := strings.Split(v, " ")
if len(s) != 2 {
- return rbacframe.ErrInvalidHeader
+ return rbac.ErrInvalidHeader
}
to := s[1]
@@ -72,14 +72,14 @@ func (ba *TokenAuthenticator) Identify(req *http.Request) error {
}
m, ok := claims.(map[string]interface{})
if !ok {
- log.Error("claims convert failed", rbacframe.ErrConvertErr)
- return rbacframe.ErrConvertErr
+ log.Error("claims convert failed", rbac.ErrConvertErr)
+ return rbac.ErrConvertErr
}
- roles := m[rbacframe.ClaimsRoles]
- roleList, err := rbacframe.GetRolesList(roles)
+
+ roleList, err := rbac.GetRolesList(m)
if err != nil {
- log.Error("role convert failed ", err)
- return rbacframe.ErrConvertErr
+ log.Error("get role list failed", err)
+ return err
}
var apiPattern string
@@ -97,7 +97,7 @@ func (ba *TokenAuthenticator) Identify(req *http.Request) error {
if err != nil {
return err
}
- req2 := req.WithContext(rbac.NewContext(req.Context(), claims.(map[string]interface{})))
+ req2 := req.WithContext(rbac.NewContext(req.Context(), m))
*req = *req2
return nil
}
@@ -120,3 +120,10 @@ func checkPerm(roleList []string, project, apiPattern, verbs string) error {
}
return nil
}
+
+func mustAuth(pattern string) bool {
+ if util.IsVersionOrHealthPattern(pattern) {
+ return false
+ }
+ return rbac.MustAuth(pattern)
+}
diff --git a/server/resource/v4/auth_resource.go b/server/resource/v4/auth_resource.go
index c754b10..8ae120d 100644
--- a/server/resource/v4/auth_resource.go
+++ b/server/resource/v4/auth_resource.go
@@ -66,9 +66,6 @@ func (ar *AuthResource) CreateAccount(w http.ResponseWriter, req *http.Request)
controller.WriteError(w, discovery.ErrInvalidParams, errorsEx.MsgJSON)
return
}
- if a.Role != "" {
- a.Roles = []string{a.Role}
- }
err = service.ValidateCreateAccount(a)
if err != nil {
controller.WriteError(w, discovery.ErrInvalidParams, err.Error())
diff --git a/server/resource/v4/rbac_resource_test.go b/server/resource/v4/rbac_resource_test.go
index 4418157..de7ceb9 100644
--- a/server/resource/v4/rbac_resource_test.go
+++ b/server/resource/v4/rbac_resource_test.go
@@ -29,7 +29,6 @@ import (
rbacmodel "github.com/go-chassis/cari/rbac"
- "github.com/apache/servicecomb-service-center/pkg/rbacframe"
"github.com/apache/servicecomb-service-center/pkg/rest"
"github.com/apache/servicecomb-service-center/server/config"
v4 "github.com/apache/servicecomb-service-center/server/resource/v4"
@@ -177,7 +176,7 @@ func TestAuthResource_DeleteAccount(t *testing.T) {
to := &rbacmodel.Token{}
json.Unmarshal(w.Body.Bytes(), to)
- b, _ = json.Marshal(&rbacmodel.Account{Name: "delete_account", Password: "Complicated_password1", Roles: []string{rbacframe.RoleDeveloper}})
+ b, _ = json.Marshal(&rbacmodel.Account{Name: "delete_account", Password: "Complicated_password1", Roles: []string{rbacmodel.RoleDeveloper}})
r2, _ := http.NewRequest(http.MethodPost, "/v4/accounts", bytes.NewBuffer(b))
r2.Header.Set(restful.HeaderAuth, "Bearer "+to.TokenStr)
w2 := httptest.NewRecorder()
diff --git a/server/resource/v4/role_resource.go b/server/resource/v4/role_resource.go
index b61470a..a5c6967 100644
--- a/server/resource/v4/role_resource.go
+++ b/server/resource/v4/role_resource.go
@@ -52,13 +52,14 @@ func (rr *RoleResource) URLPatterns() []rest.Route {
//GetRolePermission list all roles and there's permissions
func (rr *RoleResource) GetRolePermission(w http.ResponseWriter, req *http.Request) {
- rs, _, err := dao.ListRole(context.TODO())
+ rs, num, err := dao.ListRole(context.TODO())
if err != nil {
log.Error(errorsEx.MsgGetRoleFailed, err)
controller.WriteError(w, discovery.ErrInternal, errorsEx.MsgGetRoleFailed)
return
}
resp := &rbac.RoleResponse{
+ Total: num,
Roles: rs,
}
controller.WriteResponse(w, req, nil, resp)
