-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #492 from guardian/bump-pan-domain-auth
bump pan-domain-auth and permissions
- Loading branch information
Showing
8 changed files
with
132 additions
and
151 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,91 +1,76 @@ | ||
| package permissions | ||
|
|
||
| import com.gu.editorial.permissions.client.{PermissionAuthorisation, PermissionDenied, PermissionGranted} | ||
| import com.gu.permissions.PermissionDefinition | ||
| import com.gu.pandomainauth.action.UserRequest | ||
| import play.api.Logging | ||
| import play.api.mvc.{ActionFilter, Results} | ||
|
|
||
| import scala.concurrent.{Future, ExecutionContext} | ||
|
|
||
| trait PermissionActionFilter extends ActionFilter[UserRequest] with Logging { | ||
| val testAccess: String => Future[PermissionAuthorisation] | ||
| val testAccess: String => Boolean | ||
| val restrictedAction: String | ||
|
|
||
| override def filter[A](request: UserRequest[A]) = | ||
| if(request.user.email == "hmac-authed-service") { | ||
| if (request.user.email == "hmac-authed-service") { | ||
| Future.successful(None) | ||
| } else { | ||
| testAccess(request.user.email).map { | ||
| case PermissionGranted => None | ||
| case PermissionDenied => | ||
| logger.info(s"user not authorized to $restrictedAction") | ||
| Some(Results.Unauthorized)}(executionContext) | ||
| val hasAccess = testAccess(request.user.email) | ||
| if (hasAccess) { | ||
| Future.successful(None) | ||
| } else { | ||
| logger.info(s"user not authorized to $restrictedAction") | ||
| Future.successful(Some(Results.Unauthorized)) | ||
| } | ||
| } | ||
| } | ||
| abstract class BasePermissionCheck( | ||
| val permission: PermissionDefinition, | ||
| val restrictedAction: String | ||
| )(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
|
|
||
| // Tag Edit | ||
| case class CreateTagPermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.TagEdit) | ||
| val restrictedAction = "create tag" | ||
| val testAccess: String => Boolean = Permissions.testUser(permission) | ||
| } | ||
|
|
||
| case class UpdateTagPermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.TagEdit) | ||
| val restrictedAction = "update tag" | ||
| } | ||
| // Tag Edit | ||
| case class CreateTagPermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.TagEdit, "create tag") | ||
|
|
||
| case class UpdateTagPermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.TagEdit, "update tag") | ||
|
|
||
| // Tag Admin | ||
| case class AddEditionToSectionPermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.TagAdmin) | ||
| val restrictedAction = "add edition to section" | ||
| } | ||
|
|
||
| case class RemoveEditionFromSectionPermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.TagAdmin) | ||
| val restrictedAction = "remove edition from section" | ||
| } | ||
| case class AddEditionToSectionPermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.TagAdmin, "add edition to section") | ||
|
|
||
| case class DeleteTagPermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.TagAdmin) | ||
| val restrictedAction = "delete tag" | ||
| } | ||
| case class RemoveEditionFromSectionPermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.TagAdmin, "remove edition from section") | ||
|
|
||
| case class DeleteJobPermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.TagAdmin) | ||
| val restrictedAction = "delete job" | ||
| } | ||
| case class DeleteTagPermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.TagAdmin, "delete tag") | ||
|
|
||
| case class MergeTagPermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.TagAdmin) | ||
| val restrictedAction = "merge tag" | ||
| } | ||
| case class DeleteJobPermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.TagAdmin, "delete job") | ||
|
|
||
| case class JobDeletePermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.TagAdmin) | ||
| val restrictedAction = "job delete" | ||
| } | ||
| case class MergeTagPermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.TagAdmin, "merge tag") | ||
|
|
||
| case class JobRollbackPermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.TagAdmin) | ||
| val restrictedAction = "job rollback" | ||
| } | ||
| case class JobDeletePermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.TagAdmin, "job delete") | ||
|
|
||
| case class ModifySectionExpiryPermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.TagAdmin) | ||
