tim/fluke
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

privileges 'x' for deploy, script, project

Browse Source
This commit is contained in:
amartynov 2014-07-14 10:54:00 +04:00
parent 8beaa22bbf
commit 4b603f680b
4 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
devops-service/db/mongo/models/user.rb
View File

@ -9,7 +9,8 @@ class User < MongoModel
ROOT_USER_NAME = 'root' ROOT_USER_NAME = 'root'
ROOT_PASSWORD = '' ROOT_PASSWORD = ''
PRIVILEGES = ["r", "w", "rw", ""] PRIVILEGES = ["r", "w", "x"]
PRIVILEGES_REGEX = /x?y?z?/
attr_accessor :id, :password, :privileges, :email attr_accessor :id, :password, :privileges, :email
types :id => {:type => String, :empty => false}, types :id => {:type => String, :empty => false},
@ -24,7 +25,7 @@ class User < MongoModel
end end
def all_privileges def all_privileges
privileges_with_value("rw") privileges_with_value("rwx")
end end
def default_privileges def default_privileges
@ -32,7 +33,9 @@ class User < MongoModel
end end
def grant cmd, priv='' def grant cmd, priv=''
raise InvalidCommand.new "Invalid privileges '#{priv}'. Available values are '#{PRIVILEGES.join("', '")}'" unless PRIVILEGES.include?(priv) if !priv.empty? and PRIVILEGES_REGEX.match(priv).empty?
raise InvalidCommand.new "Invalid privileges '#{priv}'. Available values are '#{PRIVILEGES.join("', '")}'"
end
raise InvalidCommand.new "Can't grant privileges to root" if self.id == ROOT_USER_NAME raise InvalidCommand.new "Can't grant privileges to root" if self.id == ROOT_USER_NAME
case cmd case cmd

2
devops-service/routes/v2.0/deploy.rb
View File

@ -34,7 +34,7 @@ module Version2_0
# * *Returns* : text stream # * *Returns* : text stream
post "/deploy" do post "/deploy" do
check_headers :content_type check_headers :content_type
check_privileges("server", "w") check_privileges("server", "x")
r = create_object_from_json_body r = create_object_from_json_body
names = check_array(r["names"], "Parameter 'names' should be a not empty array of strings") names = check_array(r["names"], "Parameter 'names' should be a not empty array of strings")
tags = check_array(r["tags"], "Parameter 'tags' should be an array of strings", String, true) || [] tags = check_array(r["tags"], "Parameter 'tags' should be an array of strings", String, true) || []

2
devops-service/routes/v2.0/project.rb
View File

@ -366,7 +366,7 @@ module Version2_0
# * *Returns* : text stream # * *Returns* : text stream
post "/project/:id/deploy" do post "/project/:id/deploy" do
check_headers :content_type check_headers :content_type
check_privileges("project", "w") check_privileges("project", "x")
obj = create_object_from_json_body obj = create_object_from_json_body
check_string(obj["deploy_env"], "Parameter 'deploy_env' should be a not empty string", true) check_string(obj["deploy_env"], "Parameter 'deploy_env' should be a not empty string", true)
check_array(obj["servers"], "Parameter 'servers' should be a not empty array of strings", String, true) check_array(obj["servers"], "Parameter 'servers' should be a not empty array of strings", String, true)

4
devops-service/routes/v2.0/script.rb
View File

@ -57,7 +57,7 @@ module Version2_0
# #
# * *Returns* : text stream # * *Returns* : text stream
post "/script/command/:node_name" do post "/script/command/:node_name" do
check_privileges("script", "w") check_privileges("script", "x")
user = request.env['REMOTE_USER'] user = request.env['REMOTE_USER']
s = BaseRoutes.mongo.server_by_chef_node_name params[:node_name] s = BaseRoutes.mongo.server_by_chef_node_name params[:node_name]
BaseRoutes.mongo.check_project_auth s.project, s.deploy_env, user BaseRoutes.mongo.check_project_auth s.project, s.deploy_env, user
@ -96,7 +96,7 @@ module Version2_0
# * *Returns* : text stream # * *Returns* : text stream
post "/script/run/:script_name" do post "/script/run/:script_name" do
check_headers :content_type check_headers :content_type
check_privileges("script", "w") check_privileges("script", "x")
file_name = params[:script_name] file_name = params[:script_name]
@file = File.join(DevopsService.config[:scripts_dir], check_filename(file_name, "Parameter 'script_name' must be a not empty string", false)) @file = File.join(DevopsService.config[:scripts_dir], check_filename(file_name, "Parameter 'script_name' must be a not empty string", false))
halt(404, "File '#{file_name}' does not exist") unless File.exists?(@file) halt(404, "File '#{file_name}' does not exist") unless File.exists?(@file)