| 1147 | } |
| 1148 | |
| 1149 | func checkAdminAuth(ctx context.Context, bucketName, basicAuthUsername, basicAuthPassword string, attemptedHTTPOperation string, httpClient *http.Client, managementEndpoints []string, shouldCheckPermissions bool, accessPermissions []Permission, responsePermissions []Permission) (responsePermissionResults map[string]bool, statusCode int, err error) { |
| 1150 | anyResponsePermFailed := false |
| 1151 | permissionStatusCode, permResults, err := CheckPermissions(ctx, httpClient, managementEndpoints, bucketName, basicAuthUsername, basicAuthPassword, accessPermissions, responsePermissions) |
| 1152 | if err != nil { |
| 1153 | return nil, http.StatusInternalServerError, err |
| 1154 | } |
| 1155 | if len(responsePermissions) > 0 { |
| 1156 | responsePermissionResults = permResults |
| 1157 | for _, permResult := range permResults { |
| 1158 | if !permResult { |
| 1159 | anyResponsePermFailed = true |
| 1160 | break |
| 1161 | } |
| 1162 | } |
| 1163 | } |
| 1164 | |
| 1165 | // If the user has not logged in correctly we shouldn't continue to do any more work and return |
| 1166 | if permissionStatusCode == http.StatusUnauthorized { |
| 1167 | return nil, permissionStatusCode, nil |
| 1168 | } |
| 1169 | |
| 1170 | if shouldCheckPermissions { |
| 1171 | // If user has required accessPerms and all response perms return with statusOK |
| 1172 | // Otherwise we need to fall through to continue as the user may have access to responsePermissions through roles. |
| 1173 | if permissionStatusCode == http.StatusOK && !anyResponsePermFailed { |
| 1174 | return responsePermissionResults, http.StatusOK, nil |
| 1175 | } |
| 1176 | |
| 1177 | // If status code was not 'ok' or 'forbidden' return |
| 1178 | // If user has authenticated correctly but is not authorized with all permissions. We'll fall through to try |
| 1179 | // with roles. |
| 1180 | if permissionStatusCode != http.StatusOK && permissionStatusCode != http.StatusForbidden { |
| 1181 | return responsePermissionResults, permissionStatusCode, nil |
| 1182 | } |
| 1183 | } |
| 1184 | |
| 1185 | var requestRoles []RouteRole |
| 1186 | if bucketName != "" { |
| 1187 | requestRoles = BucketScopedEndpointRoles |
| 1188 | } else { |
| 1189 | if attemptedHTTPOperation == http.MethodGet || attemptedHTTPOperation == http.MethodHead || attemptedHTTPOperation == http.MethodOptions { |
| 1190 | requestRoles = ClusterScopedEndpointRolesRead |
| 1191 | } else { |
| 1192 | requestRoles = ClusterScopedEndpointRolesWrite |
| 1193 | } |
| 1194 | } |
| 1195 | |
| 1196 | rolesStatusCode, err := CheckRoles(ctx, httpClient, managementEndpoints, basicAuthUsername, basicAuthPassword, requestRoles, bucketName) |
| 1197 | if err != nil { |
| 1198 | return nil, http.StatusInternalServerError, err |
| 1199 | } |
| 1200 | |
| 1201 | // If a user has access through roles we're going to use this to mean they have access to all of the |
| 1202 | // responsePermissions too so we'll iterate over these and set them to true. |
| 1203 | if rolesStatusCode == http.StatusOK { |
| 1204 | responsePermissionResults = make(map[string]bool) |
| 1205 | for _, responsePerm := range responsePermissions { |
| 1206 | responsePermissionResults[responsePerm.PermissionName] = true |