mirror of
https://github.com/valitydev/bouncer-client-erlang.git
synced 2024-11-06 00:25:18 +00:00
TD-222: Bump to valitydev/bouncer-proto@de15d37 (#7)
* Update to valitydev/org-management-proto@03a269d
This commit is contained in:
parent
b6c7be05e2
commit
45ffaa2a99
7
.env
7
.env
@ -1,6 +1,3 @@
|
||||
# NOTE
|
||||
# You SHOULD specify point releases here so that build time and run time Erlang/OTPs
|
||||
# are the same. See: https://github.com/erlware/relx/pull/902
|
||||
OTP_VERSION=24.2.0
|
||||
OTP_VERSION=24.3.4
|
||||
REBAR_VERSION=3.18
|
||||
THRIFT_VERSION=0.14.2.2
|
||||
THRIFT_VERSION=0.14.2.3
|
||||
|
@ -1,7 +1,7 @@
|
||||
{"1.2.0",
|
||||
[{<<"bouncer_proto">>,
|
||||
{git,"https://github.com/valitydev/bouncer-proto",
|
||||
{ref,"633ba73e376ab06587499bd163cf807a9c34b8f7"}},
|
||||
{ref,"de15d375ee77c5002c55a1ba9a20a67d2c222115"}},
|
||||
0},
|
||||
{<<"cache">>,{pkg,<<"cache">>,<<"2.3.3">>},1},
|
||||
{<<"certifi">>,{pkg,<<"certifi">>,<<"2.8.0">>},2},
|
||||
@ -18,7 +18,7 @@
|
||||
{<<"mimerl">>,{pkg,<<"mimerl">>,<<"1.2.0">>},2},
|
||||
{<<"org_management_proto">>,
|
||||
{git,"https://github.com/valitydev/org-management-proto",
|
||||
{ref,"f433223706284000694e54e839fafb10db84e2b3"}},
|
||||
{ref,"03a269df4805fa604e8fd2d04241619a739e2ae3"}},
|
||||
0},
|
||||
{<<"parse_trans">>,{pkg,<<"parse_trans">>,<<"3.3.1">>},2},
|
||||
{<<"ranch">>,{pkg,<<"ranch">>,<<"1.8.0">>},2},
|
||||
|
@ -1,7 +1,8 @@
|
||||
-module(bouncer_client).
|
||||
|
||||
-include_lib("bouncer_proto/include/bouncer_decisions_thrift.hrl").
|
||||
-include_lib("bouncer_proto/include/bouncer_context_v1_thrift.hrl").
|
||||
-include_lib("bouncer_proto/include/bouncer_decision_thrift.hrl").
|
||||
-include_lib("bouncer_proto/include/bouncer_ctx_v1_thrift.hrl").
|
||||
-include_lib("bouncer_proto/include/bouncer_ctx_thrift.hrl").
|
||||
|
||||
%% API
|
||||
|
||||
@ -15,7 +16,7 @@
|
||||
|
||||
-type context_fragment_id() :: binary().
|
||||
-type ruleset_id() :: binary().
|
||||
-type encoded_context_fragment() :: bouncer_context_thrift:'ContextFragment'().
|
||||
-type encoded_context_fragment() :: bouncer_ctx_thrift:'ContextFragment'().
|
||||
-type context_fragment() ::
|
||||
bouncer_context_helpers:context_fragment()
|
||||
| {encoded_fragment, encoded_context_fragment()}.
|
||||
@ -24,7 +25,7 @@
|
||||
fragments => #{context_fragment_id() => context_fragment()}
|
||||
}.
|
||||
|
||||
-type judgement() :: allowed | forbidden | {restricted, bouncer_restriction_thrift:'Restrictions'()}.
|
||||
-type judgement() :: allowed | forbidden | {restricted, bouncer_rstn_thrift:'Restrictions'()}.
|
||||
|
||||
-type service_name() :: atom().
