package main import ( "fmt" "net/http" "regexp" "strings" "github.com/Luzifer/go_helpers/v2/str" ) type aclRule struct { Field string `yaml:"field"` Invert bool `yaml:"invert"` IsPresent *bool `yaml:"present"` MatchRegex *string `yaml:"regexp"` MatchString *string `yaml:"equals"` } func (a aclRule) Validate() error { if a.Field == "" { return fmt.Errorf("Field is not set") } if a.IsPresent == nil && a.MatchRegex == nil && a.MatchString == nil { return fmt.Errorf("No matcher (present, regexp, equals) is set") } if a.MatchRegex != nil { if _, err := regexp.Compile(*a.MatchRegex); err != nil { return fmt.Errorf("Regexp is invalid: %s", err) } } return nil } func (a aclRule) AppliesToFields(fields map[string]string) bool { var field, value string for f, v := range fields { if strings.ToLower(a.Field) == f { field = f value = v break } } if a.IsPresent != nil { if !a.Invert && *a.IsPresent && field == "" { // Field is expected to be present but isn't, rule does not apply return false } if !a.Invert && !*a.IsPresent && field != "" { // Field is expected not to be present but is, rule does not apply return false } if a.Invert && *a.IsPresent && field != "" { // Field is expected not to be present but is, rule does not apply return false } if a.Invert && !*a.IsPresent && field == "" { // Field is expected to be present but isn't, rule does not apply return false } return true } if field == "" { // We found a rule which has no matching field, rule does not apply return false } if a.MatchString != nil { if (*a.MatchString != value) == !a.Invert { // Value does not match expected string, rule does not apply return false } } if a.MatchRegex != nil { if regexp.MustCompile(*a.MatchRegex).MatchString(value) == a.Invert { // Value does not match expected regexp, rule does not apply return false } } return true } type aclAccessResult uint const ( accessDunno aclAccessResult = iota accessAllow accessDeny ) type aclRuleSet struct { Rules []aclRule `yaml:"rules"` Allow []string `yaml:"allow"` Deny []string `yaml:"deny"` } func (a aclRuleSet) buildFieldSet(r *http.Request) map[string]string { result := map[string]string{} for k := range r.Header { result[strings.ToLower(k)] = r.Header.Get(k) } return result } func (a aclRuleSet) HasAccess(user string, groups []string, r *http.Request) aclAccessResult { fields := a.buildFieldSet(r) for _, rule := range a.Rules { if !rule.AppliesToFields(fields) { // At least one rule does not match the request return accessDunno } } // All rules do apply to this request, we can judge if str.StringInSlice(user, a.Deny) { // Explicit deny, final result return accessDeny } if str.StringInSlice(user, a.Allow) { // Explicit allow, final result return accessAllow } for _, group := range groups { if str.StringInSlice("@"+group, a.Deny) { // Deny through group, final result return accessDeny } if str.StringInSlice("@"+group, a.Allow) { // Allow through group, final result return accessAllow } } if str.StringInSlice("@_authenticated", a.Allow) && user != "" { return accessAllow } // Neither user nor group are handled return accessDunno } func (a aclRuleSet) Validate() error { for i, r := range a.Rules { if err := r.Validate(); err != nil { return fmt.Errorf("Rule on position %d is invalid: %s", i+1, err) } } return nil } type acl struct { RuleSets []aclRuleSet `yaml:"rule_sets"` } func (a acl) Validate() error { for i, r := range a.RuleSets { if err := r.Validate(); err != nil { return fmt.Errorf("RuleSet on position %d is invalid: %s", i+1, err) } } return nil } func (a acl) HasAccess(user string, groups []string, r *http.Request) bool { result := accessDunno for _, rs := range a.RuleSets { if intermediateResult := rs.HasAccess(user, groups, r); intermediateResult > result { result = intermediateResult } } return result == accessAllow }