Skip to content

Commit 342d1a0

Browse files
majewskymajewsky
committed
rename the enum values of keppel.RBACPermission
"GrantsPull" etc. do not read well in the context of ForbiddenPermissions.
1 parent 7563b46 commit 342d1a0

7 files changed

Lines changed: 36 additions & 36 deletions

File tree

‎cmd/api/gui_redirect.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ func (g *guiRedirecter) tryRedirectToGUI(w http.ResponseWriter, r *http.Request)
7777
return
7878
}
7979
for _, policy := range policies {
80-
if !slices.Contains(policy.Permissions, keppel.GrantsAnonymousPull) {
80+
if !slices.Contains(policy.Permissions, keppel.RBACAnonymousPullPermission) {
8181
continue
8282
}
8383
ip := httpext.GetRequesterIPFor(r)

‎internal/api/auth/api_test.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -66,46 +66,46 @@ type TestCase struct {
6666
var (
6767
policyAnonPull = keppel.RBACPolicy{
6868
RepositoryPattern: "fo+",
69-
Permissions: []keppel.RBACPermission{keppel.GrantsAnonymousPull},
69+
Permissions: []keppel.RBACPermission{keppel.RBACAnonymousPullPermission},
7070
}
7171
policyAnonFirstPull = keppel.RBACPolicy{
7272
RepositoryPattern: "fo+",
73-
Permissions: []keppel.RBACPermission{keppel.GrantsAnonymousPull, keppel.GrantsAnonymousFirstPull},
73+
Permissions: []keppel.RBACPermission{keppel.RBACAnonymousPullPermission, keppel.RBACAnonymousFirstPullPermission},
7474
}
7575
policyPullMatches = keppel.RBACPolicy{
7676
RepositoryPattern: "fo+",
7777
UserNamePattern: "correct.*",
78-
Permissions: []keppel.RBACPermission{keppel.GrantsPull},
78+
Permissions: []keppel.RBACPermission{keppel.RBACPullPermission},
7979
}
8080
policyForbidPush = keppel.RBACPolicy{
8181
RepositoryPattern: "fo+",
8282
UserNamePattern: "correct.*",
83-
ForbiddenPermissions: []keppel.RBACPermission{keppel.GrantsPush},
83+
ForbiddenPermissions: []keppel.RBACPermission{keppel.RBACPushPermission},
8484
}
8585
policyPushMatches = keppel.RBACPolicy{
8686
RepositoryPattern: "fo+",
8787
UserNamePattern: "correct.*",
88-
Permissions: []keppel.RBACPermission{keppel.GrantsPull, keppel.GrantsPush},
88+
Permissions: []keppel.RBACPermission{keppel.RBACPullPermission, keppel.RBACPushPermission},
8989
}
9090
policyDeleteMatches = keppel.RBACPolicy{
9191
RepositoryPattern: "fo+",
9292
UserNamePattern: "correct.*",
93-
Permissions: []keppel.RBACPermission{keppel.GrantsPull, keppel.GrantsDelete},
93+
Permissions: []keppel.RBACPermission{keppel.RBACPullPermission, keppel.RBACDeletePermission},
9494
}
9595
policyPullDoesNotMatch = keppel.RBACPolicy{
9696
RepositoryPattern: "fo+",
9797
UserNamePattern: "doesnotmatch",
98-
Permissions: []keppel.RBACPermission{keppel.GrantsPull},
98+
Permissions: []keppel.RBACPermission{keppel.RBACPullPermission},
9999
}
100100
policyPushDoesNotMatch = keppel.RBACPolicy{
101101
RepositoryPattern: "doesnotmatch",
102102
UserNamePattern: "correct.*",
103-
Permissions: []keppel.RBACPermission{keppel.GrantsPull, keppel.GrantsPush},
103+
Permissions: []keppel.RBACPermission{keppel.RBACPullPermission, keppel.RBACPushPermission},
104104
}
105105
policyDeleteDoesNotMatch = keppel.RBACPolicy{
106106
RepositoryPattern: "fo+",
107107
UserNamePattern: "doesnotmatch",
108-
Permissions: []keppel.RBACPermission{keppel.GrantsPull, keppel.GrantsDelete},
108+
Permissions: []keppel.RBACPermission{keppel.RBACPullPermission, keppel.RBACDeletePermission},
109109
}
110110
)
111111

