@@ -21,33 +21,35 @@ import (
2121 "time"
2222
2323 "github.com/finleap-connect/monoskope/internal/gateway/auth"
24+ "github.com/finleap-connect/monoskope/pkg/api/domain/projections"
2425 api "github.com/finleap-connect/monoskope/pkg/api/gateway"
26+ "github.com/finleap-connect/monoskope/pkg/domain/errors"
2527 domainErrors "github.com/finleap-connect/monoskope/pkg/domain/errors"
2628 "github.com/finleap-connect/monoskope/pkg/domain/metadata"
2729 "github.com/finleap-connect/monoskope/pkg/domain/repositories"
2830 "github.com/finleap-connect/monoskope/pkg/jwt"
2931 "github.com/finleap-connect/monoskope/pkg/k8s"
3032 "github.com/finleap-connect/monoskope/pkg/logger"
3133 "github.com/finleap-connect/monoskope/pkg/usecase"
32- "github.com/google/uuid"
3334 "google.golang.org/protobuf/types/known/timestamppb"
35+ "k8s.io/utils/strings/slices"
3436)
3537
3638type getAuthTokenUsecase struct {
3739 * usecase.UseCaseBase
38- request * api.ClusterAuthTokenRequest
39- result * api.ClusterAuthTokenResponse
40- signer jwt.JWTSigner
41- clusterRepo repositories.ClusterRepository
42- issuer string
43- validity map [string ]time.Duration
40+ request * api.ClusterAuthTokenRequest
41+ result * api.ClusterAuthTokenResponse
42+ signer jwt.JWTSigner
43+ clusterAccessRepo repositories.ClusterAccessRepository
44+ issuer string
45+ validity map [string ]time.Duration
4446}
4547
4648func NewGetAuthTokenUsecase (
4749 request * api.ClusterAuthTokenRequest ,
4850 response * api.ClusterAuthTokenResponse ,
4951 signer jwt.JWTSigner ,
50- clusterRepo repositories.ClusterRepository ,
52+ clusterAccessRepo repositories.ClusterAccessRepository ,
5153 issuer string ,
5254 validity map [string ]time.Duration ,
5355) usecase.UseCase {
@@ -56,7 +58,7 @@ func NewGetAuthTokenUsecase(
5658 request ,
5759 response ,
5860 signer ,
59- clusterRepo ,
61+ clusterAccessRepo ,
6062 issuer ,
6163 validity ,
6264 }
@@ -80,22 +82,28 @@ func (s *getAuthTokenUsecase) Run(ctx context.Context) error {
8082 }
8183
8284 clusterId := s .request .GetClusterId ()
83- s .Log .V (logger .DebugLevel ).Info ("Getting cluster by id..." , "id" , clusterId )
84-
85- uuid , err := uuid .Parse (clusterId )
85+ s .Log .V (logger .DebugLevel ).Info ("Checking user is allowed to access cluster..." , "clusterId" , clusterId )
86+ clusterAccesses , err := s .clusterAccessRepo .GetClustersAccessibleByUserId (ctx , userInfo .Id )
8687 if err != nil {
8788 return err
8889 }
8990
90- cluster , err := s .clusterRepo .ById (ctx , uuid )
91- if err != nil {
92- return err
91+ var foundClusterAccess * projections.ClusterAccess
92+ for _ , clusterAccess := range clusterAccesses {
93+ if clusterAccess .Cluster .Id == clusterId {
94+ foundClusterAccess = clusterAccess
95+ break
96+ }
9397 }
9498
95- k8sRole := s .request .GetRole ()
96- s .Log .V (logger .DebugLevel ).Info ("Validating role exists..." , "role" , k8sRole )
97- if err := k8s .ValidateRole (k8sRole ); err != nil {
98- return err
99+ if foundClusterAccess == nil {
100+ s .Log .V (logger .DebugLevel ).Info ("User is not authorized to access cluster." , "clusterId" , clusterId )
101+ return errors .ErrUnauthorized
102+ }
103+
104+ if ! slices .Contains (foundClusterAccess .Roles , s .request .Role ) {
105+ s .Log .V (logger .DebugLevel ).Info ("User is not authorized to access cluster with role." , "clusterId" , clusterId , "role" , s .request .Role )
106+ return errors .ErrUnauthorized
99107 }
100108
101109 username := strings .ToLower (strings .Split (userInfo .Email , "@" )[0 ])
@@ -109,8 +117,8 @@ func (s *getAuthTokenUsecase) Run(ctx context.Context) error {
109117 Email : userInfo .Email ,
110118 EmailVerified : true ,
111119 }, & jwt.ClusterClaim {
112- ClusterId : cluster .GetId (),
113- ClusterName : cluster .GetName (),
120+ ClusterId : foundClusterAccess . Cluster .GetId (),
121+ ClusterName : foundClusterAccess . Cluster .GetName (),
114122 ClusterUserName : username ,
115123 ClusterRole : s .request .Role ,
116124 }, s .issuer , userInfo .Id .String (), s .validity [s .request .Role ])
0 commit comments