Function AuthSuperAdmin

edgraph/access.go:1122–1143

AuthSuperAdmin authorizes the operations for the users who belong to the guardians group in the galaxy namespace. This authorization is used for admin usages like creation and deletion of a namespace, resetting passwords across namespaces etc. NOTE: The caller should not wrap the error returned. If

(ctx context.Context)

// deletion of a namespace, resetting passwords across namespaces etc.
// NOTE: The caller should not wrap the error returned. If needed, propagate the GRPC error code.
func AuthSuperAdmin(ctx context.Context) error {
	if !x.WorkerConfig.AclEnabled {
		return nil
	}
	ns, err := x.ExtractNamespaceFrom(ctx)
	if err != nil {
		return errors.Wrap(err, "Authorize guardian of the galaxy, extracting jwt token, error:")
	}
	if ns != 0 {
		return status.Error(
			codes.PermissionDenied, "Only superadmin is allowed to do this operation")
	}
	// AuthorizeGuardians will extract (user, []groups) from the JWT claims and will check if
	// any of the group to which the user belongs is "guardians" or not.
	if err := AuthorizeGuardians(ctx); err != nil {
		s := status.Convert(err)
		return status.Error(
			s.Code(), "AuthSuperAdmin: failed to authorize guardians. "+s.Message())
	}
	glog.V(3).Info("Successfully authorised guardian of the galaxy")
	return nil
}

// AuthorizeGuardians authorizes the operation for users which belong to Guardians group.
// NOTE: The caller should not wrap the error returned. If needed, propagate the GRPC error code.