Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for fmt.Stringer implementations in Go SDK Oso methods, or propagate a warning message in instances where a type defined string is passed as the action argument #1729

Open
nathan-fiscaletti opened this issue Nov 3, 2023 · 0 comments

Comments

@nathan-fiscaletti
Copy link

nathan-fiscaletti commented Nov 3, 2023

Methods such as the Authorize(actor interface{}, action interface{}, resource interface{}) method only accept direct string types as a value for the action parameter.

A common implementation of Oso is to create an enum defining available actions using a custom Action type. A very basic implementation of this might look something like this:

type Action string

const (
     Action_LoginMobile Action = "login_mobile"
     Action_LoginWeb    Action = "login_web"
)

func (a Action) String() string {
    return string(a)
}

However, if you pass one of these constants into the Authorize function, it will not properly detect whether or not the action is authorized. This is because the Authorize() function expects a string, not a custom type.

There is also no log message, warning or error indicating the mistake.


One possible solution to this would be to update the Authorize function to accept an implementation of the fmt.Stringer interface.

This might look something like this:

func Authorize(actor, action, resource interface{}) error {
	var actionStr string
	switch v := action.(type) {
	case string:
		actionStr = v
	case fmt.Stringer:
		actionStr = v.String()
	default:
		return fmt.Errorf("action must be either a valid string or implement the fmt.Stringer interface")
	}

	fmt.Printf("found action: %v\n", actionStr)
	return nil
}

. . .

err := Authorize(user, Action_LoginMobile, resource)

Alternately, simply providing an error or a warning indicating that the Authorization will fail due to an incorrect type being passed to the method would at least inform the caller that they need to be passing a string type, and not a type definition that resolves to a string.

@nathan-fiscaletti nathan-fiscaletti changed the title Add support for Stringer implementations in Oso methods, or propagate a warning message in instances where a type defined string is passed Add support for Stringer implementations in Go SDK Oso methods, or propagate a warning message in instances where a type defined string is passed Nov 3, 2023
@nathan-fiscaletti nathan-fiscaletti changed the title Add support for Stringer implementations in Go SDK Oso methods, or propagate a warning message in instances where a type defined string is passed Add support for fmt.Stringer implementations in Go SDK Oso methods, or propagate a warning message in instances where a type defined string is passed Nov 3, 2023
@nathan-fiscaletti nathan-fiscaletti changed the title Add support for fmt.Stringer implementations in Go SDK Oso methods, or propagate a warning message in instances where a type defined string is passed Add support for fmt.Stringer implementations in Go SDK Oso methods, or propagate a warning message in instances where a type defined string is passed as the action argument Nov 3, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant