OrgGo/Mainflux.mainflux
1
0
Fork 0
mirror of https://github.com/mainflux/mainflux.git synced 2025-04-28 13:48:49 +08:00
Code Issues Projects Releases Wiki Activity

NOISSUE - Enable OwnerID Filtering For Admin (#1857)

Browse Source 
* Enable OwnerID Filtering For Admin

Signed-off-by: rodneyosodo <blackd0t@protonmail.com>

* Update things/clients/service.go

Co-authored-by: Sammy Kerata Oina <44265300+SammyOina@users.noreply.github.com>
Signed-off-by: rodneyosodo <blackd0t@protonmail.com>

* Update things/clients/service.go

Co-authored-by: Sammy Kerata Oina <44265300+SammyOina@users.noreply.github.com>
Signed-off-by: rodneyosodo <blackd0t@protonmail.com>

* Update things/clients/service.go

Co-authored-by: Sammy Kerata Oina <44265300+SammyOina@users.noreply.github.com>
Signed-off-by: rodneyosodo <blackd0t@protonmail.com>

* Update things/clients/service.go

Co-authored-by: Sammy Kerata Oina <44265300+SammyOina@users.noreply.github.com>
Signed-off-by: rodneyosodo <blackd0t@protonmail.com>

* Combine the Switch Statement

Signed-off-by: rodneyosodo <blackd0t@protonmail.com>

---------

Signed-off-by: rodneyosodo <blackd0t@protonmail.com>
Co-authored-by: Sammy Kerata Oina <44265300+SammyOina@users.noreply.github.com>
This commit is contained in:
b1ackd0t 2023-07-13 17:27:57 +03:00 committed by GitHub
parent 726e358187
commit aee0081864
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
11 changed files with 110 additions and 69 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
api/openapi/things.yml
View File

@ -1483,7 +1483,7 @@ components:
example: 'admin@example.com' example: 'admin@example.com'
Owner: Owner:
name: owner name: owner_id
description: Thing's owner. description: Thing's owner.
in: query in: query
schema: schema:

2
api/openapi/users.yml
View File

@ -1477,7 +1477,7 @@ components:
example: 'admin@example.com' example: 'admin@example.com'
Owner: Owner:
name: owner name: owner_id
description: User's owner. description: User's owner.
in: query in: query
schema: schema:

22
pkg/groups/page.go
View File

@ -4,16 +4,14 @@ import "github.com/mainflux/mainflux/pkg/clients"
// Page contains page metadata that helps navigation. // Page contains page metadata that helps navigation.
type Page struct { type Page struct {
Total uint64 `json:"total"` Total uint64 `json:"total"`
Offset uint64 `json:"offset"` Offset uint64 `json:"offset"`
Limit uint64 `json:"limit"` Limit uint64 `json:"limit"`
Name string `json:"name,omitempty"` Name string `json:"name,omitempty"`
OwnerID string `json:"identity,omitempty"` OwnerID string `json:"identity,omitempty"`
Tag string `json:"tag,omitempty"` Tag string `json:"tag,omitempty"`
Metadata clients.Metadata `json:"metadata,omitempty"` Metadata clients.Metadata `json:"metadata,omitempty"`
SharedBy string `json:"shared_by,omitempty"` Status clients.Status `json:"status,omitempty"`
Status clients.Status `json:"status,omitempty"` Subject string `json:"subject,omitempty"`
Subject string `json:"subject,omitempty"` Action string `json:"action,omitempty"`
Action string `json:"action,omitempty"`
Disconnected bool `json:"disconnected,omitempty"` // Used for connected or disconnected lists
} }

23
things/clients/api/transport.go
View File

@ -120,7 +120,7 @@ func decodeViewClient(_ context.Context, r *http.Request) (interface{}, error) {
} }
func decodeListClients(_ context.Context, r *http.Request) (interface{}, error) { func decodeListClients(_ context.Context, r *http.Request) (interface{}, error) {
var sid, oid string var sharedID, ownerID string
s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefClientStatus) s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefClientStatus)
if err != nil { if err != nil {
return nil, err return nil, err
@ -145,18 +145,25 @@ func decodeListClients(_ context.Context, r *http.Request) (interface{}, error)
if err != nil { if err != nil {
return nil, err return nil, err
} }
visibility, err := apiutil.ReadStringQuery(r, api.VisibilityKey, api.MyVisibility) oid, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
if err != nil {
return nil, err
}
visibility, err := apiutil.ReadStringQuery(r, api.VisibilityKey, "")
if err != nil { if err != nil {
return nil, err return nil, err
} }
switch visibility { switch visibility {
case api.MyVisibility: case api.MyVisibility:
oid = api.MyVisibility ownerID = api.MyVisibility
case api.SharedVisibility: case api.SharedVisibility:
sid = api.MyVisibility sharedID = api.MyVisibility
case api.AllVisibility: case api.AllVisibility:
sid = api.MyVisibility sharedID = api.MyVisibility
oid = api.MyVisibility ownerID = api.MyVisibility
}
if oid != "" {
ownerID = oid
} }
st, err := mfclients.ToStatus(s) st, err := mfclients.ToStatus(s)
if err != nil { if err != nil {
@ -170,8 +177,8 @@ func decodeListClients(_ context.Context, r *http.Request) (interface{}, error)
metadata: m, metadata: m,
name: n, name: n,
tag: t, tag: t,
sharedBy: sid, sharedBy: sharedID,
owner: oid, owner: ownerID,
} }
return req, nil return req, nil
} }

