Compare commits
6 Commits
Author | SHA1 | Date | |
---|---|---|---|
29d13371a8 | |||
b71bf21b48 | |||
ae12746ff2 | |||
4ffaabd6e6 | |||
c647f76894 | |||
c1c5d23f92 |
53
auth/auth.go
53
auth/auth.go
@@ -6,11 +6,11 @@ import (
|
|||||||
"fmt"
|
"fmt"
|
||||||
"log"
|
"log"
|
||||||
"net/http"
|
"net/http"
|
||||||
"strings"
|
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
"git.acooldomain.co/server-manager/backend/dbhandler"
|
"git.acooldomain.co/server-manager/backend/dbhandler"
|
||||||
"git.acooldomain.co/server-manager/backend/factories"
|
"git.acooldomain.co/server-manager/backend/factories"
|
||||||
|
"git.acooldomain.co/server-manager/backend/instancemanager"
|
||||||
"git.acooldomain.co/server-manager/backend/models"
|
"git.acooldomain.co/server-manager/backend/models"
|
||||||
"github.com/gin-gonic/gin"
|
"github.com/gin-gonic/gin"
|
||||||
"github.com/golang-jwt/jwt"
|
"github.com/golang-jwt/jwt"
|
||||||
@@ -19,6 +19,7 @@ import (
|
|||||||
type AuthApi struct {
|
type AuthApi struct {
|
||||||
config models.GlobalConfig
|
config models.GlobalConfig
|
||||||
|
|
||||||
|
instanceManager instancemanager.InstanceManager
|
||||||
tokenHandler dbhandler.InviteTokenDbHandler
|
tokenHandler dbhandler.InviteTokenDbHandler
|
||||||
userAuthDbHandler dbhandler.UserPassAuthanticationDbHandler
|
userAuthDbHandler dbhandler.UserPassAuthanticationDbHandler
|
||||||
serverAuthDbHandler dbhandler.ServersAuthorizationDbHandler
|
serverAuthDbHandler dbhandler.ServersAuthorizationDbHandler
|
||||||
@@ -119,8 +120,8 @@ func (con AuthApi) signUp(ctx *gin.Context) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
type SignInRequest struct {
|
type SignInRequest struct {
|
||||||
Username string
|
Username string `json:"username"`
|
||||||
Password string
|
Password string `json:"password"`
|
||||||
}
|
}
|
||||||
|
|
||||||
func (con AuthApi) signIn(ctx *gin.Context) {
|
func (con AuthApi) signIn(ctx *gin.Context) {
|
||||||
@@ -169,31 +170,23 @@ func (con AuthApi) Verify(ctx *gin.Context) {
|
|||||||
|
|
||||||
forwardedUri := ctx.Request.Header.Get("x-forwarded-uri")
|
forwardedUri := ctx.Request.Header.Get("x-forwarded-uri")
|
||||||
|
|
||||||
pathSegments := strings.Split(forwardedUri, "/")
|
fileBrowser, err := con.instanceManager.GetFileBrowserFromUrl(ctx, forwardedUri)
|
||||||
|
if err != nil {
|
||||||
|
ctx.AbortWithError(500, err)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
serverId, service := pathSegments[2], pathSegments[1]
|
fmt.Printf("%#v %s", claims, fileBrowser.ServerId)
|
||||||
|
serverPermissions, err := con.serverAuthDbHandler.GetPermissions(ctx, claims.Username, fileBrowser.ServerId)
|
||||||
switch service {
|
if err != nil {
|
||||||
case "browsers":
|
ctx.AbortWithError(500, err)
|
||||||
fmt.Printf("%#v %s", claims, serverId)
|
return
|
||||||
serverPermissions, err := con.serverAuthDbHandler.GetPermissions(ctx, claims.Username, serverId)
|
}
|
||||||
if err != nil {
|
if (claims.Permissions|serverPermissions)&models.Admin == models.Admin {
|
||||||
ctx.AbortWithError(500, err)
|
ctx.Header("X-Auth-Username", claims.Username)
|
||||||
return
|
log.Printf("Set header X-Username %s", claims.Username)
|
||||||
}
|
ctx.Status(200)
|
||||||
if (claims.Permissions|serverPermissions)&models.Admin == models.Admin {
