update s3write permissions function to cover all permissions

Dewberry · May 10, 2024 · dced850 · dced850
1 parent 27f83ea
commit dced850
Show file tree

Hide file tree

Showing 7 changed files with 29 additions and 44 deletions.
diff --git a/auth/database.go b/auth/database.go
@@ -12,7 +12,7 @@ import (
 
 // Database interface abstracts database operations
 type Database interface {
-	CheckUserPermission(userEmail, prefix, bucket string, operations []string) bool
+	CheckUserPermission(userEmail, bucket, prefix string, operations []string) bool
 	Close() error
 	GetUserAccessiblePrefixes(userEmail, bucket string, operations []string) ([]string, error)
 }

diff --git a/blobstore/blobhandler.go b/blobstore/blobhandler.go
@@ -327,7 +327,7 @@ func (bh *BlobHandler) HandleCheckS3UserPermission(c echo.Context) error {
 		log.Error(errMsg.Error())
 		return c.JSON(http.StatusUnprocessableEntity, errMsg.Error())
 	}
-	isAllowed := bh.DB.CheckUserPermission(userEmail, prefix, bucket, []string{"write"})
+	isAllowed := bh.DB.CheckUserPermission(userEmail, bucket, prefix, []string{operation})
 	log.Info("Checked user permissions successfully")
 	return c.JSON(http.StatusOK, isAllowed)
 }
diff --git a/blobstore/blobstore.go b/blobstore/blobstore.go
@@ -81,7 +81,7 @@ func isIdenticalArray(array1, array2 []string) bool {
 	return true
 }
 
-func (bh *BlobHandler) CheckUserS3WritePermission(c echo.Context, bucket, prefix string) (int, error) {
+func (bh *BlobHandler) CheckUserS3Permission(c echo.Context, bucket, prefix string, permissions []string) (int, error) {
 	if bh.Config.AuthLevel > 0 {
 		claims, ok := c.Get("claims").(*auth.Claims)
 		if !ok {
@@ -95,7 +95,7 @@ func (bh *BlobHandler) CheckUserS3WritePermission(c echo.Context, bucket, prefix
 
 		// We assume if someone is limited_writer, they should never be admin or super_writer
 		if isLimitedWriter {
-			if !bh.DB.CheckUserPermission(ue, bucket, prefix, []string{"write"}) {
+			if !bh.DB.CheckUserPermission(ue, bucket, prefix, permissions) {
 				return http.StatusForbidden, fmt.Errorf("forbidden")
 			}
 		}

diff --git a/blobstore/metadata.go b/blobstore/metadata.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/Dewberry/s3api/auth"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/s3"
@@ -118,14 +117,11 @@ func (bh *BlobHandler) HandleGetMetaData(c echo.Context) error {
 		log.Error(errMsg.Error())
 		return c.JSON(http.StatusUnprocessableEntity, errMsg.Error())
 	}
-	claims, ok := c.Get("claims").(*auth.Claims)
-	if !ok {
-		return c.JSON(http.StatusInternalServerError, fmt.Errorf("could not get claims from request context"))
-	}
-	ue := claims.Email
-	canRead := bh.DB.CheckUserPermission(ue, key, bucket, []string{"read", "write"})
-	if !canRead {
-		return c.JSON(http.StatusForbidden, fmt.Errorf("user is not autherized").Error())
+	httpCode, err := bh.CheckUserS3Permission(c, bucket, key, []string{"write", "read"})
+	if err != nil {
+		errMsg := fmt.Errorf("error while checking for user permission: %s", err)
+		log.Error(errMsg.Error())
+		return c.JSON(httpCode, errMsg.Error())
 	}
 	result, err := s3Ctrl.GetMetaData(bucket, key)
 	if err != nil {
@@ -157,14 +153,11 @@ func (bh *BlobHandler) HandleGetObjExist(c echo.Context) error {
 		log.Error(errMsg.Error())
 		return c.JSON(http.StatusUnprocessableEntity, errMsg.Error())
 	}
-	claims, ok := c.Get("claims").(*auth.Claims)
-	if !ok {
-		return c.JSON(http.StatusInternalServerError, fmt.Errorf("could not get claims from request context"))
-	}
-	ue := claims.Email
-	canRead := bh.DB.CheckUserPermission(ue, key, bucket, []string{"read", "write"})
-	if !canRead {
-		return c.JSON(http.StatusForbidden, fmt.Errorf("user is not autherized").Error())
+	httpCode, err := bh.CheckUserS3Permission(c, bucket, key, []string{"write", "read"})
+	if err != nil {
+		errMsg := fmt.Errorf("error while checking for user permission: %s", err)
+		log.Error(errMsg.Error())
+		return c.JSON(httpCode, errMsg.Error())
 	}
 	// Proceed if the permission check passes
 	result, err := s3Ctrl.KeyExists(bucket, key)

