Skip to content

Commit f6e6e8d

Browse files
committed
fix: shortcut KV permissions
All users have access to KV, however the permission system is used because: 1. KV is a driver, and all drivers have access checks 2. The rate limit policy comes from the permission system This change uses support for implicit permission shortcuts to prevent any of the permission association tables from being read. It also hard-codes the policy so that KV's rate-limit policy is not read from the policy.json file.
1 parent 3f0e765 commit f6e6e8d

File tree

2 files changed

+33
-0
lines changed

2 files changed

+33
-0
lines changed

src/backend/src/CoreModule.js

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -394,6 +394,9 @@ const install = async ({ services, app, useapi, modapi }) => {
394394

395395
const { WorkerService } = require('./services/worker/WorkerService');
396396
services.registerService("worker-service", WorkerService)
397+
398+
const { PermissionShortcutService } = require('./services/auth/PermissionShortcutService');
399+
services.registerService('permission-shortcut', PermissionShortcutService);
397400
}
398401

399402
const install_legacy = async ({ services }) => {
Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
const BaseService = require("../BaseService");
2+
const { PermissionImplicator } = require("./PermissionService");
3+
4+
class PermissionShortcutService extends BaseService {
5+
_init () {
6+
const svc_permission = this.services.get('permission');
7+
8+
svc_permission.register_implicator(PermissionImplicator.create({
9+
id: 'kv permissions are easy',
10+
shortcut: true,
11+
matcher: permission => {
12+
return permission === 'service:puter-kvstore:ii:puter-kvstore';
13+
},
14+
checker: async ({ actor }) => {
15+
return {
16+
policy: {
17+
"rate-limit": {
18+
max: 3000,
19+
period: 30000,
20+
}
21+
}
22+
};
23+
}
24+
}));
25+
}
26+
}
27+
28+
module.exports = {
29+
PermissionShortcutService,
30+
};

0 commit comments

Comments
 (0)