42
things/clients/service.go
View File

@ -99,23 +99,37 @@ func (svc service) ListClients(ctx context.Context, token string, pm mfclients.P
return mfclients.ClientsPage{}, err return mfclients.ClientsPage{}, err
} }
switch err = svc.checkAdmin(ctx, userID, thingsObjectKey, listRelationKey); err {
// If the user is admin, fetch all things from database. // If the user is admin, fetch all things from database.
if err := svc.checkAdmin(ctx, userID, thingsObjectKey, listRelationKey); err == nil { case nil:
pm.Owner = "" switch {
pm.SharedBy = "" case pm.SharedBy == MyKey && pm.Owner == MyKey:
return svc.clients.RetrieveAll(ctx, pm) pm.SharedBy = ""
} pm.Owner = ""
case pm.SharedBy == MyKey && pm.Owner != MyKey:
pm.SharedBy = userID
case pm.Owner == MyKey && pm.SharedBy != MyKey:
pm.Owner = userID
}
// If the user is not admin, check 'sharedby' parameter from page metadata. default:
// If user provides 'sharedby' key, fetch things from policies. Otherwise, // If the user is not admin, check 'sharedby' parameter from page metadata.
// fetch things from the database based on thing's 'owner' field. // If user provides 'sharedby' key, fetch things from policies. Otherwise,
if pm.SharedBy == MyKey { // fetch things from the database based on thing's 'owner' field.
pm.SharedBy = userID switch {
case pm.SharedBy == MyKey && pm.Owner == MyKey:
pm.SharedBy = userID
case pm.SharedBy == MyKey && pm.Owner != MyKey:
pm.SharedBy = userID
pm.Owner = ""
case pm.Owner == MyKey && pm.SharedBy != MyKey:
pm.Owner = userID
default:
pm.Owner = userID
}
pm.Action = listRelationKey
} }
if pm.Owner == MyKey {
pm.Owner = userID
}
pm.Action = "c_list"
return svc.clients.RetrieveAll(ctx, pm) return svc.clients.RetrieveAll(ctx, pm)
} }

7
things/groups/postgres/groups.go
View File

@ -282,7 +282,12 @@ func buildQuery(gm mfgroups.GroupsPage) (string, error) {
if gm.Status != mfclients.AllStatus { if gm.Status != mfclients.AllStatus {
queries = append(queries, "g.status = :status") queries = append(queries, "g.status = :status")
} }
if gm.OwnerID != "" {
queries = append(queries, "g.owner_id = :owner_id")
}
if gm.Tag != "" {
queries = append(queries, ":tag = ANY(c.tags)")
}
if gm.Subject != "" { if gm.Subject != "" {
queries = append(queries, "(g.owner_id = :owner_id OR id IN (SELECT object as id FROM policies WHERE subject = :subject AND :action=ANY(actions)))") queries = append(queries, "(g.owner_id = :owner_id OR id IN (SELECT object as id FROM policies WHERE subject = :subject AND :action=ANY(actions)))")
} }

6
things/groups/redis/events.go
View File

@ -213,9 +213,6 @@ func (lce listGroupEvent) Encode() (map[string]interface{}, error) {
val["metadata"] = metadata val["metadata"] = metadata
} }
if lce.SharedBy != "" {
val["sharedBy"] = lce.SharedBy
}
if lce.Status.String() != "" { if lce.Status.String() != "" {
val["status"] = lce.Status.String() val["status"] = lce.Status.String()
} }
@ -260,9 +257,6 @@ func (lcge listGroupMembershipEvent) Encode() (map[string]interface{}, error) {
val["metadata"] = metadata val["metadata"] = metadata
} }
if lcge.SharedBy != "" {
val["shared_by"] = lcge.SharedBy
}
if lcge.Status.String() != "" { if lcge.Status.String() != "" {
val["status"] = lcge.Status.String() val["status"] = lcge.Status.String()
} }

7
things/groups/service.go
View File

@ -93,11 +93,7 @@ func (svc service) ListGroups(ctx context.Context, token string, gm groups.Group
// If the user is admin, fetch all channels from the database. // If the user is admin, fetch all channels from the database.
if err := svc.authorize(ctx, userID, thingsObjectKey, listRelationKey); err == nil { if err := svc.authorize(ctx, userID, thingsObjectKey, listRelationKey); err == nil {
page, err := svc.groups.RetrieveAll(ctx, gm) return svc.groups.RetrieveAll(ctx, gm)
if err != nil {
return groups.GroupsPage{}, err
}
return page, err
} }
gm.Subject = userID gm.Subject = userID
@ -118,6 +114,7 @@ func (svc service) ListMemberships(ctx context.Context, token, clientID string,
} }
gm.OwnerID = userID gm.OwnerID = userID
gm.Action = listRelationKey
return svc.groups.Memberships(ctx, clientID, gm) return svc.groups.Memberships(ctx, clientID, gm)
} }

