Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remove all the CMS authz logic from the CouchDB validate functions #11191

Merged
merged 1 commit into from
Jun 24, 2022
Merged

remove all the CMS authz logic from the CouchDB validate functions #11191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 0 additions & 46 deletions src/couchapps/ACDC/validate_doc_update.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,50 +6,4 @@ function(newDoc, oldDoc, userCtx) {
delet : 2
};
var docOp = oldDoc ? (newDoc._deleted === true ? DOCOPS.delet : DOCOPS.modif) : DOCOPS.creat;

// Function to get the user list of site/groups for the given role
var getRole = function(role) {
var roles = userCtx.roles;
for (i in roles) {
if ( typeof (roles[i]) == "object" && roles[i][0] === role)
return roles[i][1];
// Request comes from backend auth handler
if ( typeof (roles[i]) == "string" && roles[i] === role)
return [];
// Request comes from other handlers (i.e. host auth)
}
return null;
}
// Function to check if user has the role for a given group or site
var matchesRole = function(role, grpsite) {
var r = getRole(role);
if (r != null)
if (grpsite === "" || r.indexOf(grpsite) != -1)
return true;
return false;
}
// Gets whether the user is a global admin
// name=null means requests coming from the local replicator, so we must allow
// (the cms couch auth does not allow name=null, so it affects only internal
// replication requests)
var isGlobalAdm = (userCtx.name === null) ||
matchesRole("_admin", "") ||
matchesRole("-admin", "group:couchdb");

//---------------------------------
// Authorization rules for Myapp DB

// The following rule aplies for all operation types
var allowed = isGlobalAdm ||
matchesRole("admin", "group:reqmgr") ||
matchesRole("web-service", "group:facops") ||
matchesRole("production-operator", "group:dataops");

// Throw if user not validated
if (!allowed) {
log(toJSON(userCtx));
throw {
forbidden : "User not authorized for action."
};
}
}
45 changes: 0 additions & 45 deletions src/couchapps/LogDB/validate_doc_update.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,49 +3,4 @@ function(newDoc, oldDoc, userCtx) {
var DOCOPS = { modif:0, creat:1, delet:2 };
var docOp = oldDoc ? (newDoc._deleted === true ? DOCOPS.delet : DOCOPS.modif)
: DOCOPS.creat;

// Function to get the user list of site/groups for the given role
var getRole = function(role) {
var roles = userCtx.roles;
for (i in roles) {
if(typeof(roles[i]) == "object" && roles[i][0] === role)
return roles[i][1]; // Request comes from backend auth handler
if(typeof(roles[i]) == "string" && roles[i] === role)
return []; // Request comes from other handlers (i.e. host auth)
}
return null;
}

// Function to check if user has the role for a given group or site
var matchesRole = function(role, grpsite) {
var r = getRole(role);
if (r != null)
if (grpsite === "" || r.indexOf(grpsite) != -1)
return true;
return false;
}

// Gets whether the user is a global admin
// name=null means requests coming from the local replicator, so we must allow
// (the cms couch auth does not allow name=null, so it affects only internal
// replication requests)
var isGlobalAdm = (userCtx.name === null)
|| matchesRole("admin", "")
|| matchesRole("_admin", "")
|| matchesRole("-admin", "group:couchdb");

//---------------------------------
// Authorization rules for Myapp DB

// The following rule aplies for all operation types
var allowed = isGlobalAdm || matchesRole("admin", "group:reqmgr")
|| matchesRole("web-service", "group:facops")
|| matchesRole("t0-operator","group:dataops")
|| matchesRole("production-operator", "group:dataops");

// Throw if user not validated
if(!allowed) {
log(toJSON(userCtx));
throw {forbidden: "User not authorized for action."};
}
}
45 changes: 0 additions & 45 deletions src/couchapps/ReqMgr/validate_doc_update.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,49 +3,4 @@ function(newDoc, oldDoc, userCtx) {
var DOCOPS = { modif:0, creat:1, delet:2 };
var docOp = oldDoc ? (newDoc._deleted === true ? DOCOPS.delet : DOCOPS.modif)
: DOCOPS.creat;

// Function to get the user list of site/groups for the given role
var getRole = function(role) {
var roles = userCtx.roles;
for (i in roles) {
if(typeof(roles[i]) == "object" && roles[i][0] === role)
return roles[i][1]; // Request comes from backend auth handler
if(typeof(roles[i]) == "string" && roles[i] === role)
return []; // Request comes from other handlers (i.e. host auth)
}
return null;
}

// Function to check if user has the role for a given group or site
var matchesRole = function(role, grpsite) {
var r = getRole(role);
if (r != null)
if (grpsite === "" || r.indexOf(grpsite) != -1)
return true;
return false;
}

