@@ -20,27 +20,28 @@ package handler
2020
2121import (
2222 "cmp"
23- "context"
2423 "encoding/base64"
2524 "fmt"
2625 "net/http"
2726 "slices"
2827 "time"
2928
30- "github.com/unikorn-cloud/core/pkg/authorization/constants"
31- "github.com/unikorn-cloud/core/pkg/authorization/userinfo"
32- coreopenapi "github.com/unikorn-cloud/core/pkg/openapi"
29+ coreapi "github.com/unikorn-cloud/core/pkg/openapi"
3330 "github.com/unikorn-cloud/core/pkg/server/conversion"
3431 "github.com/unikorn-cloud/core/pkg/server/errors"
3532 coreutil "github.com/unikorn-cloud/core/pkg/util"
36- "github.com/unikorn-cloud/identity/pkg/authorization"
3733 identityclient "github.com/unikorn-cloud/identity/pkg/client"
34+ identityapi "github.com/unikorn-cloud/identity/pkg/openapi"
35+ "github.com/unikorn-cloud/identity/pkg/rbac"
3836 unikornv1 "github.com/unikorn-cloud/region/pkg/apis/unikorn/v1alpha1"
37+ "github.com/unikorn-cloud/region/pkg/constants"
3938 "github.com/unikorn-cloud/region/pkg/handler/region"
4039 "github.com/unikorn-cloud/region/pkg/openapi"
4140 "github.com/unikorn-cloud/region/pkg/providers"
4241 "github.com/unikorn-cloud/region/pkg/server/util"
4342
43+ metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
44+
4445 "sigs.k8s.io/controller-runtime/pkg/client"
4546)
4647
@@ -77,27 +78,8 @@ func (h *Handler) setUncacheable(w http.ResponseWriter) {
7778 w .Header ().Add ("Cache-Control" , "no-cache" )
7879}
7980
80- //nolint:unparam
81- func (h * Handler ) checkRBAC (ctx context.Context , organizationID , scope string , permission constants.Permission ) error {
82- identity , err := h .identity .Client (ctx )
83- if err != nil {
84- return err
85- }
86-
87- authorizer , err := userinfo .NewAuthorizer (ctx , authorization .NewIdentityACLGetter (identity , organizationID ))
88- if err != nil {
89- return errors .HTTPForbidden ("operation is not allowed by rbac" ).WithError (err )
90- }
91-
92- if err := authorizer .Allow (ctx , scope , permission ); err != nil {
93- return errors .HTTPForbidden ("operation is not allowed by rbac" ).WithError (err )
94- }
95-
96- return nil
97- }
98-
9981func (h * Handler ) GetApiV1OrganizationsOrganizationIDProjectsProjectIDRegions (w http.ResponseWriter , r * http.Request , organizationID openapi.OrganizationIDParameter , projectID openapi.ProjectIDParameter ) {
100- if err := h . checkRBAC (r .Context (), organizationID , "infrastructure" , constants .Read ); err != nil {
82+ if err := rbac . AllowProjectScope (r .Context (), "infrastructure" , identityapi .Read , organizationID , projectID ); err != nil {
10183 errors .HandleError (w , r , err )
10284 return
10385 }
@@ -125,7 +107,7 @@ func convertGpuVendor(in providers.GPUVendor) openapi.GpuVendor {
125107
126108func convertFlavor (in providers.Flavor ) openapi.Flavor {
127109 out := openapi.Flavor {
128- Metadata : coreopenapi .StaticResourceMetadata {
110+ Metadata : coreapi .StaticResourceMetadata {
129111 Id : in .ID ,
130112 Name : in .Name ,
131113 },
@@ -150,7 +132,7 @@ func convertFlavor(in providers.Flavor) openapi.Flavor {
150132}
151133
152134func (h * Handler ) GetApiV1OrganizationsOrganizationIDProjectsProjectIDRegionsRegionIDFlavors (w http.ResponseWriter , r * http.Request , organizationID openapi.OrganizationIDParameter , projectID openapi.ProjectIDParameter , regionID openapi.RegionIDParameter ) {
153- if err := h . checkRBAC (r .Context (), organizationID , "infrastructure" , constants .Read ); err != nil {
135+ if err := rbac . AllowProjectScope (r .Context (), "infrastructure" , identityapi .Read , organizationID , projectID ); err != nil {
154136 errors .HandleError (w , r , err )
155137 return
156138 }
@@ -193,7 +175,7 @@ func (h *Handler) GetApiV1OrganizationsOrganizationIDProjectsProjectIDRegionsReg
193175
194176func convertImage (in providers.Image ) openapi.Image {
195177 out := openapi.Image {
196- Metadata : coreopenapi .StaticResourceMetadata {
178+ Metadata : coreapi .StaticResourceMetadata {
197179 Id : in .ID ,
198180 Name : in .Name ,
199181 CreationTime : in .Created ,
@@ -211,7 +193,7 @@ func convertImage(in providers.Image) openapi.Image {
211193}
212194
213195func (h * Handler ) GetApiV1OrganizationsOrganizationIDProjectsProjectIDRegionsRegionIDImages (w http.ResponseWriter , r * http.Request , organizationID openapi.OrganizationIDParameter , projectID openapi.ProjectIDParameter , regionID openapi.RegionIDParameter ) {
214- if err := h . checkRBAC (r .Context (), organizationID , "infrastructure" , constants .Read ); err != nil {