23
users/clients/api/transport.go
View File

@ -162,7 +162,7 @@ func decodeViewProfile(_ context.Context, r *http.Request) (interface{}, error)
} }
func decodeListClients(_ context.Context, r *http.Request) (interface{}, error) { func decodeListClients(_ context.Context, r *http.Request) (interface{}, error) {
var sid, oid string var sharedID, ownerID string
s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefClientStatus) s, err := apiutil.ReadStringQuery(r, api.StatusKey, api.DefClientStatus)
if err != nil { if err != nil {
return nil, err return nil, err
@ -192,18 +192,25 @@ func decodeListClients(_ context.Context, r *http.Request) (interface{}, error)
if err != nil { if err != nil {
return nil, err return nil, err
} }
visibility, err := apiutil.ReadStringQuery(r, api.VisibilityKey, api.MyVisibility) oid, err := apiutil.ReadStringQuery(r, api.OwnerKey, "")
if err != nil {
return nil, err
}
visibility, err := apiutil.ReadStringQuery(r, api.VisibilityKey, "")
if err != nil { if err != nil {
return nil, err return nil, err
} }
switch visibility { switch visibility {
case api.MyVisibility: case api.MyVisibility:
oid = api.MyVisibility ownerID = api.MyVisibility
case api.SharedVisibility: case api.SharedVisibility:
sid = api.MyVisibility sharedID = api.MyVisibility
case api.AllVisibility: case api.AllVisibility:
sid = api.MyVisibility sharedID = api.MyVisibility
oid = api.MyVisibility ownerID = api.MyVisibility
}
if oid != "" {
ownerID = oid
} }
st, err := mfclients.ToStatus(s) st, err := mfclients.ToStatus(s)
if err != nil { if err != nil {
@ -218,8 +225,8 @@ func decodeListClients(_ context.Context, r *http.Request) (interface{}, error)
name: n, name: n,
identity: i, identity: i,
tag: t, tag: t,
sharedBy: sid, sharedBy: sharedID,
owner: oid, owner: ownerID,
} }
return req, nil return req, nil
} }

38
users/clients/service.go
View File

@ -163,19 +163,33 @@ func (svc service) ListClients(ctx context.Context, token string, pm mfclients.P
return mfclients.ClientsPage{}, err return mfclients.ClientsPage{}, err
} }
if pm.SharedBy == MyKey { switch err := svc.authorize(ctx, id, clientsObjectKey, listRelationKey); err {
pm.SharedBy = id // If the user is admin, fetch all users from database.
} case nil:
if pm.Owner == MyKey { switch {
pm.Owner = id case pm.SharedBy == MyKey && pm.Owner == MyKey:
} pm.SharedBy = ""
pm.Action = "c_list" pm.Owner = ""
case pm.SharedBy == MyKey && pm.Owner != MyKey:
pm.SharedBy = id
case pm.Owner == MyKey && pm.SharedBy != MyKey:
pm.Owner = id
}
// If the user is admin, fetch all things from database. // If the user is not admin, fetch users that they own or are shared with them.
if err := svc.authorize(ctx, id, clientsObjectKey, listRelationKey); err == nil { default:
pm.SharedBy = "" switch {
pm.Owner = "" case pm.SharedBy == MyKey && pm.Owner == MyKey:
pm.Action = "" pm.SharedBy = id
case pm.SharedBy == MyKey && pm.Owner != MyKey:
pm.SharedBy = id
pm.Owner = ""
case pm.Owner == MyKey && pm.SharedBy != MyKey:
pm.Owner = id
default:
pm.Owner = id
}
pm.Action = listRelationKey
} }
clients, err := svc.clients.RetrieveAll(ctx, pm) clients, err := svc.clients.RetrieveAll(ctx, pm)

7
users/groups/postgres/groups.go
View File

@ -295,7 +295,12 @@ func buildQuery(gm mfgroups.GroupsPage) (string, error) {
if gm.Status != mfclients.AllStatus { if gm.Status != mfclients.AllStatus {
queries = append(queries, "g.status = :status") queries = append(queries, "g.status = :status")
} }
if gm.OwnerID != "" {
queries = append(queries, "g.owner_id = :owner_id")
}
if gm.Tag != "" {
queries = append(queries, ":tag = ANY(c.tags)")
}
if gm.Subject != "" { if gm.Subject != "" {
queries = append(queries, "(g.owner_id = :owner_id OR id IN (SELECT object as id FROM policies WHERE subject = :subject AND :action=ANY(actions)))") queries = append(queries, "(g.owner_id = :owner_id OR id IN (SELECT object as id FROM policies WHERE subject = :subject AND :action=ANY(actions)))")
} }