|
||||
|
||||
@ -53,18 +54,18 @@ judge_(RulesetID, JudgeContext, WoodyContext) ->
|
||||
case bouncer_client_woody:call(bouncer, 'Judge', {RulesetID, Context}, WoodyContext) of
|
||||
{ok, Judgement} ->
|
||||
{ok, parse_judgement(Judgement)};
|
||||
{exception, #bdcs_RulesetNotFound{}} ->
|
||||
{exception, #decision_RulesetNotFound{}} ->
|
||||
{error, {ruleset, notfound}};
|
||||
{exception, #bdcs_InvalidRuleset{}} ->
|
||||
{exception, #decision_InvalidRuleset{}} ->
|
||||
{error, {ruleset, invalid}};
|
||||
{exception, #bdcs_InvalidContext{}} ->
|
||||
{exception, #decision_InvalidContext{}} ->
|
||||
{error, {context, invalid}}
|
||||
end.
|
||||
|
||||
%%
|
||||
|
||||
collect_judge_context(JudgeContext) ->
|
||||
#bdcs_Context{fragments = collect_fragments(JudgeContext, #{})}.
|
||||
#decision_Context{fragments = collect_fragments(JudgeContext, #{})}.
|
||||
|
||||
collect_fragments(#{fragments := Fragments}, Context) ->
|
||||
maps:fold(fun collect_fragments_/3, Context, Fragments);
|
||||
@ -73,16 +74,18 @@ collect_fragments(_, Context) ->
|
||||
|
||||
collect_fragments_(FragmentID, {encoded_fragment, EncodedFragment}, Acc0) ->
|
||||
Acc0#{FragmentID => EncodedFragment};
|
||||
collect_fragments_(FragmentID, ContextFragment = #bctx_v1_ContextFragment{}, Acc0) ->
|
||||
collect_fragments_(FragmentID, ContextFragment = #ctx_v1_ContextFragment{}, Acc0) ->
|
||||
collect_fragments_(FragmentID, bake_context_fragment(ContextFragment), Acc0).
|
||||
|
||||
%%
|
||||
|
||||
parse_judgement(#bdcs_Judgement{resolution = {allowed, #bdcs_ResolutionAllowed{}}}) ->
|
||||
parse_judgement(#decision_Judgement{resolution = {allowed, #decision_ResolutionAllowed{}}}) ->
|
||||
allowed;
|
||||
parse_judgement(#bdcs_Judgement{resolution = {forbidden, #bdcs_ResolutionForbidden{}}}) ->
|
||||
parse_judgement(#decision_Judgement{resolution = {forbidden, #decision_ResolutionForbidden{}}}) ->
|
||||
forbidden;
|
||||
parse_judgement(#bdcs_Judgement{resolution = {restricted, #bdcs_ResolutionRestricted{restrictions = Restrictions}}}) ->
|
||||
parse_judgement(#decision_Judgement{
|
||||
resolution = {restricted, #decision_ResolutionRestricted{restrictions = Restrictions}}
|
||||
}) ->
|
||||
{restricted, Restrictions}.
|
||||
|
||||
%%
|
||||
@ -90,13 +93,13 @@ parse_judgement(#bdcs_Judgement{resolution = {restricted, #bdcs_ResolutionRestri
|
||||
-spec bake_context_fragment(bouncer_context_helpers:context_fragment()) ->
|
||||
{encoded_fragment, encoded_context_fragment()}.
|
||||
bake_context_fragment(ContextFragment) ->
|
||||
{encoded_fragment, #bctx_ContextFragment{
|
||||
{encoded_fragment, #ctx_ContextFragment{
|
||||
type = v1_thrift_binary,
|
||||
content = encode_context_fragment(ContextFragment)
|
||||
}}.
|
||||
|
||||
encode_context_fragment(ContextFragment) ->
|
||||
Type = {struct, struct, {bouncer_context_v1_thrift, 'ContextFragment'}},
|
||||
Type = {struct, struct, {bouncer_ctx_v1_thrift, 'ContextFragment'}},
|
||||
Codec = thrift_strict_binary_codec:new(),
|
||||
case thrift_strict_binary_codec:write(Codec, Type, ContextFragment) of
|
||||
{ok, Codec1} ->
|
||||
|
@ -3,7 +3,6 @@
|
||||
-export([call/4]).
|
||||
-export([call/5]).
|
||||
|
||||
-define(APP, bouncer_client).
|
||||
-define(DEFAULT_DEADLINE, 5000).
|
||||
|
||||
%%
|
||||
@ -81,9 +80,9 @@ get_service_client_url(ClientConfig) ->
|
||||
|
||||
-spec get_service_modname(service_name()) -> woody:service().