‎internal/api/keppel/api_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ func TestAlternativeAuthSchemes(t *testing.T) {
5353
mustExec(t, s.DB, `UPDATE accounts SET rbac_policies_json = $2 WHERE name = $1`, "test1",
5454
test.ToJSON([]keppel.RBACPolicy{{
5555
RepositoryPattern: "foo",
56-
Permissions: []keppel.RBACPermission{keppel.GrantsAnonymousPull},
56+
Permissions: []keppel.RBACPermission{keppel.RBACAnonymousPullPermission},
5757
}}),
5858
)
5959
assert.HTTPRequest{

‎internal/api/registry/blobs_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ func TestBlobMonolithicUpload(t *testing.T) {
189189
_, err := s.DB.Exec(`UPDATE accounts SET rbac_policies_json = $2 WHERE name = $1`, "test1",
190190
test.ToJSON([]keppel.RBACPolicy{{
191191
RepositoryPattern: "foo",
192-
Permissions: []keppel.RBACPermission{keppel.GrantsAnonymousPull},
192+
Permissions: []keppel.RBACPermission{keppel.RBACAnonymousPullPermission},
193193
}}),
194194
)
195195
if err != nil {

‎internal/api/registry/manifests_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -335,7 +335,7 @@ func TestImageManifestLifecycle(t *testing.T) {
335335
_, err = s.DB.Exec(`UPDATE accounts SET rbac_policies_json = $2 WHERE name = $1`, "test1",
336336
test.ToJSON([]keppel.RBACPolicy{{
337337
RepositoryPattern: "foo",
338-
Permissions: []keppel.RBACPermission{keppel.GrantsAnonymousPull},
338+
Permissions: []keppel.RBACPermission{keppel.RBACAnonymousPullPermission},
339339
}}),
340340
)
341341
if err != nil {

‎internal/auth/filter.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -213,28 +213,28 @@ func filterRepoActions(ip string, scope Scope, uid keppel.UserIdentity, audience
213213

214214
// certain policies can never be granted to anonymous users by an RBAC policy
215215
if uid.UserType() == keppel.AnonymousUser {
216-
delete(permOverride, keppel.GrantsPull)
217-
delete(permOverride, keppel.GrantsPush)
218-
delete(permOverride, keppel.GrantsDelete)
216+
delete(permOverride, keppel.RBACPullPermission)
217+
delete(permOverride, keppel.RBACPushPermission)
218+
delete(permOverride, keppel.RBACDeletePermission)
219219
}
220220

221221
// evaluate final permission set
222222
isAllowedAction := map[string]bool{
223-
"pull": permOverride[keppel.GrantsPull].UnwrapOr(
223+
"pull": permOverride[keppel.RBACPullPermission].UnwrapOr(
224224
uid.HasPermission(keppel.CanPullFromAccount, authTenantID),
225225
),
226-
"push": permOverride[keppel.GrantsPush].UnwrapOr(
226+
"push": permOverride[keppel.RBACPushPermission].UnwrapOr(
227227
uid.HasPermission(keppel.CanPushToAccount, authTenantID),
228228
),
229-
"delete": permOverride[keppel.GrantsDelete].UnwrapOr(
229+
"delete": permOverride[keppel.RBACDeletePermission].UnwrapOr(
230230
uid.HasPermission(keppel.CanDeleteFromAccount, authTenantID),
231231
),
232232
}
233-
if permOverride[keppel.GrantsAnonymousPull].UnwrapOr(false) {
233+
if permOverride[keppel.RBACAnonymousPullPermission].UnwrapOr(false) {
234234
isAllowedAction["pull"] = true
235235
}
236236
if isAllowedAction["pull"] {
237-
isAllowedAction["anonymous_first_pull"] = permOverride[keppel.GrantsAnonymousFirstPull].UnwrapOr(false)
237+
isAllowedAction["anonymous_first_pull"] = permOverride[keppel.RBACAnonymousFirstPullPermission].UnwrapOr(false)
238238
}
239239