196+ if err := rbac . AllowProjectScope (r .Context (), "infrastructure" , identityapi .Read , organizationID , projectID ); err != nil {
215197 errors .HandleError (w , r , err )
216198 return
217199 }
@@ -266,9 +248,29 @@ func convertTags(in unikornv1.TagList) openapi.TagList {
266248 return out
267249}
268250
251+ func regionScopedResourceReadMetadata (in metav1.Object , status coreapi.ResourceProvisioningStatus ) coreapi.RegionScopedResourceMetadata {
252+ labels := in .GetLabels ()
253+
254+ temp := conversion .ProjectScopedResourceReadMetadata (in , status )
255+
256+ out := coreapi.RegionScopedResourceMetadata {
257+ Id : temp .Id ,
258+ Name : temp .Name ,
259+ Description : temp .Description ,
260+ CreatedBy : temp .CreatedBy ,
261+ CreationTime : temp .CreationTime ,
262+ ProvisioningStatus : temp .ProvisioningStatus ,
263+ OrganizationId : temp .OrganizationId ,
264+ ProjectId : temp .ProjectId ,
265+ RegionId : labels [constants .RegionLabel ],
266+ }
267+
268+ return out
269+ }
270+
269271func convertIdentity (identity * unikornv1.Identity , in * providers.CloudConfig ) * openapi.IdentityRead {
270272 out := & openapi.IdentityRead {
271- Metadata : conversion . ProjectScopedResourceReadMetadata (identity , coreopenapi .ResourceProvisioningStatusProvisioned ),
273+ Metadata : regionScopedResourceReadMetadata (identity , coreapi .ResourceProvisioningStatusProvisioned ),
272274 }
273275
274276 if tags := convertTags (identity .Spec .Tags ); tags != nil {
@@ -291,8 +293,11 @@ func convertIdentity(identity *unikornv1.Identity, in *providers.CloudConfig) *o
291293 return out
292294}
293295
296+ func (h * Handler ) GetApiV1OrganizationsOrganizationIDIdentities (w http.ResponseWriter , r * http.Request , organizationID openapi.OrganizationIDParameter ) {
297+ }
298+
294299func (h * Handler ) PostApiV1OrganizationsOrganizationIDProjectsProjectIDRegionsRegionIDIdentities (w http.ResponseWriter , r * http.Request , organizationID openapi.OrganizationIDParameter , projectID openapi.ProjectIDParameter , regionID openapi.RegionIDParameter ) {
295- if err := h . checkRBAC (r .Context (), organizationID , "infrastructure" , constants .Create ); err != nil {
300+ if err := rbac . AllowProjectScope (r .Context (), "infrastructure" , identityapi .Create , organizationID , projectID ); err != nil {
296301 errors .HandleError (w , r , err )
297302 return
298303 }
@@ -322,7 +327,7 @@ func (h *Handler) PostApiV1OrganizationsOrganizationIDProjectsProjectIDRegionsRe
322327
323328func convertPhysicalNetwork (in * unikornv1.PhysicalNetwork ) * openapi.PhysicalNetworkRead {
324329 out := & openapi.PhysicalNetworkRead {
325- Metadata : conversion .ProjectScopedResourceReadMetadata (in , coreopenapi .ResourceProvisioningStatusProvisioned ),
330+ Metadata : conversion .ProjectScopedResourceReadMetadata (in , coreapi .ResourceProvisioningStatusProvisioned ),
326331 }
327332
328333 if tags := convertTags (in .Spec .Tags ); tags != nil {
@@ -333,7 +338,7 @@ func convertPhysicalNetwork(in *unikornv1.PhysicalNetwork) *openapi.PhysicalNetw
333338}
334339
335340func (h * Handler ) PostApiV1OrganizationsOrganizationIDProjectsProjectIDRegionsRegionIDIdentitiesIdentityIDPhysicalNetworks (w http.ResponseWriter , r * http.Request , organizationID openapi.OrganizationIDParameter , projectID openapi.ProjectIDParameter , regionID openapi.RegionIDParameter , identityID openapi.IdentityIDParameter ) {
336- if err := h . checkRBAC (r .Context (), organizationID , "infrastructure" , constants .Create ); err != nil {
341+ if err := rbac . AllowProjectScope (r .Context (), "infrastructure" , identityapi .Create , organizationID , projectID ); err != nil {
337342 errors .HandleError (w , r , err )
338343 return
339344 }
@@ -380,7 +385,7 @@ func convertExternalNetworks(in providers.ExternalNetworks) openapi.ExternalNetw
380385}
381386
382387func (h * Handler ) GetApiV1OrganizationsOrganizationIDProjectsProjectIDRegionsRegionIDExternalnetworks (w http.ResponseWriter , r * http.Request , organizationID openapi.OrganizationIDParameter , projectID openapi.ProjectIDParameter , regionID openapi.RegionIDParameter ) {
383- if err := h . checkRBAC (r .Context (), organizationID , "infrastructure" , constants .Read ); err != nil {
388+ if err := rbac . AllowProjectScope (r .Context (), "infrastructure" , identityapi .Read , organizationID , projectID ); err != nil {
384389 errors .HandleError (w , r , err )
385390 return
386391 }
0 commit comments