|
||||
get_service_modname(org_management) ->
|
||||
{orgmgmt_auth_context_provider_thrift, 'AuthContextProvider'};
|
||||
{orgmgmt_authctx_provider_thrift, 'AuthContextProvider'};
|
||||
get_service_modname(bouncer) ->
|
||||
{bouncer_decisions_thrift, 'Arbiter'}.
|
||||
{bouncer_decision_thrift, 'Arbiter'}.
|
||||
|
||||
-spec get_service_deadline(client_config()) -> undefined | woody_deadline:deadline().
|
||||
get_service_deadline(ClientConfig) ->
|
||||
|
@ -1,7 +1,7 @@
|
||||
-module(bouncer_context_helpers).
|
||||
|
||||
-include_lib("bouncer_proto/include/bouncer_context_v1_thrift.hrl").
|
||||
-include_lib("bouncer_proto/include/bouncer_context_thrift.hrl").
|
||||
-include_lib("bouncer_proto/include/bouncer_ctx_v1_thrift.hrl").
|
||||
-include_lib("bouncer_proto/include/bouncer_base_thrift.hrl").
|
||||
|
||||
-export([empty/0]).
|
||||
-export([make_env_fragment/1]).
|
||||
@ -20,7 +20,7 @@
|
||||
-type email() :: binary().
|
||||
-type timestamp() :: binary().
|
||||
-type ip() :: inet:ip_address() | string() | binary().
|
||||
-type context_fragment() :: bouncer_context_v1_thrift:'ContextFragment'().
|
||||
-type context_fragment() :: bouncer_ctx_v1_thrift:'ContextFragment'().
|
||||
-type woody_context() :: woody_context:ctx().
|
||||
|
||||
-type entity() :: #{
|
||||
@ -91,21 +91,21 @@
|
||||
|
||||
-spec empty() -> context_fragment().
|
||||
empty() ->
|
||||
#bctx_v1_ContextFragment{}.
|
||||
#ctx_v1_ContextFragment{}.
|
||||
|
||||
-spec make_env_fragment(environment_params()) -> context_fragment().
|
||||
make_env_fragment(Params) ->
|
||||
add_env(Params, empty()).
|
||||
|
||||
-spec add_env(environment_params(), context_fragment()) -> context_fragment().
|
||||
add_env(Params, ContextFragment = #bctx_v1_ContextFragment{env = undefined}) ->
|
||||
add_env(Params, ContextFragment = #ctx_v1_ContextFragment{env = undefined}) ->
|
||||
Now = maybe_get_param(now, Params, genlib_rfc3339:format(genlib_time:unow(), second)),
|
||||
Deployment = maybe_get_param(deployment, Params),
|
||||
DeploymentID = maybe_get_param(id, Deployment),
|
||||
ContextFragment#bctx_v1_ContextFragment{
|
||||
env = #bctx_v1_Environment{
|
||||
ContextFragment#ctx_v1_ContextFragment{
|
||||
env = #ctx_v1_Environment{
|
||||
now = Now,
|
||||
deployment = maybe_add_param(#bctx_v1_Deployment{id = DeploymentID}, Deployment)
|
||||
deployment = maybe_add_param(#ctx_v1_Deployment{id = DeploymentID}, Deployment)
|
||||
}
|
||||
}.
|
||||
|
||||
@ -114,13 +114,13 @@ make_auth_fragment(Params) ->
|
||||
add_auth(Params, empty()).
|
||||
|
||||
-spec add_auth(auth_params(), context_fragment()) -> context_fragment().
|
||||
add_auth(Params, ContextFragment = #bctx_v1_ContextFragment{auth = undefined}) ->
|
||||
add_auth(Params, ContextFragment = #ctx_v1_ContextFragment{auth = undefined}) ->
|
||||
Method = get_param(method, Params),
|
||||
Scope = maybe_get_param(scope, Params),
|
||||
Expiration = maybe_get_param(expiration, Params),
|
||||
Token = maybe_get_param(token, Params),
|
||||
ContextFragment#bctx_v1_ContextFragment{
|
||||
auth = #bctx_v1_Auth{
|
||||
ContextFragment#ctx_v1_ContextFragment{
|
||||
auth = #ctx_v1_Auth{
|
||||
method = Method,
|
||||
scope = maybe_marshal_auth_scopes(Scope),
|
||||
expiration = Expiration,
|
||||
@ -133,13 +133,13 @@ make_user_fragment(Params) ->
|
||||
add_user(Params, empty()).