// Gets whether the user is a global admin
// name=null means requests coming from the local replicator, so we must allow
// (the cms couch auth does not allow name=null, so it affects only internal
// replication requests)
var isGlobalAdm = (userCtx.name === null)
|| matchesRole("admin", "")
|| matchesRole("_admin", "")
|| matchesRole("-admin", "group:couchdb");

//---------------------------------
// Authorization rules for Myapp DB

// The following rule aplies for all operation types
var allowed = isGlobalAdm || matchesRole("admin", "group:reqmgr")
|| matchesRole("data-manager", "group:reqmgr")
|| matchesRole("web-service", "group:facops")
|| matchesRole("production-operator", "group:dataops");

// Throw if user not validated
if(!allowed) {
log(toJSON(userCtx));
throw {forbidden: "User not authorized for action."};
}
}
43 changes: 0 additions & 43 deletions src/couchapps/ReqMgrAux/validate_doc_update.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,47 +3,4 @@ function(newDoc, oldDoc, userCtx) {
var DOCOPS = { modif:0, creat:1, delet:2 };
var docOp = oldDoc ? (newDoc._deleted === true ? DOCOPS.delet : DOCOPS.modif)
: DOCOPS.creat;

// Function to get the user list of site/groups for the given role
var getRole = function(role) {
var roles = userCtx.roles;
for (i in roles) {
if(typeof(roles[i]) == "object" && roles[i][0] === role)
return roles[i][1]; // Request comes from backend auth handler
if(typeof(roles[i]) == "string" && roles[i] === role)
return []; // Request comes from other handlers (i.e. host auth)
}
return null;
}

// Function to check if user has the role for a given group or site
var matchesRole = function(role, grpsite) {
var r = getRole(role);
if (r != null)
if (grpsite === "" || r.indexOf(grpsite) != -1)
return true;
return false;
}

// Gets whether the user is a global admin
// name=null means requests coming from the local replicator, so we must allow
// (the cms couch auth does not allow name=null, so it affects only internal
// replication requests)
var isGlobalAdm = (userCtx.name === null)
|| matchesRole("_admin", "")
|| matchesRole("-admin", "group:couchdb");

//---------------------------------
// Authorization rules for Myapp DB

// The following rule aplies for all operation types
var allowed = isGlobalAdm || matchesRole("admin", "group:reqmgr")
|| matchesRole("web-service", "group:facops")
|| matchesRole("production-operator", "group:dataops");

// Throw if user not validated
if(!allowed) {
log(toJSON(userCtx));
throw {forbidden: "User not authorized for action."};
}
}
47 changes: 1 addition & 46 deletions src/couchapps/T0Request/validate_doc_update.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,49 +3,4 @@ function(newDoc, oldDoc, userCtx) {
var DOCOPS = { modif:0, creat:1, delet:2 };
var docOp = oldDoc ? (newDoc._deleted === true ? DOCOPS.delet : DOCOPS.modif)
: DOCOPS.creat;

// Function to get the user list of site/groups for the given role
var getRole = function(role) {
var roles = userCtx.roles;
for (i in roles) {
if(typeof(roles[i]) == "object" && roles[i][0] === role)
return roles[i][1]; // Request comes from backend auth handler
if(typeof(roles[i]) == "string" && roles[i] === role)
return []; // Request comes from other handlers (i.e. host auth)
}
return null;
};

// Function to check if user has the role for a given group or site
var matchesRole = function(role, grpsite) {
var r = getRole(role);
if (r != null)
if (grpsite === "" || r.indexOf(grpsite) != -1)
return true;
return false;
};

// Gets whether the user is a global admin
// name=null means requests coming from the local replicator, so we must allow
// (the cms couch auth does not allow name=null, so it affects only internal
// replication requests)
var isGlobalAdm = (userCtx.name === null)
|| matchesRole("admin", "")
|| matchesRole("_admin", "")
|| matchesRole("-admin", "group:couchdb");

//---------------------------------
// Authorization rules for Myapp DB

// The following rule aplies for all operation types
var allowed = isGlobalAdm || matchesRole("admin", "group:reqmgr")
|| matchesRole("web-service", "group:facops")
|| matchesRole("t0-operator","group:dataops")
|| matchesRole("production-operator", "group:dataops");

// Throw if user not validated
if(!allowed) {
log(toJSON(userCtx));
throw {forbidden: "User not authorized for action."};
}
};
}
43 changes: 0 additions & 43 deletions src/couchapps/WMStats/validate_doc_update.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,47 +7,4 @@ function(newDoc, oldDoc, userCtx) {
if (newDoc._deleted === true && !oldDoc) {
throw({forbidden: 'Do not create deleted docs'});
}

