Function securityRulesFromMagicAuthToken

admin/server/runtime_jwt.go:256–325

securityRulesFromMagicAuthToken builds the security rules encoded by a magic auth token: a resource allow-list (or blanket deny), metrics-view row filters, and a field allow-list.

(mdl *database.MagicAuthToken)

// securityRulesFromMagicAuthToken builds the security rules encoded by a magic auth token:
// a resource allow-list (or blanket deny), metrics-view row filters, and a field allow-list.
func securityRulesFromMagicAuthToken(mdl *database.MagicAuthToken) ([]*runtimev1.SecurityRule, error) {
	var rules []*runtimev1.SecurityRule
	if len(mdl.Resources) == 0 {
		// No resources means deny all access.
		rules = append(rules, &runtimev1.SecurityRule{
			Rule: &runtimev1.SecurityRule_Access{
				Access: &runtimev1.SecurityRuleAccess{Allow: false},
			},
		})
	} else {
		for _, r := range mdl.Resources {
			rules = append(rules, &runtimev1.SecurityRule{
				Rule: &runtimev1.SecurityRule_TransitiveAccess{
					TransitiveAccess: &runtimev1.SecurityRuleTransitiveAccess{
						Resource: &runtimev1.ResourceName{
							Kind: r.Type,
							Name: r.Name,
						},
					},
				},
			})
		}
	}

	for mv, filter := range mdl.MetricsViewFilterJSONs {
		if mv == "" {
			return nil, status.Errorf(codes.Internal, "empty metrics view name in metrics view filter")
		}
		expr := &runtimev1.Expression{}
		if err := protojson.Unmarshal([]byte(filter), expr); err != nil {
			return nil, status.Errorf(codes.Internal, "could not unmarshal metrics view %q filter: %s", mv, err.Error())
		}
		if mv == "*" {
			// Backwards compatibility: "*" applies to all metrics views.
			rules = append(rules, &runtimev1.SecurityRule{
				Rule: &runtimev1.SecurityRule_RowFilter{
					RowFilter: &runtimev1.SecurityRuleRowFilter{
						Expression: expr,
					},
				},
			})
			continue
		}
		rules = append(rules, &runtimev1.SecurityRule{
			Rule: &runtimev1.SecurityRule_RowFilter{
				RowFilter: &runtimev1.SecurityRuleRowFilter{
					ConditionResources: []*runtimev1.ResourceName{{
						Kind: runtime.ResourceKindMetricsView,
						Name: mv,
					}},
					Expression: expr,
				},
			},
		})
	}

	if len(mdl.Fields) > 0 {
		rules = append(rules, &runtimev1.SecurityRule{