|
||||
|
||||
-spec add_user(user_params(), context_fragment()) -> context_fragment().
|
||||
add_user(Params, ContextFragment = #bctx_v1_ContextFragment{user = undefined}) ->
|
||||
add_user(Params, ContextFragment = #ctx_v1_ContextFragment{user = undefined}) ->
|
||||
UserID = get_param(id, Params),
|
||||
RealmEntity = get_param(realm, Params),
|
||||
Email = maybe_get_param(email, Params),
|
||||
Orgs = maybe_get_param(orgs, Params),
|
||||
ContextFragment#bctx_v1_ContextFragment{
|
||||
user = #bctx_v1_User{
|
||||
ContextFragment#ctx_v1_ContextFragment{
|
||||
user = #ctx_v1_User{
|
||||
id = UserID,
|
||||
realm = marshal_entity(RealmEntity),
|
||||
email = Email,
|
||||
@ -152,10 +152,10 @@ make_requester_fragment(Params) ->
|
||||
add_requester(Params, empty()).
|
||||
|
||||
-spec add_requester(requester_params(), context_fragment()) -> context_fragment().
|
||||
add_requester(Params, ContextFragment = #bctx_v1_ContextFragment{requester = undefined}) ->
|
||||
add_requester(Params, ContextFragment = #ctx_v1_ContextFragment{requester = undefined}) ->
|
||||
IP = maybe_get_param(ip, Params),
|
||||
ContextFragment#bctx_v1_ContextFragment{
|
||||
requester = #bctx_v1_Requester{
|
||||
ContextFragment#ctx_v1_ContextFragment{
|
||||
requester = #ctx_v1_Requester{
|
||||
ip = maybe_marshal_ip(IP)
|
||||
}
|
||||
}.
|
||||
@ -166,27 +166,11 @@ get_user_orgs_fragment(UserID, WoodyContext) ->
|
||||
ServiceName = org_management,
|
||||
case bouncer_client_woody:call(ServiceName, 'GetUserContext', {UserID}, WoodyContext) of
|
||||
{ok, EncodedFragment} ->
|
||||
{ok, {encoded_fragment, convert_fragment(ServiceName, EncodedFragment)}};
|
||||
{ok, {encoded_fragment, EncodedFragment}};
|
||||
{exception, {'orgmgmt_UserNotFound'}} ->
|
||||
{error, {user, notfound}}
|
||||
end.
|
||||
|
||||
%% As taken from org_management_proto/include/orgmgmt_context_thrift.hrl, please keep in sync:
|
||||
%% struct 'ContextFragment'
|
||||
%% -record('bctx_ContextFragment', {
|
||||
%% 'type' :: atom(),
|
||||
%% 'content' :: binary() | undefined
|
||||
%% }).
|
||||
|
||||
convert_fragment(
|
||||
org_management,
|
||||
{'bctx_ContextFragment', Type = v1_thrift_binary, Content}
|
||||
) when is_binary(Content) ->
|
||||
#bctx_ContextFragment{
|
||||
type = Type,
|
||||
content = Content
|
||||
}.
|
||||
|
||||
get_param(Key, Map = #{}) ->
|
||||
maps:get(Key, Map).
|
||||
|
||||
@ -212,16 +196,16 @@ maybe_add_param(Value, _Param) ->
|
||||
|
||||
marshal_entity(Entity) ->
|
||||
EntityID = get_param(id, Entity),
|
||||
#bouncer_base_Entity{id = EntityID}.
|
||||
#base_Entity{id = EntityID}.
|
||||
|
||||
maybe_marshal_entity(undefined) ->
|
||||
undefined;
|
||||
maybe_marshal_entity(Entity) ->
|
||||
EntityID = maybe_get_param(id, Entity),
|
||||
#bouncer_base_Entity{id = EntityID}.
|
||||
#base_Entity{id = EntityID}.
|
||||
|
||||
marshal_token(Token) ->
|
||||
#bctx_v1_Token{id = maybe_get_param(id, Token)}.
|
||||
#ctx_v1_Token{id = maybe_get_param(id, Token)}.