|
return
|
||||||
ctx.Header("X-Auth-Username", claims.Username)
|
|
||||||
log.Printf("Set header X-Username %s", claims.Username)
|
|
||||||
ctx.Status(200)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
case "cloud":
|
|
||||||
if claims.Permissions&models.Cloud == models.Cloud || claims.Permissions&models.Admin == models.Admin {
|
|
||||||
log.Printf("Set header X-Username %s", claims.Username)
|
|
||||||
ctx.Header("X-Auth-Username", claims.Username)
|
|
||||||
ctx.Status(200)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
ctx.Redirect(303, fmt.Sprintf("http://%s/login", con.config.Domain))
|
ctx.Redirect(303, fmt.Sprintf("http://%s/login", con.config.Domain))
|
||||||
@@ -210,6 +203,11 @@ func LoadGroup(group *gin.RouterGroup, config models.GlobalConfig) gin.HandlerFu
|
|||||||
panic(err)
|
panic(err)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
instanceManager, err := factories.GetInstanceManager(config.InstanceManager, config.Domain)
|
||||||
|
if err != nil {
|
||||||
|
panic(err)
|
||||||
|
}
|
||||||
|
|
||||||
inviteHandler, err := factories.GetInviteTokenDbHandler(config.Authentication.UserPass.InviteTokenDatabase)
|
inviteHandler, err := factories.GetInviteTokenDbHandler(config.Authentication.UserPass.InviteTokenDatabase)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
panic(err)
|
panic(err)
|
||||||
@@ -218,6 +216,7 @@ func LoadGroup(group *gin.RouterGroup, config models.GlobalConfig) gin.HandlerFu
|
|||||||
connection := AuthApi{
|
connection := AuthApi{
|
||||||
userAuthDbHandler: userAuthHandler,
|
userAuthDbHandler: userAuthHandler,
|
||||||
serverAuthDbHandler: serverAuthDbHandler,
|
serverAuthDbHandler: serverAuthDbHandler,
|
||||||
|
instanceManager: instanceManager,
|
||||||
tokenHandler: inviteHandler,
|
tokenHandler: inviteHandler,
|
||||||
config: config,
|
config: config,
|
||||||
}
|
}
|
||||||
|
@@ -21,8 +21,8 @@ type ServersAuthorizationDbHandler struct {
|
|||||||
collection *mongo.Collection
|
collection *mongo.Collection
|
||||||
}
|
}
|
||||||
|
|
||||||
func (self *ServersAuthorizationDbHandler) RemoveUser(ctx context.Context, username string) error {
|
func (sa *ServersAuthorizationDbHandler) RemoveUser(ctx context.Context, username string) error {
|
||||||
_, err := self.collection.DeleteMany(
|
_, err := sa.collection.DeleteMany(
|
||||||
ctx,
|
ctx,
|
||||||
bson.M{
|
bson.M{
|
||||||
"username": username,
|
"username": username,
|
||||||
@@ -32,8 +32,8 @@ func (self *ServersAuthorizationDbHandler) RemoveUser(ctx context.Context, usern
|
|||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
func (self *ServersAuthorizationDbHandler) RemoveServer(ctx context.Context, serverId string) error {
|
func (sa *ServersAuthorizationDbHandler) RemoveServer(ctx context.Context, serverId string) error {
|
||||||
_, err := self.collection.DeleteMany(
|
_, err := sa.collection.DeleteMany(
|
||||||
ctx,
|
ctx,
|
||||||
bson.M{
|
bson.M{
|
||||||
"server_id": serverId,
|
"server_id": serverId,
|
||||||
@@ -43,33 +43,33 @@ func (self *ServersAuthorizationDbHandler) RemoveServer(ctx context.Context, ser
|
|||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
func (self *ServersAuthorizationDbHandler) AddPermissions(ctx context.Context, username string, serverId string, permissions models.Permission) error {