diff --git a/server/service/rbac/authr_plugin.go b/server/service/rbac/authr_plugin.go
index 400070a..7bd7cb5 100644
--- a/server/service/rbac/authr_plugin.go
+++ b/server/service/rbac/authr_plugin.go
@@ -19,7 +19,9 @@ package rbac
import (
"context"
+ "crypto/rsa"
"errors"
+ "github.com/go-chassis/cari/rbac"
"github.com/dgrijalva/jwt-go"
"github.com/go-chassis/go-chassis/v2/security/authr"
@@ -27,7 +29,6 @@ import (
"github.com/apache/servicecomb-service-center/pkg/log"
"github.com/apache/servicecomb-service-center/pkg/privacy"
- "github.com/apache/servicecomb-service-center/pkg/rbacframe"
"github.com/apache/servicecomb-service-center/server/service/rbac/dao"
)
@@ -59,8 +60,8 @@ func (a *EmbeddedAuthenticator) Login(ctx context.Context, user string, password
return "", err
}
tokenStr, err := token.Sign(map[string]interface{}{
- rbacframe.ClaimsUser: user,
- rbacframe.ClaimsRoles: account.Roles,
+ rbac.ClaimsUser: user,
+ rbac.ClaimsRoles: account.Roles,
},
secret,
token.WithExpTime(opt.ExpireAfter),
@@ -73,13 +74,21 @@ func (a *EmbeddedAuthenticator) Login(ctx context.Context, user string, password
}
return "", ErrUnauthorized
}
+
+//Authenticate parse a token to claims
func (a *EmbeddedAuthenticator) Authenticate(ctx context.Context, tokenStr string) (interface{}, error) {
p, err := jwt.ParseRSAPublicKeyFromPEM([]byte(PublicKey()))
if err != nil {
log.Error("can not parse public key", err)
return nil, err
}
- return rbacframe.Authenticate(tokenStr, p)
+ return a.autheToken(tokenStr, p)
+}
+
+func (a *EmbeddedAuthenticator) autheToken(tokenStr string, pub *rsa.PublicKey) (interface{}, error) {
+ return token.Verify(tokenStr, func(claims interface{}, method token.SigningMethod) (interface{}, error) {
+ return pub, nil
+ })
}
func init() {
diff --git a/server/service/rbac/dao/account_dao_test.go b/server/service/rbac/dao/account_dao_test.go
index 04437eb..79a48a3 100644
--- a/server/service/rbac/dao/account_dao_test.go
+++ b/server/service/rbac/dao/account_dao_test.go
@@ -22,7 +22,6 @@ import (
"context"
"testing"
- "github.com/apache/servicecomb-service-center/pkg/rbacframe"
"github.com/apache/servicecomb-service-center/server/service/rbac/dao"
_ "github.com/apache/servicecomb-service-center/test"
@@ -40,7 +39,7 @@ func newAccount(name string) *rbac.Account {
return &rbac.Account{
Name: name,
Password: "Ab@11111",
- Roles: []string{rbacframe.RoleAdmin},
+ Roles: []string{rbac.RoleAdmin},
}
}
@@ -71,13 +70,13 @@ func TestAccountDao_UpdateAccount(t *testing.T) {
t.Run("update account", func(t *testing.T) {
newAccount := &rbac.Account{
- Roles: []string{rbacframe.RoleDeveloper},
+ Roles: []string{rbac.RoleDeveloper},
}
err = dao.UpdateAccount(context.Background(), account.Name, newAccount)
assert.NoError(t, err)
a, err := dao.GetAccount(context.Background(), account.Name)
assert.NoError(t, err)
assert.Equal(t, 1, len(a.Roles))
- assert.Equal(t, rbacframe.RoleDeveloper, a.Roles[0])
+ assert.Equal(t, rbac.RoleDeveloper, a.Roles[0])
})
}
diff --git a/server/service/rbac/password.go b/server/service/rbac/password.go
index 35a3798..a8d5dd3 100644
--- a/server/service/rbac/password.go
+++ b/server/service/rbac/password.go
@@ -21,7 +21,6 @@ import (
"context"
"github.com/apache/servicecomb-service-center/pkg/privacy"
- "github.com/apache/servicecomb-service-center/pkg/rbacframe"
rbacmodel "github.com/go-chassis/cari/rbac"
"github.com/go-chassis/foundation/stringutil"
@@ -41,7 +40,7 @@ func ChangePassword(ctx context.Context, changerRole []string, changerName strin
}
for i := 0; i < len(changerRole); i++ {
//need to check password mismatch. but admin role can change any user password without supply current password