|
||||
|
||||
maybe_marshal_auth_scopes(undefined) ->
|
||||
undefined;
|
||||
@ -229,7 +213,7 @@ maybe_marshal_auth_scopes(Scopes) ->
|
||||
ordsets:from_list(lists:map(fun(Scope) -> maybe_marshal_auth_scope(Scope) end, Scopes)).
|
||||
|
||||
maybe_marshal_auth_scope(Scope) ->
|
||||
#bctx_v1_AuthScope{
|
||||
#ctx_v1_AuthScope{
|
||||
party = maybe_marshal_entity(maybe_get_param(party, Scope)),
|
||||
shop = maybe_marshal_entity(maybe_get_param(shop, Scope)),
|
||||
invoice = maybe_marshal_entity(maybe_get_param(invoice, Scope)),
|
||||
@ -247,7 +231,7 @@ maybe_marshal_user_org(Org) ->
|
||||
OwnerEntity = maybe_get_param(owner, Org),
|
||||
PartyEntity = maybe_get_param(party, Org),
|
||||
Roles = maybe_get_param(roles, Org),
|
||||
#bctx_v1_Organization{
|
||||
#ctx_v1_Organization{
|
||||
id = ID,
|
||||
owner = maybe_marshal_entity(OwnerEntity),
|
||||
party = maybe_marshal_entity(PartyEntity),
|
||||
@ -263,11 +247,10 @@ maybe_marshal_user_role(Role) ->
|
||||
ID = maybe_get_param(id, Role),
|
||||
Scope = maybe_get_param(scope, Role),
|
||||
ShopEntity = maybe_get_param(shop, Scope),
|
||||
|
||||
#bctx_v1_OrgRole{
|
||||
#ctx_v1_OrgRole{
|
||||
id = ID,
|
||||
scope = maybe_add_param(
|
||||
#bctx_v1_OrgRoleScope{
|
||||
#ctx_v1_OrgRoleScope{
|
||||
shop = maybe_add_param(maybe_marshal_entity(ShopEntity), ShopEntity)
|
||||
},
|
||||
Scope
|
||||
|
@ -3,8 +3,10 @@
|
||||
-include_lib("stdlib/include/assert.hrl").
|
||||
-include_lib("common_test/include/ct.hrl").
|
||||
|
||||
-include_lib("bouncer_proto/include/bouncer_decisions_thrift.hrl").
|
||||
-include_lib("bouncer_proto/include/bouncer_context_v1_thrift.hrl").
|
||||
-include_lib("bouncer_proto/include/bouncer_decision_thrift.hrl").
|
||||
-include_lib("bouncer_proto/include/bouncer_ctx_v1_thrift.hrl").
|
||||
-include_lib("bouncer_proto/include/bouncer_ctx_thrift.hrl").
|
||||
-include_lib("bouncer_proto/include/bouncer_base_thrift.hrl").
|
||||
|
||||
-export([all/0]).
|
||||
|
||||
@ -111,8 +113,8 @@ empty_judge(C) ->
|
||||
_ = mock_services(
|
||||
[
|
||||
{bouncer, fun('Judge', _) ->
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {allowed, #bdcs_ResolutionAllowed{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {allowed, #decision_ResolutionAllowed{}}
|
||||
}}
|
||||
end}
|
||||
],
|
||||
@ -139,8 +141,8 @@ follows_timeout(C) ->
|
||||
[
|
||||
{bouncer, fun('Judge', _) ->
|
||||
ok = timer:sleep(5000),
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {allowed, #bdcs_ResolutionAllowed{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {allowed, #decision_ResolutionAllowed{}}
|
||||
}}
|
||||
end}
|
||||
],
|
||||
@ -167,23 +169,23 @@ validate_user_fragment(C) ->
|
||||
{bouncer, fun('Judge', {_RulesetID, Fragments}) ->
|
||||
Auth = get_fragment(<<"user">>, Fragments),
|
||||
?assertEqual(
|
||||
#bctx_v1_ContextFragment{
|
||||
user = #bctx_v1_User{
|
||||
#ctx_v1_ContextFragment{
|
||||
user = #ctx_v1_User{
|
||||
id = UserID,
|
||||
realm = #bouncer_base_Entity{id = UserRealm},
|
||||
realm = #base_Entity{id = UserRealm},
|
||||
orgs = [
|
||||
#bctx_v1_Organization{
|
||||
#ctx_v1_Organization{
|
||||
id = OrgID,
|
||||
party = #bouncer_base_Entity{id = PartyID},
|
||||
owner = #bouncer_base_Entity{id = UserID}
|
||||
party = #base_Entity{id = PartyID},
|
||||
owner = #base_Entity{id = UserID}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
Auth
