[#478] *: Fix funlen linter warnings

Signed-off-by: Evgenii Stratonikov <e.stratonikov@yadro.com>
This commit is contained in:
Evgenii Stratonikov 2023-06-28 14:10:06 +03:00 committed by Evgenii Stratonikov
parent 33d9ebbe7f
commit d0ab552a90

View file

@ -51,20 +51,10 @@ func (s *Service) verifyClient(req message, cid cidSDK.ID, rawBearer []byte, op
if err != nil { if err != nil {
return err return err
} }
if op == acl.OpObjectGet {
// verify if the request for a client operation isAuthorized, err := s.isAuthorized(req, op)
// was signed by a key from authorized list. if isAuthorized || err != nil {
// Operation must be one of READ. return err
sign := req.GetSignature()
if sign == nil {
return errors.New("missing signature")
}
var key = sign.GetKey()
for i := range s.authorizedKeys {
if bytes.Equal(s.authorizedKeys[i], key) {
return nil
}
}
} }
cnr, err := s.cnrSource.Get(cid) cnr, err := s.cnrSource.Get(cid)
@ -74,18 +64,9 @@ func (s *Service) verifyClient(req message, cid cidSDK.ID, rawBearer []byte, op
eaclOp := eACLOp(op) eaclOp := eACLOp(op)
var bt *bearer.Token bt, err := parseBearer(rawBearer, cid, eaclOp)
if len(rawBearer) > 0 { if err != nil {
bt = new(bearer.Token) return err
if err = bt.Unmarshal(rawBearer); err != nil {
return eACLErr(eaclOp, fmt.Errorf("invalid bearer token: %w", err))
}
if !bt.AssertContainer(cid) {
return eACLErr(eaclOp, errBearerWrongContainer)
}
if !bt.VerifySignature() {
return eACLErr(eaclOp, errBearerSignature)
}
} }
role, err := roleFromReq(cnr, req, bt) role, err := roleFromReq(cnr, req, bt)
@ -117,32 +98,65 @@ func (s *Service) verifyClient(req message, cid cidSDK.ID, rawBearer []byte, op
var tb eacl.Table var tb eacl.Table
signer := req.GetSignature().GetKey() signer := req.GetSignature().GetKey()
if tableFromBearer { if tableFromBearer && !bt.Impersonate() {
if bt.Impersonate() { if !bearer.ResolveIssuer(*bt).Equals(cnr.Value.Owner()) {
tbCore, err := s.eaclSource.GetEACL(cid) return eACLErr(eaclOp, errBearerWrongOwner)
if err != nil {
return handleGetEACLError(err)
}
tb = *tbCore.Value
signer = bt.SigningKeyBytes()
} else {
if !bearer.ResolveIssuer(*bt).Equals(cnr.Value.Owner()) {
return eACLErr(eaclOp, errBearerWrongOwner)
}
tb = bt.EACLTable()
} }
tb = bt.EACLTable()
} else { } else {
tbCore, err := s.eaclSource.GetEACL(cid) tbCore, err := s.eaclSource.GetEACL(cid)
if err != nil { if err != nil {
return handleGetEACLError(err) return handleGetEACLError(err)
} }
tb = *tbCore.Value tb = *tbCore.Value
if bt.Impersonate() {
signer = bt.SigningKeyBytes()
}
} }
return checkEACL(tb, signer, eACLRole(role), eaclOp) return checkEACL(tb, signer, eACLRole(role), eaclOp)
} }
// Returns true iff the operation is read-only and request was signed
// with one of the authorized keys.
func (s *Service) isAuthorized(req message, op acl.Op) (bool, error) {
if op != acl.OpObjectGet {
return false, nil
}
sign := req.GetSignature()
if sign == nil {
return false, errors.New("missing signature")
}
key := sign.GetKey()
for i := range s.authorizedKeys {
if bytes.Equal(s.authorizedKeys[i], key) {
return true, nil
}
}
return false, nil
}
func parseBearer(rawBearer []byte, cid cidSDK.ID, eaclOp eacl.Operation) (*bearer.Token, error) {
if len(rawBearer) == 0 {
return nil, nil
}
bt := new(bearer.Token)
if err := bt.Unmarshal(rawBearer); err != nil {
return nil, eACLErr(eaclOp, fmt.Errorf("invalid bearer token: %w", err))
}
if !bt.AssertContainer(cid) {
return nil, eACLErr(eaclOp, errBearerWrongContainer)
}
if !bt.VerifySignature() {
return nil, eACLErr(eaclOp, errBearerSignature)
}
return bt, nil
}
func handleGetEACLError(err error) error { func handleGetEACLError(err error) error {
if client.IsErrEACLNotFound(err) { if client.IsErrEACLNotFound(err) {
return nil return nil