240240
// grant requested actions as possible

‎internal/keppel/rbac_policy.go‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -44,19 +44,19 @@ type RBACPolicy struct {
4444
type RBACPermission string
4545

4646
const (
47-
GrantsPull RBACPermission = "pull"
48-
GrantsPush RBACPermission = "push"
49-
GrantsDelete RBACPermission = "delete"
50-
GrantsAnonymousPull RBACPermission = "anonymous_pull"
51-
GrantsAnonymousFirstPull RBACPermission = "anonymous_first_pull"
47+
RBACPullPermission RBACPermission = "pull"
48+
RBACPushPermission RBACPermission = "push"
49+
RBACDeletePermission RBACPermission = "delete"
50+
RBACAnonymousPullPermission RBACPermission = "anonymous_pull"
51+
RBACAnonymousFirstPullPermission RBACPermission = "anonymous_first_pull"
5252
)
5353

5454
var isRBACPermission = map[RBACPermission]bool{
55-
GrantsPull: true,
56-
GrantsPush: true,
57-
GrantsDelete: true,
58-
GrantsAnonymousPull: true,
59-
GrantsAnonymousFirstPull: true,
55+
RBACPullPermission: true,
56+
RBACPushPermission: true,
57+
RBACDeletePermission: true,
58+
RBACAnonymousPullPermission: true,
59+
RBACAnonymousFirstPullPermission: true,
6060
}
6161

6262
// Matches evaluates the cidr and regexes in this policy.
@@ -123,19 +123,19 @@ func (r *RBACPolicy) ValidateAndNormalize(strategy ReplicationStrategy) error {
123123
if r.CidrPattern == "" && r.UserNamePattern == "" && r.RepositoryPattern == "" {
124124
return errors.New(`RBAC policy must have at least one "match_..." attribute`)
125125
}
126-
if (refersToPerm[GrantsAnonymousPull] || refersToPerm[GrantsAnonymousFirstPull]) && r.UserNamePattern != "" {
126+
if (refersToPerm[RBACAnonymousPullPermission] || refersToPerm[RBACAnonymousFirstPullPermission]) && r.UserNamePattern != "" {
127127
return errors.New(`RBAC policy with "anonymous_pull" or "anonymous_first_pull" may not have the "match_username" attribute`)
128128
}
129-
if refersToPerm[GrantsPull] && r.CidrPattern == "" && r.UserNamePattern == "" {
129+
if refersToPerm[RBACPullPermission] && r.CidrPattern == "" && r.UserNamePattern == "" {
130130
return errors.New(`RBAC policy with "pull" must have the "match_cidr" or "match_username" attribute`)
131131
}
132-
if grantsPerm[GrantsPush] && !grantsPerm[GrantsPull] {
132+
if grantsPerm[RBACPushPermission] && !grantsPerm[RBACPullPermission] {
133133
return errors.New(`RBAC policy with "push" must also grant "pull"`)
134134
}
135-
if refersToPerm[GrantsDelete] && r.UserNamePattern == "" {
135+
if refersToPerm[RBACDeletePermission] && r.UserNamePattern == "" {
136136
return errors.New(`RBAC policy with "delete" must have the "match_username" attribute`)
137137
}
138-
if refersToPerm[GrantsAnonymousFirstPull] && strategy != FromExternalOnFirstUseStrategy {
138+
if refersToPerm[RBACAnonymousFirstPullPermission] && strategy != FromExternalOnFirstUseStrategy {
139139
return errors.New(`RBAC policy with "anonymous_first_pull" may only be for external replica accounts`)
140140
}
141141

0 commit comments

Comments
 (0)