|
||||
),
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {allowed, #bdcs_ResolutionAllowed{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {allowed, #decision_ResolutionAllowed{}}
|
||||
}}
|
||||
end}
|
||||
],
|
||||
@ -212,12 +214,12 @@ validate_env_fragment(C) ->
|
||||
{bouncer, fun('Judge', {_RulesetID, Fragments}) ->
|
||||
case get_time(Fragments) of
|
||||
Time ->
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {allowed, #bdcs_ResolutionAllowed{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {allowed, #decision_ResolutionAllowed{}}
|
||||
}};
|
||||
_ ->
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {forbidden, #bdcs_ResolutionForbidden{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {forbidden, #decision_ResolutionForbidden{}}
|
||||
}}
|
||||
end
|
||||
end}
|
||||
@ -240,16 +242,16 @@ validate_auth_fragment(C) ->
|
||||
{bouncer, fun('Judge', {_RulesetID, Fragments}) ->
|
||||
Auth = get_fragment(<<"auth">>, Fragments),
|
||||
?assertEqual(
|
||||
#bctx_v1_ContextFragment{
|
||||
auth = #bctx_v1_Auth{
|
||||
#ctx_v1_ContextFragment{
|
||||
auth = #ctx_v1_Auth{
|
||||
method = Method,
|
||||
token = #bctx_v1_Token{id = TokenID}
|
||||
token = #ctx_v1_Token{id = TokenID}
|
||||
}
|
||||
},
|
||||
Auth
|
||||
),
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {allowed, #bdcs_ResolutionAllowed{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {allowed, #decision_ResolutionAllowed{}}
|
||||
}}
|
||||
end}
|
||||
],
|
||||
@ -280,22 +282,22 @@ validate_auth_fragment_scope(C) ->
|
||||
{bouncer, fun('Judge', {_RulesetID, Fragments}) ->
|
||||
Auth = get_fragment(<<"auth">>, Fragments),
|
||||
?assertEqual(
|
||||
#bctx_v1_ContextFragment{
|
||||
auth = #bctx_v1_Auth{
|
||||
#ctx_v1_ContextFragment{
|
||||
auth = #ctx_v1_Auth{
|
||||
method = Method,
|
||||
scope = [
|
||||
#bctx_v1_AuthScope{
|
||||
invoice_template = #bouncer_base_Entity{id = InvoiceTemplateID},
|
||||
customer = #bouncer_base_Entity{id = CustomerID}
|
||||
#ctx_v1_AuthScope{
|
||||
invoice_template = #base_Entity{id = InvoiceTemplateID},
|
||||
customer = #base_Entity{id = CustomerID}
|
||||
},
|
||||
#bctx_v1_AuthScope{party = #bouncer_base_Entity{id = PartyID}}
|
||||
#ctx_v1_AuthScope{party = #base_Entity{id = PartyID}}
|
||||
]
|
||||
}
|
||||
},
|
||||
Auth
|
||||
),
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {allowed, #bdcs_ResolutionAllowed{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {allowed, #decision_ResolutionAllowed{}}
|
||||
}}
|
||||
end}
|
||||
],
|
||||
@ -329,18 +331,18 @@ validate_requester_fragment(C) ->
|
||||
{bouncer, fun('Judge', {_RulesetID, Fragments}) ->
|
||||
case get_ip(Fragments) of
|
||||
undefined ->
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {forbidden, #bdcs_ResolutionForbidden{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {forbidden, #decision_ResolutionForbidden{}}
|
||||
}};
|
||||
BinaryIP ->
|
||||
case binary_to_list(BinaryIP) of
|
||||
IP ->
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {allowed, #bdcs_ResolutionAllowed{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {allowed, #decision_ResolutionAllowed{}}
|
||||
}};
|
||||
_ ->
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {forbidden, #bdcs_ResolutionForbidden{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {forbidden, #decision_ResolutionForbidden{}}
|
||||
}}
|
||||
end
|
||||