| val restrictedAction = "trigger unexpiry of section content" | ||
| } | ||
| case class JobRollbackPermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.TagAdmin, "job rollback") | ||
|
|
||
| case class ManageSponsorshipsPermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.CommercialTags) | ||
| val restrictedAction = "manage sponsorships" | ||
| } | ||
| case class ModifySectionExpiryPermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.TagAdmin,"trigger unexpiry of section content") | ||
|
|
||
| case class TriggerMigrationPermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.TagAdmin) | ||
| val restrictedAction = "manage sponsorships" | ||
| } | ||
| // Other Permissions | ||
| case class ManageSponsorshipsPermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.CommercialTags, "manage sponsorships") | ||
|
|
||
| case class PillarPermissionsCheck()(implicit val executionContext: ExecutionContext) extends PermissionActionFilter { | ||
| val testAccess: String => Future[PermissionAuthorisation] = Permissions.testUser(Permissions.TagAdmin) | ||
| val restrictedAction = "manage pillars" | ||
| } | ||
| case class TriggerMigrationPermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.TagAdmin, "trigger migration") | ||
|
|
||
| case class PillarPermissionsCheck()(implicit executionContext: ExecutionContext) | ||
| extends BasePermissionCheck(Permissions.TagAdmin, "manage pillars") |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,40 +1,32 @@ | ||
| package permissions | ||
|
|
||
| import com.gu.editorial.permissions.client._ | ||
| import com.amazonaws.auth.{AWSCredentialsProvider, DefaultAWSCredentialsProviderChain} | ||
| import com.gu.permissions.{PermissionDefinition, PermissionsConfig, PermissionsProvider} | ||
| import services.Config | ||
|
|
||
| import scala.concurrent.Future | ||
| object Permissions { | ||
| val app = "tag-manager" | ||
|
|
||
| object Permissions extends PermissionsProvider { | ||
| val TagEdit: PermissionDefinition = PermissionDefinition("tag_edit", app) | ||
| val TagAdmin: PermissionDefinition = PermissionDefinition("tag_admin", app) | ||
| val CommercialTags: PermissionDefinition = PermissionDefinition("commercial_tags", app) | ||
| val TagUnaccessible: PermissionDefinition = PermissionDefinition("tag_no_one", app) | ||
|
|
||
| lazy val TagEdit = Permission("tag_edit", "tag-manager", PermissionDenied) | ||
| lazy val TagAdmin = Permission("tag_admin", "tag-manager", PermissionDenied) | ||
| lazy val CommercialTags = Permission("commercial_tags", "tag-manager", PermissionDenied) | ||
| lazy val TagUnaccessible = Permission("tag_no_one", "tag-manager", PermissionDenied) | ||
|
|
||
| lazy val all = Seq(TagAdmin) | ||
|
|
||
| implicit def config = PermissionsConfig( | ||
| app = "tag-manager", | ||
| all = all, | ||
| s3BucketPrefix = Config().permissionsStage, | ||
| s3Region = Some("eu-west-1") | ||
| private val permissionDefinitions = Map( | ||
| "tag_edit" -> TagEdit, | ||
| "tag_admin" -> TagAdmin, | ||
| "commercial_tags" -> CommercialTags, | ||
| "tag_no_one" -> TagUnaccessible | ||
| ) | ||
|
|
||
| def testUser(permission: Permission)(email: String): Future[PermissionAuthorisation] = { | ||
| println("Permissions for: " + email) | ||
| implicit val permissionsUser: PermissionsUser = PermissionsUser(email) | ||
|
|
||
| Permissions.get(permission) | ||
| } | ||
| private val credentials: AWSCredentialsProvider = new DefaultAWSCredentialsProviderChain() | ||
|
|
||
| def getPermissionsForUser(email: String): Future[Map[String, Boolean]] = { | ||
| implicit val permissionsUser: PermissionsUser = PermissionsUser(email) | ||
| private val permissions: PermissionsProvider = PermissionsProvider(PermissionsConfig(Config().permissionsStage, Config().aws.region, credentials)) | ||
|
|
||
| Permissions.list.map(_.filter(_._1.app == "tag-manager").flatMap( _ match { | ||
| case (p: Permission, PermissionGranted) => Map(p.name -> true) | ||
| case (p: Permission, PermissionDenied) => Map(p.name -> false) | ||
| })) | ||
| def testUser(permission:PermissionDefinition)(email: String): Boolean = { | ||
| println("Permissions for: " + email) | ||
| permissions.hasPermission(permission, email) | ||
| } | ||
| def getPermissionsForUser(email: String): Map[String, Boolean] = permissionDefinitions.transform((_, permission) => permissions.hasPermission(permission, email)) | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.