forked from TrueCloudLab/policy-engine
df15b38c63
* Make changing state methods like AddMorphRuleChain, RemoveMorphRuleChain return transaction hash and VUB. Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>
121 lines
3.4 KiB
Go
121 lines
3.4 KiB
Go
package engine
|
|
|
|
import (
|
|
"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
|
|
"git.frostfs.info/TrueCloudLab/policy-engine/pkg/resource"
|
|
"github.com/nspcc-dev/neo-go/pkg/util"
|
|
)
|
|
|
|
type ChainRouter interface {
|
|
// IsAllowed returns status for the operation after all checks.
|
|
// The second return value signifies whether a matching rule was found.
|
|
IsAllowed(name chain.Name, reqTarget RequestTarget, r resource.Request) (status chain.Status, found bool, err error)
|
|
}
|
|
|
|
// LocalOverrideStorage is the interface to manage local overrides defined
|
|
// for a node. Local overrides have a higher priority than chains got from morph storage.
|
|
type LocalOverrideStorage interface {
|
|
AddOverride(name chain.Name, target Target, c *chain.Chain) (chain.ID, error)
|
|
|
|
GetOverride(name chain.Name, target Target, chainID chain.ID) (*chain.Chain, error)
|
|
|
|
RemoveOverride(name chain.Name, target Target, chainID chain.ID) error
|
|
|
|
ListOverrides(name chain.Name, target Target) ([]*chain.Chain, error)
|
|
|
|
DropAllOverrides(name chain.Name) error
|
|
}
|
|
|
|
type TargetType rune
|
|
|
|
const (
|
|
Namespace TargetType = 'n'
|
|
Container TargetType = 'c'
|
|
)
|
|
|
|
type Target struct {
|
|
Type TargetType
|
|
Name string
|
|
}
|
|
|
|
// RequestTarget combines several targets on which the request is performed.
|
|
type RequestTarget struct {
|
|
Namespace *Target
|
|
Container *Target
|
|
}
|
|
|
|
func NewRequestTargetWithNamespace(namespace string) RequestTarget {
|
|
nt := NamespaceTarget(namespace)
|
|
return RequestTarget{
|
|
Namespace: &nt,
|
|
}
|
|
}
|
|
|
|
func NewRequestTargetWithContainer(container string) RequestTarget {
|
|
ct := ContainerTarget(container)
|
|
return RequestTarget{
|
|
Container: &ct,
|
|
}
|
|
}
|
|
|
|
func NewRequestTarget(namespace, container string) RequestTarget {
|
|
nt := NamespaceTarget(namespace)
|
|
ct := ContainerTarget(container)
|
|
return RequestTarget{
|
|
Namespace: &nt,
|
|
Container: &ct,
|
|
}
|
|
}
|
|
|
|
func (rt *RequestTarget) Targets() (targets []Target) {
|
|
if rt.Container != nil {
|
|
targets = append(targets, *rt.Container)
|
|
}
|
|
if rt.Namespace != nil {
|
|
targets = append(targets, *rt.Namespace)
|
|
}
|
|
return
|
|
}
|
|
|
|
func NamespaceTarget(namespace string) Target {
|
|
return Target{
|
|
Type: Namespace,
|
|
Name: namespace,
|
|
}
|
|
}
|
|
|
|
func ContainerTarget(container string) Target {
|
|
return Target{
|
|
Type: Container,
|
|
Name: container,
|
|
}
|
|
}
|
|
|
|
// MorphRuleChainStorage is the interface to manage chains from the chain storage.
|
|
// Basically, this implies that the storage manages rules stored in policy contract.
|
|
type MorphRuleChainStorage interface {
|
|
// AddMorphRuleChain adds a chain rule to the policy contract and returns transaction hash, VUB and error.
|
|
AddMorphRuleChain(name chain.Name, target Target, c *chain.Chain) (util.Uint256, uint32, error)
|
|
|
|
// RemoveMorphRuleChain removes a chain rule to the policy contract and returns transaction hash, VUB and error.
|
|
RemoveMorphRuleChain(name chain.Name, target Target, chainID chain.ID) (util.Uint256, uint32, error)
|
|
|
|
// ListMorphRuleChains just lists deserialized chains.
|
|
ListMorphRuleChains(name chain.Name, target Target) ([]*chain.Chain, error)
|
|
}
|
|
|
|
// Engine is the interface that provides methods to check request permissions checking
|
|
// chain rules from morph client - this implies using the policy contract.
|
|
type Engine interface {
|
|
ChainRouter
|
|
|
|
MorphRuleChainStorage() MorphRuleChainStorage
|
|
}
|
|
|
|
// LocalOverrideEngine is extended Engine that also provides methods to manage a local
|
|
// chain rule storage. Local overrides must have the highest priority during request checking.
|
|
type LocalOverrideEngine interface {
|
|
Engine
|
|
|
|
LocalStorage() LocalOverrideStorage
|
|
}
|