end
|
||||
@ -361,24 +363,24 @@ validate_complex_fragment(C) ->
|
||||
[
|
||||
{bouncer, fun('Judge', {_RulesetID, Fragments}) ->
|
||||
case Fragments of
|
||||
#bdcs_Context{fragments = #{<<"complex">> := Fragment}} ->
|
||||
#decision_Context{fragments = #{<<"complex">> := Fragment}} ->
|
||||
case decode_fragment(Fragment) of
|
||||
#bctx_v1_ContextFragment{
|
||||
env = #bctx_v1_Environment{},
|
||||
auth = #bctx_v1_Auth{},
|
||||
user = #bctx_v1_User{}
|
||||
#ctx_v1_ContextFragment{
|
||||
env = #ctx_v1_Environment{},
|
||||
auth = #ctx_v1_Auth{},
|
||||
user = #ctx_v1_User{}
|
||||
} ->
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {allowed, #bdcs_ResolutionAllowed{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {allowed, #decision_ResolutionAllowed{}}
|
||||
}};
|
||||
_ ->
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {forbidden, #bdcs_ResolutionForbidden{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {forbidden, #decision_ResolutionForbidden{}}
|
||||
}}
|
||||
end;
|
||||
_ ->
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {forbidden, #bdcs_ResolutionForbidden{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {forbidden, #decision_ResolutionForbidden{}}
|
||||
}}
|
||||
end
|
||||
end}
|
||||
@ -388,7 +390,19 @@ validate_complex_fragment(C) ->
|
||||
WoodyContext = woody_context:new(),
|
||||
ComplexFragment =
|
||||
bouncer_context_helpers:add_user(
|
||||
#{id => <<"USER">>, realm => #{id => <<"external">>}, email => <<"user@example.org">>},
|
||||
#{
|
||||
id => <<"USER">>,
|
||||
realm => #{id => <<"external">>},
|
||||
email => <<"user@example.org">>,
|
||||
orgs => [
|
||||
#{
|
||||
id => <<"ORG">>,
|
||||
roles => [
|
||||
#{id => <<"COMMANDER">>, scope => #{shop => #{id => <<"SHOP">>}}}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
bouncer_context_helpers:add_auth(
|
||||
#{method => <<"METHOD">>},
|
||||
bouncer_context_helpers:make_env_fragment(
|
||||
@ -408,22 +422,22 @@ validate_remote_user_fragment(C) ->
|
||||
_ = mock_services(
|
||||
[
|
||||
{org_management, fun('GetUserContext', _) ->
|
||||
Content = encode(#bctx_v1_ContextFragment{
|
||||
user = #bctx_v1_User{
|
||||
Content = encode(#ctx_v1_ContextFragment{
|
||||
user = #ctx_v1_User{
|
||||
id = UserID
|
||||
}
|
||||
}),
|
||||
{ok, {'bctx_ContextFragment', v1_thrift_binary, Content}}
|
||||
{ok, #ctx_ContextFragment{type = v1_thrift_binary, content = Content}}
|
||||
end},
|
||||
{bouncer, fun('Judge', {_RulesetID, Fragments}) ->
|
||||
case get_user_id(Fragments) of
|
||||
UserID ->
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {allowed, #bdcs_ResolutionAllowed{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {allowed, #decision_ResolutionAllowed{}}
|
||||
}};
|
||||
_ ->
|
||||
{ok, #bdcs_Judgement{
|
||||
resolution = {forbidden, #bdcs_ResolutionForbidden{}}
|
||||
{ok, #decision_Judgement{
|
||||
resolution = {forbidden, #decision_ResolutionForbidden{}}
|
||||
}}
|
||||
end
|
||||
end}
|
||||
@ -436,37 +450,37 @@ validate_remote_user_fragment(C) ->
|
||||
|
||||
%%
|
||||
|
||||
get_ip(#bdcs_Context{
|
||||
get_ip(#decision_Context{
|
||||
fragments = #{<<"requester">> := Fragment}
|
||||
}) ->
|
||||
#bctx_v1_ContextFragment{requester = #bctx_v1_Requester{ip = IP}} = decode_fragment(Fragment),
|
||||
#ctx_v1_ContextFragment{requester = #ctx_v1_Requester{ip = IP}} = decode_fragment(Fragment),
|
||||
IP.