- if changerRole[i] == rbacframe.RoleAdmin {
+ if changerRole[i] == rbacmodel.RoleAdmin {
return changePasswordForcibly(ctx, a.Name, a.Password)
}
}
diff --git a/server/service/rbac/permission.go b/server/service/rbac/permission.go
index 877b910..0c9ccf2 100644
--- a/server/service/rbac/permission.go
+++ b/server/service/rbac/permission.go
@@ -18,7 +18,6 @@
package rbac
import (
- "github.com/apache/servicecomb-service-center/pkg/rbacframe"
"github.com/go-chassis/cari/rbac"
)
@@ -34,7 +33,7 @@ var (
// AdminPerms allocate all resource permissions
func AdminPerms() []*rbac.Permission {
- resources := rbacframe.BuildResourceList(
+ resources := rbac.BuildResourceList(
ResourceAccount, ResourceRole,
ResourceService, ResourceGovern, ResourceOps, ResourceSchema)
perm := []*rbac.Permission{
@@ -48,7 +47,7 @@ func AdminPerms() []*rbac.Permission {
// DevPerms allocate all resource permissions except account and role resources
func DevPerms() []*rbac.Permission {
- resources := rbacframe.BuildResourceList(
+ resources := rbac.BuildResourceList(
ResourceService, ResourceGovern, ResourceOps, ResourceSchema)
perm := []*rbac.Permission{
{
diff --git a/server/service/rbac/rbac.go b/server/service/rbac/rbac.go
index d40f9d6..ed5f563 100644
--- a/server/service/rbac/rbac.go
+++ b/server/service/rbac/rbac.go
@@ -27,7 +27,6 @@ import (
"github.com/apache/servicecomb-service-center/datasource"
"github.com/apache/servicecomb-service-center/pkg/log"
- "github.com/apache/servicecomb-service-center/pkg/rbacframe"
"github.com/apache/servicecomb-service-center/server/config"
"github.com/apache/servicecomb-service-center/server/plugin/security/cipher"
"github.com/apache/servicecomb-service-center/server/service"
@@ -73,7 +72,7 @@ func Init() {
readPublicKey()
initAdminRole()
initDevRole()
- rbacframe.Add2WhiteAPIList(APITokenGranter)
+ rbac.Add2WhiteAPIList(APITokenGranter)
log.Info("rbac is enabled")
}
@@ -118,7 +117,7 @@ func initFirstTime(admin string) {
a := &rbac.Account{
Name: admin,
Password: pwd,
- Roles: []string{rbacframe.RoleAdmin},
+ Roles: []string{rbac.RoleAdmin},
}
err = service.ValidateCreateAccount(a)
if err != nil {
diff --git a/server/service/rbac/rbac_test.go b/server/service/rbac/rbac_test.go
index 38b03c3..2d98516 100644
--- a/server/service/rbac/rbac_test.go
+++ b/server/service/rbac/rbac_test.go
@@ -20,7 +20,6 @@ package rbac_test
import (
"context"
"github.com/apache/servicecomb-service-center/pkg/privacy"
- "github.com/apache/servicecomb-service-center/pkg/rbacframe"
"github.com/apache/servicecomb-service-center/server/config"
"github.com/apache/servicecomb-service-center/server/service/rbac"
"github.com/apache/servicecomb-service-center/server/service/rbac/dao"
@@ -80,7 +79,7 @@ func TestInitRBAC(t *testing.T) {
assert.NoError(t, err)
claims, err := authr.Authenticate(context.Background(), token)
assert.NoError(t, err)
- assert.Equal(t, "root", claims.(map[string]interface{})[rbacframe.ClaimsUser])
+ assert.Equal(t, "root", claims.(map[string]interface{})[rbacmodel.ClaimsUser])
})
t.Run("second time init", func(t *testing.T) {
@@ -91,7 +90,7 @@ func TestInitRBAC(t *testing.T) {
persisted := &rbacmodel.Account{Name: "a", Password: "Complicated_password1"}
err := dao.CreateAccount(context.Background(), persisted)
assert.NoError(t, err)
- err = rbac.ChangePassword(context.Background(), []string{rbacframe.RoleAdmin}, "admin", &rbacmodel.Account{Name: "a", Password: "Complicated_password2"})
+ err = rbac.ChangePassword(context.Background(), []string{rbacmodel.RoleAdmin}, "admin", &rbacmodel.Account{Name: "a", Password: "Complicated_password2"})
assert.NoError(t, err)
a, err := dao.GetAccount(context.Background(), "a")
assert.NoError(t, err)