|
func (sa *ServersAuthorizationDbHandler) AddPermissions(ctx context.Context, username string, serverId string, permissions models.Permission) error {
|
||||||
var serverPermissions ServerPermissions
|
var serverPermissions ServerPermissions
|
||||||
err := self.collection.FindOne(
|
err := sa.collection.FindOne(
|
||||||
ctx,
|
ctx,
|
||||||
bson.M{
|
bson.M{
|
||||||
"username": username,
|
"username": username,
|
||||||
"server_id": serverId,
|
"server_id": serverId,
|
||||||
},
|
},
|
||||||
).Decode(&serverPermissions)
|
).Decode(&serverPermissions)
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
newPermissions := serverPermissions.Permissions | permissions
|
newPermissions := serverPermissions.Permissions | permissions
|
||||||
|
|
||||||
_, err = self.collection.UpdateOne(
|
_, err = sa.collection.UpdateOne(
|
||||||
ctx,
|
ctx,
|
||||||
bson.M{
|
bson.M{
|
||||||
"username": username,
|
"username": username,
|
||||||
"server_id": serverId,
|
"server_id": serverId,
|
||||||
},
|
},
|
||||||
bson.M{"$set": bson.M{
|
bson.M{
|
||||||
"username": username,
|
"$set": bson.M{
|
||||||
"server_id": serverId,
|
"username": username,
|
||||||
"permissions": newPermissions,
|
"server_id": serverId,
|
||||||
},
|
"permissions": newPermissions,
|
||||||
|
},
|
||||||
},
|
},
|
||||||
options.Update().SetUpsert(true),
|
options.Update().SetUpsert(true),
|
||||||
)
|
)
|
||||||
@@ -77,65 +77,68 @@ func (self *ServersAuthorizationDbHandler) AddPermissions(ctx context.Context, u
|
|||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
func (self *ServersAuthorizationDbHandler) RemovePermissions(ctx context.Context, username string, serverId string, permissions models.Permission) error {
|
func (sa *ServersAuthorizationDbHandler) RemovePermissions(ctx context.Context, username string, serverId string, permissions models.Permission) error {
|
||||||
var serverPermissions ServerPermissions
|
var serverPermissions ServerPermissions
|
||||||
err := self.collection.FindOne(
|
err := sa.collection.FindOne(
|
||||||
ctx,
|
ctx,
|
||||||
bson.M{
|
bson.M{
|
||||||
"username": username,
|
"username": username,
|
||||||
"server_id": serverId,
|
"server_id": serverId,
|
||||||
},
|
},
|
||||||
).Decode(&serverPermissions)
|
).Decode(&serverPermissions)
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
newPermissions := serverPermissions.Permissions | permissions ^ permissions
|
newPermissions := serverPermissions.Permissions | permissions ^ permissions
|
||||||
|
|
||||||
_, err = self.collection.UpdateOne(
|
_, err = sa.collection.UpdateOne(
|
||||||
ctx,
|
ctx,
|
||||||
bson.M{
|
bson.M{
|
||||||
"username": username,
|
"username": username,
|
||||||
"server_id": serverId,
|
"server_id": serverId,
|
||||||
},
|
},
|
||||||
bson.M{"$set": bson.M{
|
bson.M{
|
||||||
"permissions": newPermissions,
|
"$set": bson.M{
|
||||||
},
|
"permissions": newPermissions,
|
||||||
|
},
|
||||||
},
|
},
|
||||||
)
|
)
|
||||||
|
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
func (self *ServersAuthorizationDbHandler) SetPermissions(ctx context.Context, username string, serverId string, permissions models.Permission) error {
|
