GET, POST, PUT, DELETE: /node/{nid}/acl/ GET is the only action implemented here.
(ctx context.Context)
| 26 | // GET, POST, PUT, DELETE: /node/{nid}/acl/ |
| 27 | // GET is the only action implemented here. |
| 28 | func AclRequest(ctx context.Context) { |
| 29 | nid := ctx.PathValue("nid") |
| 30 | rmeth := ctx.HttpRequest().Method |
| 31 | |
| 32 | u, err := request.Authenticate(ctx.HttpRequest()) |
| 33 | if err != nil && err.Error() != e.NoAuth { |
| 34 | request.AuthError(err, ctx) |
| 35 | return |
| 36 | } |
| 37 | |
| 38 | // public user (no auth) can perform a GET operation with the proper node permissions |
| 39 | if u == nil { |
| 40 | if rmeth == "GET" && conf.ANON_READ { |
| 41 | u = &user.User{Uuid: "public"} |
| 42 | } else { |
| 43 | responder.RespondWithError(ctx, http.StatusUnauthorized, e.NoAuth) |
| 44 | return |
| 45 | } |
| 46 | } |
| 47 | |
| 48 | // Load node by id |
| 49 | n, err := node.Load(nid) |
| 50 | if err != nil { |
| 51 | if err == mgo.ErrNotFound { |
| 52 | logger.Error("err@node_Acl: (node.Load) id=" + nid + ": " + e.NodeNotFound) |
| 53 | responder.RespondWithError(ctx, http.StatusNotFound, e.NodeNotFound) |
| 54 | return |
| 55 | } else { |
| 56 | // In theory the db connection could be lost between |
| 57 | // checking user and load but seems unlikely. |
| 58 | err_msg := "err@node_Acl: (node.Load) id=" + nid + ": " + err.Error() |
| 59 | logger.Error(err_msg) |
| 60 | responder.RespondWithError(ctx, http.StatusInternalServerError, err_msg) |
| 61 | return |
| 62 | } |
| 63 | } |
| 64 | |
| 65 | // Only the owner, an admin, or someone with read access can view acl's. |
| 66 | // |
| 67 | // NOTE: If the node is publicly owned, then anyone can view all acl's. The owner can only |
| 68 | // be "public" when anonymous node creation (ANON_WRITE) is enabled in Shock config. |
| 69 | |
| 70 | rights := n.Acl.Check(u.Uuid) |
| 71 | if n.Acl.Owner != u.Uuid && u.Admin == false && n.Acl.Owner != "public" && rights["read"] == false { |
| 72 | logger.Error("err@node_Acl: (Authenticate) id=" + nid + ": " + e.UnAuth) |
| 73 | responder.RespondWithError(ctx, http.StatusUnauthorized, e.UnAuth) |
| 74 | return |
| 75 | } |
| 76 | |
| 77 | if rmeth == "GET" { |
| 78 | query := ctx.HttpRequest().URL.Query() |
| 79 | verbosity := "" |
| 80 | if _, ok := query["verbosity"]; ok { |
| 81 | verbosity = query.Get("verbosity") |
| 82 | } |
| 83 | responder.RespondWithData(ctx, n.Acl.FormatDisplayAcl(verbosity)) |
| 84 | } else { |
| 85 | responder.RespondWithError(ctx, http.StatusNotImplemented, "This request type is not implemented.") |
nothing calls this directly
no test coverage detected