// Function to get the user list of site/groups for the given role
var getRole = function(role) {
var roles = userCtx.roles;
for (i in roles) {
if(typeof(roles[i]) == "object" && roles[i][0] === role)
return roles[i][1]; // Request comes from backend auth handler
if(typeof(roles[i]) == "string" && roles[i] === role)
return []; // Request comes from other handlers (i.e. host auth)
}
return null;
};
// Function to check if user has the role for a given group or site
var matchesRole = function(role, grpsite) {
var r = getRole(role);
if (r != null)
if (grpsite === "" || r.indexOf(grpsite) != -1)
return true;
return false;
};

// Gets whether the user is a global admin
// name=null means requests coming from the local replicator, so we must allow
// (the cms couch auth does not allow name=null, so it affects only internal
// replication requests)
var isGlobalAdm = (userCtx.name === null)
|| matchesRole("admin","")
|| matchesRole("_admin","")
|| matchesRole("-admin","group:couchdb");

//---------------------------------
// Authorization rules for Myapp DB

// The following rule aplies for all operation types
var allowed = isGlobalAdm || matchesRole("web-service","group:facops")
|| matchesRole("t0-operator","group:dataops")
|| matchesRole("production-operator","group:dataops");

// Throw if user not validated
if(!allowed) {
log(toJSON(userCtx));
throw {forbidden: "User not authorized for action."};
}
}
32 changes: 0 additions & 32 deletions src/couchapps/WMStatsAgent/validate_doc_update.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,36 +7,4 @@ function(newDoc, oldDoc, userCtx) {
if (newDoc._deleted === true && !oldDoc) {
throw({forbidden: 'Do not create deleted docs'});
}

// Function to get the user list of site/groups for the given role
var getRole = function(role) {
var roles = userCtx.roles;
for (i in roles) {
if(typeof(roles[i]) == "object" && roles[i][0] === role)
return roles[i][1]; // Request comes from backend auth handler
if(typeof(roles[i]) == "string" && roles[i] === role)
return []; // Request comes from other handlers (i.e. host auth)
}
return null;
};
// Function to check if user has the role for a given group or site
var matchesRole = function(role, grpsite) {
var r = getRole(role);
if (r != null)
if (grpsite === "" || r.indexOf(grpsite) != -1)
return true;
return false;
};

// Gets whether the user is a global admin
// name=null means requests coming from the local replicator, so we must allow
// (the cms couch auth does not allow name=null, so it affects only internal
// replication requests)
var allowed = (userCtx.name === null) || matchesRole("_admin","");

// Throw if user not validated
if(!allowed) {
log(toJSON(userCtx));
throw {forbidden: "User not authorized for action."};
}
}
17 changes: 0 additions & 17 deletions src/couchapps/WorkQueue/validate_doc_update.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,4 @@ function(newDoc, oldDoc, userCtx) {
throw({forbidden: 'Do not create deleted docs'});
}

var validation = require("lib/validate").init(newDoc, oldDoc, userCtx);

// Admins can do anything
if (validation.isAdmin()) {
return true;
}

// Either Developer or DataOps Operator/Manager required
if (validation.hasGroupRole("dataops", "developer") ||
validation.hasGroupRole("dataops", "production-operator") ||
validation.hasGroupRole("facops", "web-service")) {
return true;
}

// authentication failed
log("Authentication failed: " + toJSON(userCtx));
throw {forbidden: "User not validated for action"};
}
24 changes: 3 additions & 21 deletions src/couchapps/WorkloadSummary/validate_doc_update.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,25 +2,7 @@ function(newDoc, oldDoc, userCtx) {
// We only care if the user is someone with the correct permissions
// there is no difference between creating a new doc or updating an old one

var validation = require("lib/validate").init(newDoc, oldDoc, userCtx);

// Gets whether the user is a global admin
// name=null means requests coming from the local replicator, so we must allow
// (the cms couch auth does not allow name=null, so it affects only internal requests)
var isGlobalAdm = (userCtx.name === null)

// Admins can do anything
if (validation.isAdmin() || isGlobalAdm) {
return true;
}

// Either Developer or DataOps Operator/Manager required
if (validation.hasGroupRole("dataops", "developer") ||
validation.hasGroupRole("dataops", "production-operator")) {
return true;
}

// authentication failed
log("Authentication failed: " + toJSON(userCtx));
throw {forbidden: "User not validated for action"};
if (newDoc._deleted === true && !oldDoc) {
throw({forbidden: 'Do not create deleted docs'});
}
}
Loading