func (sa *ServersAuthorizationDbHandler) SetPermissions(ctx context.Context, username string, serverId string, permissions models.Permission) error {
|
||||||
_, err := self.collection.UpdateOne(
|
_, err := sa.collection.UpdateOne(
|
||||||
ctx,
|
ctx,
|
||||||
bson.M{
|
bson.M{
|
||||||
"username": username,
|
"username": username,
|
||||||
"server_id": serverId,
|
"server_id": serverId,
|
||||||
},
|
},
|
||||||
bson.M{"$set": bson.M{
|
bson.M{
|
||||||
"permissions": permissions,
|
"$set": bson.M{
|
||||||
},
|
"permissions": permissions,
|
||||||
|
},
|
||||||
},
|
},
|
||||||
)
|
)
|
||||||
|
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
func (self *ServersAuthorizationDbHandler) GetPermissions(ctx context.Context, username string, serverId string) (models.Permission, error) {
|
func (sa *ServersAuthorizationDbHandler) GetPermissions(ctx context.Context, username string, serverId string) (models.Permission, error) {
|
||||||
var serverPermissions ServerPermissions
|
var serverPermissions ServerPermissions
|
||||||
|
|
||||||
err := self.collection.FindOne(
|
err := sa.collection.FindOne(
|
||||||
ctx,
|
ctx,
|
||||||
bson.M{
|
bson.M{
|
||||||
"username": username,
|
"username": username,
|
||||||
"server_id": serverId,
|
"server_id": serverId,
|
||||||
},
|
},
|
||||||
).Decode(&serverPermissions)
|
).Decode(&serverPermissions)
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
if err == mongo.ErrNoDocuments {
|
||||||
|
return 0, nil
|
||||||
|
}
|
||||||
return 0, err
|
return 0, err
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@@ -656,6 +656,10 @@ func (im *InstanceManager) StopFileBrowser(ctx context.Context, serverId string)
|
|||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func (im *InstanceManager) GetFileBrowserFromUrl(ctx context.Context, url string) (*models.FileBrowser, error) {
|
||||||
|
return im.GetFileBrowser(ctx, strings.Split(url, "/")[1])
|
||||||
|
}
|
||||||
|
|
||||||
func NewInstanceManager(config models.DockerInstanceManagerConfig, siteDomain string) (*InstanceManager, error) {
|
func NewInstanceManager(config models.DockerInstanceManagerConfig, siteDomain string) (*InstanceManager, error) {
|
||||||
apiClient, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
|
apiClient, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
@@ -59,6 +59,7 @@ type InstanceManager interface {
|
|||||||
|
|
||||||
// Read Only
|
// Read Only
|
||||||
GetFileBrowser(ctx context.Context, serverId string) (*models.FileBrowser, error)
|
GetFileBrowser(ctx context.Context, serverId string) (*models.FileBrowser, error)
|
||||||
|
GetFileBrowserFromUrl(ctx context.Context, url string) (*models.FileBrowser, error)
|
||||||
ListFileBrowsers(ctx context.Context) ([]models.FileBrowser, error)
|
ListFileBrowsers(ctx context.Context) ([]models.FileBrowser, error)
|
||||||
|
|
||||||
// Status Changing
|
// Status Changing
|
||||||
|
@@ -3,6 +3,7 @@ package kubernetes
|
|||||||
import (
|
import (
|
||||||
"context"
|
"context"
|
||||||
"io"
|
"io"
|
||||||
|
"log"
|
||||||
"os"
|
"os"
|
||||||
"path/filepath"
|
"path/filepath"
|
||||||
"strings"
|
"strings"
|
||||||
@@ -250,22 +251,24 @@ func (i *InstanceManager) InteractiveTerminal(ctx context.Context, serverId stri
|
|||||||
req := i.coreV1Cli.CoreV1().RESTClient().