|
||||
|
||||
get_time(#bdcs_Context{
|
||||
get_time(#decision_Context{
|
||||
fragments = #{<<"env">> := Fragment}
|
||||
}) ->
|
||||
#bctx_v1_ContextFragment{env = #bctx_v1_Environment{now = Time}} = decode_fragment(Fragment),
|
||||
#ctx_v1_ContextFragment{env = #ctx_v1_Environment{now = Time}} = decode_fragment(Fragment),
|
||||
Time.
|
||||
|
||||
get_user_id(#bdcs_Context{
|
||||
get_user_id(#decision_Context{
|
||||
fragments = #{<<"user">> := Fragment}
|
||||
}) ->
|
||||
#bctx_v1_ContextFragment{user = #bctx_v1_User{id = UserID}} = decode_fragment(Fragment),
|
||||
#ctx_v1_ContextFragment{user = #ctx_v1_User{id = UserID}} = decode_fragment(Fragment),
|
||||
UserID.
|
||||
|
||||
get_fragment(ID, #bdcs_Context{fragments = Fragments}) ->
|
||||
get_fragment(ID, #decision_Context{fragments = Fragments}) ->
|
||||
decode_fragment(maps:get(ID, Fragments)).
|
||||
|
||||
decode_fragment(#bctx_ContextFragment{type = v1_thrift_binary, content = Content}) ->
|
||||
decode_fragment(#ctx_ContextFragment{type = v1_thrift_binary, content = Content}) ->
|
||||
case decode_fragment_content(Content) of
|
||||
Fragment = #bctx_v1_ContextFragment{} ->
|
||||
Fragment = #ctx_v1_ContextFragment{} ->
|
||||
Fragment;
|
||||
{error, Reason} ->
|
||||
error(Reason)
|
||||
end.
|
||||
|
||||
decode_fragment_content(Content) ->
|
||||
Type = {struct, struct, {bouncer_context_v1_thrift, 'ContextFragment'}},
|
||||
Type = {struct, struct, {bouncer_ctx_v1_thrift, 'ContextFragment'}},
|
||||
Codec = thrift_strict_binary_codec:new(Content),
|
||||
case thrift_strict_binary_codec:read(Codec, Type) of
|
||||
{ok, CtxThrift, Codec1} ->
|
||||
@ -481,7 +495,7 @@ decode_fragment_content(Content) ->
|
||||
end.
|
||||
|
||||
encode(ContextFragment) ->
|
||||
Type = {struct, struct, {bouncer_context_v1_thrift, 'ContextFragment'}},
|
||||
Type = {struct, struct, {bouncer_ctx_v1_thrift, 'ContextFragment'}},
|
||||
Codec = thrift_strict_binary_codec:new(),
|
||||
case thrift_strict_binary_codec:write(Codec, Type, ContextFragment) of
|
||||
{ok, Codec1} ->
|
||||
@ -501,9 +515,7 @@ stop_mocked_service_sup(SupPid) ->
|
||||
|
||||
-define(APP, bouncer_client).
|
||||
-define(HOST_IP, "::").
|
||||
-define(HOST_PORT, 8080).
|
||||
-define(HOST_NAME, "localhost").
|
||||
-define(HOST_URL, ?HOST_NAME ++ ":" ++ integer_to_list(?HOST_PORT)).
|
||||
|
||||
mock_services(Services, SupOrConfig) ->
|
||||
maps:map(fun set_cfg/2, mock_services_(Services, SupOrConfig)).
|
||||
@ -556,9 +568,9 @@ mock_service_handler(ServiceName, WoodyService, Fun) ->
|
||||
{make_path(ServiceName), {WoodyService, {bouncer_client_mock_service, #{function => Fun}}}}.
|
||||
|
||||
get_service_modname(org_management) ->
|
||||
{orgmgmt_auth_context_provider_thrift, 'AuthContextProvider'};
|
||||
{orgmgmt_authctx_provider_thrift, 'AuthContextProvider'};
|
||||
get_service_modname(bouncer) ->
|
||||
{bouncer_decisions_thrift, 'Arbiter'}.
|
||||
{bouncer_decision_thrift, 'Arbiter'}.
|
||||
|
||||
make_url(ServiceName, Port) ->
|
||||
iolist_to_binary(["http://", ?HOST_NAME, ":", integer_to_list(Port), make_path(ServiceName)]).
|
||||
|
Loading…
Reference in New Issue
Block a user