From dc43901a73fdd2b9d063ef9e2f3a438bfa426ca0 Mon Sep 17 00:00:00 2001 From: Leonid Kaganov Date: Fri, 17 Oct 2025 11:41:55 +0300 Subject: [PATCH] fix: key parameter added Signed-off-by: Leonid Kaganov --- .gitignore | 2 ++ Cargo.lock | 2 +- Cargo.toml | 2 +- permit.repo => policy.repo | 1 + src/config.rs | 2 +- src/handlers_http.rs | 8 ++++---- src/handlers_ws.rs | 11 ++++++++++- src/workspace_owner.rs | 11 ++++++----- 8 files changed, 26 insertions(+), 13 deletions(-) rename permit.repo => policy.repo (78%) diff --git a/.gitignore b/.gitignore index 9637afea5e..543c428394 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,5 @@ DROP_DB.sh TODO.txt DOCKER.sh /lleo +/client +/scripts diff --git a/Cargo.lock b/Cargo.lock index a18099e421..41ee1ef8c0 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1310,7 +1310,7 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9" [[package]] name = "hulypulse" -version = "0.1.31" +version = "0.1.32" dependencies = [ "actix", "actix-cors", diff --git a/Cargo.toml b/Cargo.toml index 7b03b63262..4b7420c092 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "hulypulse" -version = "0.1.31" +version = "0.1.32" edition = "2024" [dependencies] diff --git a/permit.repo b/policy.repo similarity index 78% rename from permit.repo rename to policy.repo index 7344d76fcd..0888019a93 100644 --- a/permit.repo +++ b/policy.repo @@ -2,5 +2,6 @@ default permit = true #permit if { # input.command == "Get" +# contains(input.key, "/typing/") # input.claim.workspace == "00000000-0000-0000-0000-000000000001" #} diff --git a/src/config.rs b/src/config.rs index b5b6801303..0da65cb145 100644 --- a/src/config.rs +++ b/src/config.rs @@ -59,7 +59,7 @@ pub struct Config { pub heartbeat_timeout: u64, - pub permit_file: Option, + pub policy_file: Option, } pub static CONFIG: LazyLock = LazyLock::new(|| { diff --git a/src/handlers_http.rs b/src/handlers_http.rs index 1a5a59b256..4de72250e4 100644 --- a/src/handlers_http.rs +++ b/src/handlers_http.rs @@ -68,7 +68,7 @@ pub async fn list( let key = format!("{}/{}", ¶ms.workspace, ¶ms.key); trace!(key, "list request"); - if !CONFIG.no_authorization && !test_rego_http(req, "List") { + if !CONFIG.no_authorization && !test_rego_http(req, "List", &key) { return Err(actix_web::error::ErrorForbidden("forbidden")); } @@ -86,7 +86,7 @@ pub async fn get( let key = format!("{}/{}", ¶ms.workspace, ¶ms.key); trace!(key, "get request"); - if !CONFIG.no_authorization && !test_rego_http(req, "Get") { + if !CONFIG.no_authorization && !test_rego_http(req, "Get", &key) { return Err(actix_web::error::ErrorForbidden("forbidden")); } @@ -119,7 +119,7 @@ pub async fn put( let key = format!("{}/{}", ¶ms.workspace, ¶ms.key); trace!(key, "put request"); - if !CONFIG.no_authorization && !test_rego_http(req, "Put") { + if !CONFIG.no_authorization && !test_rego_http(req, "Put", &key) { return Err(actix_web::error::ErrorForbidden("forbidden")); } @@ -171,7 +171,7 @@ pub async fn delete( let key = format!("{}/{}", ¶ms.workspace, ¶ms.key); trace!(key, "delete request"); - if !CONFIG.no_authorization && !test_rego_http(req, "Delete") { + if !CONFIG.no_authorization && !test_rego_http(req, "Delete", &key) { return Err(actix_web::error::ErrorForbidden("forbidden")); } diff --git a/src/handlers_ws.rs b/src/handlers_ws.rs index 98880dded0..5bda8a1bca 100644 --- a/src/handlers_ws.rs +++ b/src/handlers_ws.rs @@ -217,8 +217,17 @@ impl StreamHandler> for WsSession { // let x = self.claims.unwrap().as_ref(); // ); if !CONFIG.no_authorization { + let key = match &cmd { + WsCommand::Put { key, .. } + | WsCommand::Delete { key, .. } + | WsCommand::Get { key, .. } + | WsCommand::List { key, .. } + | WsCommand::Sub { key, .. } + | WsCommand::Unsub { key, .. } => key.as_str(), + _ => "", + }; if let Some(ref claim) = self.claims { - if !test_rego_claims(claim, cmd.as_ref()) { + if !test_rego_claims(claim, cmd.as_ref(), &key) { ctx.text("Unauthorized: Rego policy"); ctx.stop(); return; diff --git a/src/workspace_owner.rs b/src/workspace_owner.rs index b25e5c5e0f..d477abfef6 100644 --- a/src/workspace_owner.rs +++ b/src/workspace_owner.rs @@ -57,33 +57,34 @@ pub fn check_workspace_core(claims_opt: Option, key: &str) -> Result<(), Ok(()) } -pub fn test_rego_claims(claim: &Claims, command: &str) -> bool { +pub fn test_rego_claims(claim: &Claims, command: &str, key: &str) -> bool { let data = serde_json::to_value(&claim).unwrap_or_default(); let mut rego = REGORUS_ENGINE.clone(); rego.set_input(regorus::Value::from(json!({ "command": command, "claim": data, + "key": key, }))); let result = rego.eval_rule(String::from("data.main.permit")).unwrap(); result == regorus::Value::Bool(true) } -pub fn test_rego_http(req: HttpRequest, command: &str) -> bool { +pub fn test_rego_http(req: HttpRequest, command: &str, key: &str) -> bool { let claims = req .extensions() .get::() .expect("Missing claims") .to_owned(); - test_rego_claims(&claims, command) + test_rego_claims(&claims, command, key) } pub static POLICY_TEXT: LazyLock = LazyLock::new(|| { - let Some(permit_file) = CONFIG.permit_file.as_ref() else { + let Some(policy_file) = CONFIG.policy_file.as_ref() else { return "package main\n\ndefault permit = true\n".to_string(); }; - let path = Path::new(permit_file); + let path = Path::new(policy_file); if !path.exists() { panic!("Policy file not found: {}", path.display()); }