Update authorization (organizations controller)
@@ -15,14 +15,11 @@ import (
// OrganizationsController defines the fields required for this controller.
type OrganizationsController struct {
Store store.Store
- abilities authorization.Ability
}
// Register should define an association between HTTP routes and their
// respective handlers defined within this Controller.
func (o *OrganizationsController) Register(r *mux.Router) {
- o.abilities = authorization.Ability{Resource: types.RuleTypeOrganization}
-
r.HandleFunc("/rbac/organizations", o.many).Methods(http.MethodGet)
r.HandleFunc("/rbac/organizations", o.update).Methods(http.MethodPost)
r.HandleFunc("/rbac/organizations/{organization}", o.single).Methods(http.MethodGet)
@@ -34,9 +31,7 @@ func (o *OrganizationsController) delete(w http.ResponseWriter, r *http.Request)
vars := mux.Vars(r)
org := vars["organization"]
- abilities := o.abilities.WithContext(r.Context())
- // abilities.context.Organization = org // TODO: Set organization method?
-
+ abilities := authorization.Organizations.WithContext(r.Context())
if !abilities.CanDelete() {
authorization.UnauthorizedAccessToResource(w)
return
@@ -53,8 +48,8 @@ func (o *OrganizationsController) delete(w http.ResponseWriter, r *http.Request)
// many returns all organizations
func (o *OrganizationsController) many(w http.ResponseWriter, r *http.Request) {
- abilities := o.abilities.WithContext(r.Context())
- if !abilities.CanRead() {
+ abilities := authorization.Organizations.WithContext(r.Context())
+ if !abilities.CanList() {
authorization.UnauthorizedAccessToResource(w)
return
}
@@ -65,6 +60,9 @@ func (o *OrganizationsController) many(w http.ResponseWriter, r *http.Request) {
return
}
+ // Reject those resources the viewer is unauthorized to view
+ rejectOrganizations(&orgs, abilities.CanRead)
+
bytes, err := json.Marshal(orgs)
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
@@ -79,13 +77,7 @@ func (o *OrganizationsController) single(w http.ResponseWriter, r *http.Request)
vars := mux.Vars(r)
name := vars["organization"]
- abilities := o.abilities.WithContext(r.Context())
- // abilities.context.Organization = org // TODO: Set organization method?
-
- if !abilities.CanRead() {
- authorization.UnauthorizedAccessToResource(w)
- return
- }
+ abilities := authorization.Organizations.WithContext(r.Context())
var (
org *types.Organization
@@ -103,6 +95,11 @@ func (o *OrganizationsController) single(w http.ResponseWriter, r *http.Request)
return
}
+ if !abilities.CanRead(org) {
+ authorization.UnauthorizedAccessToResource(w)
+ return
+ }
+
bytes, err := json.Marshal(org)
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
@@ -125,9 +122,7 @@ func (o *OrganizationsController) update(w http.ResponseWriter, r *http.Request)
}
defer r.Body.Close()
- abilities := o.abilities.WithContext(r.Context())
- // abilities.Actor.Organization = org.Name // TODO: Set org?
-
+ abilities := authorization.Organizations.WithContext(r.Context())
if !abilities.CanCreate() {
authorization.UnauthorizedAccessToResource(w)
return
@@ -154,3 +149,13 @@ func (o *OrganizationsController) update(w http.ResponseWriter, r *http.Request)
w.WriteHeader(http.StatusCreated)
return
}
+
+func rejectOrganizations(records *[]*types.Organization, predicate func(*types.Organization) bool) {
+ new := make([]*types.Organization, 0, len(*records))
+ for _, record := range *records {
+ if predicate(record) {
+ new = append(new, record)
+ }
+ }
+ *records = new
+}
