mirror/opencloud
1
0
Fork 0
mirror of https://github.com/opencloud-eu/opencloud.git synced 2026-01-20 19:40:39 -06:00
Code Issues Packages Projects Releases Wiki Activity

Let graph auth middleware add the roleids to the context

Browse Source 
They were also added by the ExtractAccountUUID for the /drives endpoint.
We'll need some on other endpoints as well (for automatic user
provisioning).
This commit is contained in:
Ralf Haferkamp
2022-05-20 13:09:34 +02:00
committed by Ralf Haferkamp
parent a755f23e55
commit a6f05e761e
2 changed files with 17 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
extensions/graph/pkg/middleware/auth.go
View File

@@ -8,6 +8,8 @@ import (
"github.com/cs3org/reva/v2/pkg/token/manager/jwt"
"github.com/owncloud/ocis/v2/extensions/graph/pkg/service/v0/errorcode"
"github.com/owncloud/ocis/v2/ocis-pkg/account"
opkgm "github.com/owncloud/ocis/v2/ocis-pkg/middleware"
gmmetadata "go-micro.dev/v4/metadata"
"google.golang.org/grpc/metadata"
)
@@ -25,6 +27,8 @@ func authOptions(opts ...account.Option) account.Options {
// Auth provides a middleware to authenticate requests using the x-access-token header value
// and write it to the context. If there is no x-access-token the middleware prevents access and renders a json document.
func Auth(opts ...account.Option) func(http.Handler) http.Handler {
// Note: This largely duplicates was ocis-pkg/middleware/account.go already does (apart from a slightly different error
// handling). Ideally we should merge both middlewares.
opt := authOptions(opts...)
tokenManager, err := jwt.New(map[string]interface{}{
"secret": opt.JWTSecret,
@@ -69,6 +73,12 @@ func Auth(opts ...account.Option) func(http.Handler) http.Handler {
ctx = revactx.ContextSetToken(ctx, t)
ctx = revactx.ContextSetUser(ctx, u)
ctx = gmmetadata.Set(ctx, opkgm.AccountID, u.Id.OpaqueId)
if u.Opaque != nil {
if roles, ok := u.Opaque.Map["roles"]; ok {
ctx = gmmetadata.Set(ctx, opkgm.RoleIDs, string(roles.Value))
}
}
ctx = metadata.AppendToOutgoingContext(ctx, revactx.TokenHeader, t)
next.ServeHTTP(w, r.WithContext(ctx))

22
extensions/graph/pkg/service/v0/service.go
View File

@@ -14,8 +14,6 @@ import (
"github.com/owncloud/ocis/v2/extensions/graph/pkg/identity"
"github.com/owncloud/ocis/v2/extensions/graph/pkg/identity/ldap"
graphm "github.com/owncloud/ocis/v2/extensions/graph/pkg/middleware"
"github.com/owncloud/ocis/v2/ocis-pkg/account"
opkgm "github.com/owncloud/ocis/v2/ocis-pkg/middleware"
"github.com/owncloud/ocis/v2/ocis-pkg/roles"
"github.com/owncloud/ocis/v2/ocis-pkg/service/grpc"
settingssvc "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/settings/v0"
@@ -171,19 +169,13 @@ func NewService(opts ...Option) Service {
})
})
})
r.Group(func(r chi.Router) {
r.Use(opkgm.ExtractAccountUUID(
account.Logger(options.Logger),
account.JWTSecret(options.Config.TokenManager.JWTSecret)),
)
r.Route("/drives", func(r chi.Router) {
r.Get("/", svc.GetAllDrives)
r.Post("/", svc.CreateDrive)
r.Route("/{driveID}", func(r chi.Router) {
r.Patch("/", svc.UpdateDrive)
r.Get("/", svc.GetSingleDrive)
r.Delete("/", svc.DeleteDrive)
})
r.Route("/drives", func(r chi.Router) {
r.Get("/", svc.GetAllDrives)
r.Post("/", svc.CreateDrive)
r.Route("/{driveID}", func(r chi.Router) {
r.Patch("/", svc.UpdateDrive)
r.Get("/", svc.GetSingleDrive)
r.Delete("/", svc.DeleteDrive)
})
})
})