| OLD | NEW |
| 1 // Copyright 2015 The LUCI Authors. All rights reserved. | 1 // Copyright 2015 The LUCI Authors. All rights reserved. |
| 2 // Use of this source code is governed under the Apache License, Version 2.0 | 2 // Use of this source code is governed under the Apache License, Version 2.0 |
| 3 // that can be found in the LICENSE file. | 3 // that can be found in the LICENSE file. |
| 4 | 4 |
| 5 package auth | 5 package auth |
| 6 | 6 |
| 7 import ( | 7 import ( |
| 8 "errors" | 8 "errors" |
| 9 "fmt" | 9 "fmt" |
| 10 "net" | 10 "net" |
| 11 "net/http" | |
| 12 "strings" | 11 "strings" |
| 13 "time" | 12 "time" |
| 14 | 13 |
| 15 "github.com/julienschmidt/httprouter" | |
| 16 "golang.org/x/net/context" | 14 "golang.org/x/net/context" |
| 17 | 15 |
| 18 "github.com/luci/luci-go/common/clock" | 16 "github.com/luci/luci-go/common/clock" |
| 19 "github.com/luci/luci-go/common/lazyslot" | 17 "github.com/luci/luci-go/common/lazyslot" |
| 20 "github.com/luci/luci-go/common/logging" | 18 "github.com/luci/luci-go/common/logging" |
| 21 "github.com/luci/luci-go/common/mathrand" | 19 "github.com/luci/luci-go/common/mathrand" |
| 22 | 20 |
| 23 "github.com/luci/luci-go/server/auth/identity" | 21 "github.com/luci/luci-go/server/auth/identity" |
| 24 "github.com/luci/luci-go/server/auth/service/protocol" | 22 "github.com/luci/luci-go/server/auth/service/protocol" |
| 25 » "github.com/luci/luci-go/server/middleware" | 23 » "github.com/luci/luci-go/server/router" |
| 26 "github.com/luci/luci-go/server/secrets" | 24 "github.com/luci/luci-go/server/secrets" |
| 27 ) | 25 ) |
| 28 | 26 |
| 29 // ErrNoDB is returned by default DB returned from GetDB if no DBFactory is | 27 // ErrNoDB is returned by default DB returned from GetDB if no DBFactory is |
| 30 // installed in the context. | 28 // installed in the context. |
| 31 var ErrNoDB = errors.New("auth: using default auth.DB, install a properly mocked
one instead") | 29 var ErrNoDB = errors.New("auth: using default auth.DB, install a properly mocked
one instead") |
| 32 | 30 |
| 33 // DB is interface to access a database of authorization related information. | 31 // DB is interface to access a database of authorization related information. |
| 34 // | 32 // |
| 35 // It is static read only object that represent snapshot of auth data at some | 33 // It is static read only object that represent snapshot of auth data at some |
| (...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 79 | 77 |
| 80 // dbKey is used for context.Context key of DBFactory. | 78 // dbKey is used for context.Context key of DBFactory. |
| 81 type dbKey int | 79 type dbKey int |
| 82 | 80 |
| 83 // UseDB sets a factory that creates DB instances. | 81 // UseDB sets a factory that creates DB instances. |
| 84 func UseDB(c context.Context, f DBFactory) context.Context { | 82 func UseDB(c context.Context, f DBFactory) context.Context { |
| 85 return context.WithValue(c, dbKey(0), f) | 83 return context.WithValue(c, dbKey(0), f) |
| 86 } | 84 } |
| 87 | 85 |
| 88 // WithDB is middleware that sets given DBFactory in the context before calling | 86 // WithDB is middleware that sets given DBFactory in the context before calling |
| 89 // a handler. | 87 // the next handler. |
| 90 func WithDB(h middleware.Handler, f DBFactory) middleware.Handler { | 88 func WithDB(f DBFactory) router.Middleware { |
| 91 » return func(c context.Context, rw http.ResponseWriter, r *http.Request,
p httprouter.Params) { | 89 » return func(c *router.Context, next router.Handler) { |
| 92 » » h(UseDB(c, f), rw, r, p) | 90 » » c.Context = UseDB(c.Context, f) |
| 91 » » next(c) |
| 93 } | 92 } |
| 94 } | 93 } |
| 95 | 94 |
| 96 // GetDB returns most recent snapshot of authorization database using factory | 95 // GetDB returns most recent snapshot of authorization database using factory |
| 97 // installed in the context via `UseDB`. | 96 // installed in the context via `UseDB`. |
| 98 // | 97 // |
| 99 // If no factory is installed, returns DB that forbids everything and logs | 98 // If no factory is installed, returns DB that forbids everything and logs |
| 100 // errors. It is often good enough for unit tests that do not care about | 99 // errors. It is often good enough for unit tests that do not care about |
| 101 // authorization, and still not horribly bad if accidentally used in production. | 100 // authorization, and still not horribly bad if accidentally used in production. |
| 102 // | 101 // |
| (...skipping 346 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 449 // IP whitelist is a set of IP subnets. Unknown IP whitelists are considered | 448 // IP whitelist is a set of IP subnets. Unknown IP whitelists are considered |
| 450 // empty. May return errors if underlying datastore has issues. | 449 // empty. May return errors if underlying datastore has issues. |
| 451 func (db *SnapshotDB) IsInWhitelist(c context.Context, ip net.IP, whitelist stri
ng) (bool, error) { | 450 func (db *SnapshotDB) IsInWhitelist(c context.Context, ip net.IP, whitelist stri
ng) (bool, error) { |
| 452 for _, ipnet := range db.whitelists[whitelist] { | 451 for _, ipnet := range db.whitelists[whitelist] { |
| 453 if ipnet.Contains(ip) { | 452 if ipnet.Contains(ip) { |
| 454 return true, nil | 453 return true, nil |
| 455 } | 454 } |
| 456 } | 455 } |
| 457 return false, nil | 456 return false, nil |
| 458 } | 457 } |
| OLD | NEW |