HandleAuth implements the sql.AuthorizationHandler interface.
(ctx *sql.Context, aqs sql.AuthorizationQueryState, auth vitess.AuthInformation)
| 82 | |
| 83 | // HandleAuth implements the sql.AuthorizationHandler interface. |
| 84 | func (h *AuthorizationHandler) HandleAuth(ctx *sql.Context, aqs sql.AuthorizationQueryState, auth vitess.AuthInformation) error { |
| 85 | // TODO: eventually we'll want all conversion paths to provide both the AuthType and TargetType, but this lets us iterate faster for now |
| 86 | if len(auth.AuthType) == 0 && len(auth.TargetType) == 0 { |
| 87 | return nil |
| 88 | } |
| 89 | if aqs == nil { |
| 90 | aqs = h.NewQueryState(ctx) |
| 91 | } |
| 92 | state := aqs.(AuthorizationQueryState) |
| 93 | if state.err != nil { |
| 94 | return state.err |
| 95 | } |
| 96 | globalLock.RLock() |
| 97 | defer globalLock.RUnlock() |
| 98 | |
| 99 | checkSchemaForUsage := false |
| 100 | var privileges []Privilege |
| 101 | switch auth.AuthType { |
| 102 | case AuthType_IGNORE: |
| 103 | // This means that authorization is being handled elsewhere (such as a child or parent), and should be ignored here |
| 104 | return nil |
| 105 | case AuthType_CREATE: |
| 106 | privileges = []Privilege{Privilege_CREATE} |
| 107 | case AuthType_DELETE: |
| 108 | privileges = []Privilege{Privilege_DELETE} |
| 109 | case AuthType_DROPTABLE: |
| 110 | privileges = []Privilege{Privilege_DROP} |
| 111 | case AuthType_EXECUTE: |
| 112 | privileges = []Privilege{Privilege_EXECUTE} |
| 113 | case AuthType_INSERT: |
| 114 | privileges = []Privilege{Privilege_INSERT} |
| 115 | case AuthType_SELECT: |
| 116 | privileges = []Privilege{Privilege_SELECT} |
| 117 | case AuthType_TRUNCATE: |
| 118 | privileges = []Privilege{Privilege_TRUNCATE} |
| 119 | case AuthType_USAGE: |
| 120 | checkSchemaForUsage = true |
| 121 | privileges = []Privilege{Privilege_USAGE} |
| 122 | case AuthType_UPDATE: |
| 123 | privileges = []Privilege{Privilege_UPDATE} |
| 124 | default: |
| 125 | if len(auth.AuthType) == 0 { |
| 126 | return errors.New("AuthType is empty") |
| 127 | } else { |
| 128 | return errors.Errorf("AuthType not handled: `%s`", auth.AuthType) |
| 129 | } |
| 130 | } |
| 131 | |
| 132 | // TODO: implement the rest of these |
| 133 | switch auth.TargetType { |
| 134 | case AuthTargetType_Ignore: |
| 135 | // This means that the AuthType did not need a TargetType, so we can safely ignore it |
| 136 | case AuthTargetType_DatabaseIdentifiers: |
| 137 | for _, database := range auth.TargetNames { |
| 138 | database = h.dbName(ctx, database) |
| 139 | roleDatabaseKey := DatabasePrivilegeKey{ |
| 140 | Role: state.role.ID(), |
| 141 | Name: database, |
no test coverage detected