|
req := i.coreV1Cli.CoreV1().RESTClient().
|
||||||
Post().
|
Post().
|
||||||
Resource("pods").
|
Resource("pods").
|
||||||
Namespace(i.Config.Namespace).
|
|
||||||
Name(serverId).
|
Name(serverId).
|
||||||
|
Namespace(i.Config.Namespace).
|
||||||
SubResource("attach").
|
SubResource("attach").
|
||||||
VersionedParams(&corev1.PodAttachOptions{
|
VersionedParams(&corev1.PodAttachOptions{
|
||||||
Container: "server",
|
Stdin: true,
|
||||||
Stdin: true,
|
Stdout: true,
|
||||||
Stdout: true,
|
Stderr: true,
|
||||||
Stderr: true,
|
TTY: true,
|
||||||
TTY: true,
|
|
||||||
}, clientgoscheme.ParameterCodec)
|
}, clientgoscheme.ParameterCodec)
|
||||||
|
|
||||||
executor, err := remotecommand.NewSPDYExecutor(i.restCfg, "POST", req.URL())
|
executor, err := remotecommand.NewSPDYExecutor(i.restCfg, "POST", req.URL())
|
||||||
go func() {
|
go func() {
|
||||||
defer stdoutWriter.Close()
|
defer stdoutWriter.Close()
|
||||||
defer stdinReader.Close()
|
defer stdinReader.Close()
|
||||||
_ = executor.StreamWithContext(ctx, remotecommand.StreamOptions{Stdin: stdinReader, Stdout: stdoutWriter, Stderr: stdoutWriter, Tty: true, TerminalSizeQueue: queue})
|
err := executor.StreamWithContext(ctx, remotecommand.StreamOptions{Stdin: stdinReader, Stdout: stdoutWriter, Stderr: stdoutWriter, Tty: true, TerminalSizeQueue: queue})
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("Failed to attach %e", err)
|
||||||
|
}
|
||||||
}()
|
}()
|
||||||
|
|
||||||
if err != nil {
|
if err != nil {
|
||||||
@@ -296,6 +299,18 @@ func (i *InstanceManager) GetFileBrowser(ctx context.Context, serverId string) (
|
|||||||
return &models.FileBrowser{ServerId: serverManager.Name, Id: serverManager.Name, Url: serverManager.Status.Browser.Url}, nil
|
return &models.FileBrowser{ServerId: serverManager.Name, Id: serverManager.Name, Url: serverManager.Status.Browser.Url}, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func (i *InstanceManager) GetFileBrowserFromUrl(ctx context.Context, url string) (*models.FileBrowser, error) {
|
||||||
|
serverManager := &servermanagerv1.ServerManager{}
|
||||||
|
urlSegments := strings.Split(url, "/")
|
||||||
|
namespace, serverId := urlSegments[2], urlSegments[3]
|
||||||
|
err := i.client.Get(ctx, client.ObjectKey{Namespace: namespace, Name: serverId}, serverManager)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
return &models.FileBrowser{ServerId: serverManager.Name, Id: serverManager.Name, Url: serverManager.Status.Browser.Url}, nil
|
||||||
|
}
|
||||||
|
|
||||||
func (i *InstanceManager) ListFileBrowsers(ctx context.Context) ([]models.FileBrowser, error) {
|
func (i *InstanceManager) ListFileBrowsers(ctx context.Context) ([]models.FileBrowser, error) {
|
||||||
serverManagers := &servermanagerv1.ServerManagerList{}
|
serverManagers := &servermanagerv1.ServerManagerList{}
|
||||||
err := i.client.List(ctx, serverManagers, &client.ListOptions{Namespace: i.Config.Namespace})
|
err := i.client.List(ctx, serverManagers, &client.ListOptions{Namespace: i.Config.Namespace})
|
||||||
|
Reference in New Issue
Block a user