diff --git a/blobstore/object_content.go b/blobstore/object_content.go
@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/Dewberry/s3api/auth"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/labstack/echo/v4"
@@ -54,14 +53,11 @@ func (bh *BlobHandler) HandleObjectContents(c echo.Context) error {
 		log.Error(errMsg.Error())
 		return c.JSON(http.StatusUnprocessableEntity, errMsg.Error())
 	}
-	claims, ok := c.Get("claims").(*auth.Claims)
-	if !ok {
-		return c.JSON(http.StatusInternalServerError, fmt.Errorf("could not get claims from request context"))
-	}
-	ue := claims.Email
-	canRead := bh.DB.CheckUserPermission(ue, key, bucket, []string{"read", "write"})
-	if !canRead {
-		return c.JSON(http.StatusForbidden, fmt.Errorf("user is not autherized").Error())
+	httpCode, err := bh.CheckUserS3Permission(c, bucket, key, []string{"write", "read"})
+	if err != nil {
+		errMsg := fmt.Errorf("error while checking for user permission: %s", err)
+		log.Error(errMsg.Error())
+		return c.JSON(httpCode, errMsg.Error())
 	}
 	body, err := s3Ctrl.FetchObjectContent(bucket, key)
 	if err != nil {

diff --git a/blobstore/presigned_url.go b/blobstore/presigned_url.go
@@ -14,7 +14,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/Dewberry/s3api/auth"
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/aws/aws-sdk-go/service/s3/s3manager"
@@ -130,14 +129,11 @@ func (bh *BlobHandler) HandleGetPresignedDownloadURL(c echo.Context) error {
 		log.Error("HandleGetPresignedURL: " + err.Error())
 		return c.JSON(http.StatusUnprocessableEntity, err.Error())
 	}
-	claims, ok := c.Get("claims").(*auth.Claims)
-	if !ok {
-		return c.JSON(http.StatusInternalServerError, fmt.Errorf("could not get claims from request context"))
-	}
-	ue := claims.Email
-	canRead := bh.DB.CheckUserPermission(ue, key, bucket, []string{"read", "write"})
-	if !canRead {
-		return c.JSON(http.StatusForbidden, fmt.Errorf("user is not autherized").Error())
+	httpCode, err := bh.CheckUserS3Permission(c, bucket, key, []string{"write", "read"})
+	if err != nil {
+		errMsg := fmt.Errorf("error while checking for user permission: %s", err)
+		log.Error(errMsg.Error())
+		return c.JSON(httpCode, errMsg.Error())
 	}
 	keyExist, err := s3Ctrl.KeyExists(bucket, key)
 	if err != nil {

diff --git a/blobstore/upload.go b/blobstore/upload.go
@@ -129,7 +129,7 @@ func (bh *BlobHandler) HandleMultipartUpload(c echo.Context) error {
 		return c.JSON(http.StatusUnprocessableEntity, errMsg.Error())
 	}
 
-	httpCode, err := bh.CheckUserS3WritePermission(c, bucket, key)
+	httpCode, err := bh.CheckUserS3Permission(c, bucket, key, []string{"write"})
 	if err != nil {
 		errMsg := fmt.Errorf("error while checking for user permission: %s", err)
 		log.Error(errMsg.Error())
@@ -240,7 +240,7 @@ func (bh *BlobHandler) HandleGetPresignedUploadURL(c echo.Context) error {
 		log.Error(errMsg.Error())
 		return c.JSON(http.StatusUnprocessableEntity, errMsg.Error())
 	}
-	httpCode, err := bh.CheckUserS3WritePermission(c, bucket, key)
+	httpCode, err := bh.CheckUserS3Permission(c, bucket, key, []string{"write"})
 	if err != nil {
 		errMsg := fmt.Errorf("error while checking for user permission: %s", err)
 		log.Error(errMsg.Error())
@@ -309,7 +309,7 @@ func (bh *BlobHandler) HandleGetMultipartUploadID(c echo.Context) error {
 		log.Error(errMsg.Error())
 		return c.JSON(http.StatusUnprocessableEntity, errMsg.Error())
 	}
-	httpCode, err := bh.CheckUserS3WritePermission(c, bucket, key)
+	httpCode, err := bh.CheckUserS3Permission(c, bucket, key, []string{"write"})
 	if err != nil {
 		errMsg := fmt.Errorf("error while checking for user permission: %s", err)
 		log.Error(errMsg.Error())
@@ -358,7 +358,7 @@ func (bh *BlobHandler) HandleCompleteMultipartUpload(c echo.Context) error {
 		log.Error(errMsg.Error())
 		return c.JSON(http.StatusUnprocessableEntity, errMsg.Error())
 	}
-	httpCode, err := bh.CheckUserS3WritePermission(c, bucket, key)
+	httpCode, err := bh.CheckUserS3Permission(c, bucket, key, []string{"write"})
 	if err != nil {
 		errMsg := fmt.Errorf("error while checking for user permission: %s", err.Error())
 		log.Error(errMsg.Error())
@@ -426,7 +426,7 @@ func (bh *BlobHandler) HandleAbortMultipartUpload(c echo.Context) error {
 		log.Error(errMsg.Error())
 		return c.JSON(http.StatusUnprocessableEntity, errMsg.Error())
 	}
-	httpCode, err := bh.CheckUserS3WritePermission(c, bucket, key)
+	httpCode, err := bh.CheckUserS3Permission(c, bucket, key, []string{"write"})
 	if err != nil {
 		errMsg := fmt.Errorf("error while checking for user permission: %s", err)
 		log.Error(errMsg.Error())