forked from TrueCloudLab/frostfs-node
89 lines
2.6 KiB
Go
89 lines
2.6 KiB
Go
package control
|
|
|
|
import (
|
|
"encoding/hex"
|
|
|
|
"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/rpc/client"
|
|
"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/key"
|
|
"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/modules/util"
|
|
commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
|
|
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/control"
|
|
apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
const (
|
|
ruleFlag = "rule"
|
|
)
|
|
|
|
var addRuleCmd = &cobra.Command{
|
|
Use: "add-rule",
|
|
Short: "Add local override",
|
|
Long: "Add local APE rule to a node with following format:\n<action>[:action_detail] <operation> [<condition1> ...] <resource>",
|
|
Example: `control add-rule --endpoint ... -w ... --address ... --chain-id ChainID --cid ... --rule "allow Object.Get *"
|
|
--rule "deny Object.Get EbxzAdz5LB4uqxuz6crWKAumBNtZyK2rKsqQP7TdZvwr/*"
|
|
--rule "deny:QuotaLimitReached Object.Put Object.Resource:Department=HR *"
|
|
`,
|
|
Run: addRule,
|
|
}
|
|
|
|
func addRule(cmd *cobra.Command, _ []string) {
|
|
pk := key.Get(cmd)
|
|
|
|
target := parseTarget(cmd)
|
|
|
|
chainID, _ := cmd.Flags().GetString(chainIDFlag)
|
|
hexEncoded, _ := cmd.Flags().GetBool(chainIDHexFlag)
|
|
|
|
chainIDRaw := []byte(chainID)
|
|
|
|
if hexEncoded {
|
|
var err error
|
|
chainIDRaw, err = hex.DecodeString(chainID)
|
|
commonCmd.ExitOnErr(cmd, "can't decode chain ID as hex: %w", err)
|
|
}
|
|
|
|
rule, _ := cmd.Flags().GetStringArray(ruleFlag)
|
|
|
|
chain := new(apechain.Chain)
|
|
commonCmd.ExitOnErr(cmd, "parser error: %w", util.ParseAPEChain(chain, rule))
|
|
chain.ID = apechain.ID(chainIDRaw)
|
|
serializedChain := chain.Bytes()
|
|
|
|
cmd.Println("Parsed chain:")
|
|
util.PrintHumanReadableAPEChain(cmd, chain)
|
|
|
|
req := &control.AddChainLocalOverrideRequest{
|
|
Body: &control.AddChainLocalOverrideRequest_Body{
|
|
Target: target,
|
|
Chain: serializedChain,
|
|
},
|
|
}
|
|
|
|
signRequest(cmd, pk, req)
|
|
|
|
cli := getClient(cmd, pk)
|
|
|
|
var resp *control.AddChainLocalOverrideResponse
|
|
var err error
|
|
err = cli.ExecRaw(func(client *client.Client) error {
|
|
resp, err = control.AddChainLocalOverride(client, req)
|
|
return err
|
|
})
|
|
commonCmd.ExitOnErr(cmd, "rpc error: %w", err)
|
|
|
|
verifyResponse(cmd, resp.GetSignature(), resp.GetBody())
|
|
cmd.Println("\nRule has been added.")
|
|
}
|
|
|
|
func initControlAddRuleCmd() {
|
|
initControlFlags(addRuleCmd)
|
|
|
|
ff := addRuleCmd.Flags()
|
|
ff.StringArray(ruleFlag, []string{}, "Rule statement")
|
|
ff.String(chainIDFlag, "", "Assign ID to the parsed chain")
|
|
ff.String(targetNameFlag, "", targetNameDesc)
|
|
ff.String(targetTypeFlag, "", targetTypeDesc)
|
|
_ = addRuleCmd.MarkFlagRequired(targetTypeFlag)
|
|
ff.Bool(chainIDHexFlag, false, "Flag to parse chain ID as hex")
|
|
}
|