gravitl/netmaker
1
1
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-09-07 05:34:38 +08:00
Code Issues Projects Releases Packages Wiki Activity

remove user role from policy types

Browse source
This commit is contained in:
abhishek9686 2024-10-29 08:51:27 +04:00
parent a954f87c9d
commit 2cc54d949c
5 changed files with 7 additions and 70 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
controllers/acls.go
View file

@ -44,7 +44,6 @@ func aclPolicyTypes(w http.ResponseWriter, r *http.Request) {
}, },
SrcGroupTypes: []models.AclGroupType{ SrcGroupTypes: []models.AclGroupType{
models.UserAclID, models.UserAclID,
//models.UserRoleAclID,
models.UserGroupAclID, models.UserGroupAclID,
models.DeviceAclID, models.DeviceAclID,
}, },

14
logic/acls.go
View file

@ -56,10 +56,6 @@ func CreateDefaultAclNetworkPolicies(netID models.NetworkID) {
ID: models.UserGroupAclID, ID: models.UserGroupAclID,
Value: "*", Value: "*",
}, },
// {
// ID: models.UserRoleAclID,
// Value: "*",
// },
}, },
Dst: []models.AclPolicyTag{{ Dst: []models.AclPolicyTag{{
ID: models.DeviceAclID, ID: models.DeviceAclID,
@ -175,9 +171,7 @@ func IsAclPolicyValid(acl models.Acl) bool {
if srcI.Value == "*" { if srcI.Value == "*" {
continue continue
} }
if srcI.ID != models.UserAclID { if srcI.ID != models.UserAclID && srcI.ID != models.UserGroupAclID {
// && srcI.ID != models.UserGroupAclID && srcI.ID != models.UserRoleAclID
return false return false
} }
// check if user group is valid // check if user group is valid
@ -186,12 +180,6 @@ func IsAclPolicyValid(acl models.Acl) bool {
if err != nil { if err != nil {
return false return false
} }
// } else if srcI.ID == models.UserRoleAclID {
// _, err := GetRole(models.UserRoleID(srcI.Value))
// if err != nil {
// return false
// }
} else if srcI.ID == models.UserGroupAclID { } else if srcI.ID == models.UserGroupAclID {
err := IsGroupValid(models.UserGroupID(srcI.Value)) err := IsGroupValid(models.UserGroupID(srcI.Value))

5
models/acl.go
View file

@ -44,9 +44,8 @@ type AclPolicyTag struct {
type AclGroupType string type AclGroupType string
const ( const (
UserAclID AclGroupType = "user" UserAclID AclGroupType = "user"
UserGroupAclID AclGroupType = "user-group" UserGroupAclID AclGroupType = "user-group"
//UserRoleAclID AclGroupType = "user-role"
DeviceAclID AclGroupType = "tag" DeviceAclID AclGroupType = "tag"
NetmakerIPAclID AclGroupType = "ip" NetmakerIPAclID AclGroupType = "ip"
NetmakerSubNetRangeAClID AclGroupType = "ipset" NetmakerSubNetRangeAClID AclGroupType = "ipset"

8
pro/controllers/users.go
View file

@ -834,7 +834,7 @@ func getUserRemoteAccessNetworks(w http.ResponseWriter, r *http.Request) {
userGws := make(map[string][]models.UserRemoteGws) userGws := make(map[string][]models.UserRemoteGws)
networks := []models.Network{} networks := []models.Network{}
networkMap := make(map[string]struct{}) networkMap := make(map[string]struct{})
userGwNodes := proLogic.GetUserRAGNodes(*user) userGwNodes := proLogic.GetUserRAGNodesV1(*user)
for _, node := range userGwNodes { for _, node := range userGwNodes {
network, err := logic.GetNetwork(node.Network) network, err := logic.GetNetwork(node.Network)
if err != nil { if err != nil {
@ -876,7 +876,7 @@ func getUserRemoteAccessNetworkGateways(w http.ResponseWriter, r *http.Request)
} }
userGws := []models.UserRAGs{} userGws := []models.UserRAGs{}
userGwNodes := proLogic.GetUserRAGNodes(*user) userGwNodes := proLogic.GetUserRAGNodesV1(*user)
for _, node := range userGwNodes { for _, node := range userGwNodes {
if node.Network != network { if node.Network != network {
continue continue
@ -931,7 +931,7 @@ func getRemoteAccessGatewayConf(w http.ResponseWriter, r *http.Request) {
return return
} }
userGwNodes := proLogic.GetUserRAGNodes(*user) userGwNodes := proLogic.GetUserRAGNodesV1(*user)
if _, ok := userGwNodes[remoteGwID]; !ok { if _, ok := userGwNodes[remoteGwID]; !ok {
logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("access denied"), "forbidden")) logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("access denied"), "forbidden"))
return return
@ -1075,7 +1075,7 @@ func getUserRemoteAccessGwsV1(w http.ResponseWriter, r *http.Request) {
logic.ReturnErrorResponse(w, r, logic.FormatError(err, "internal")) logic.ReturnErrorResponse(w, r, logic.FormatError(err, "internal"))
return return
} }
userGwNodes := proLogic.GetUserRAGNodes(*user) userGwNodes := proLogic.GetUserRAGNodesV1(*user)
for _, extClient := range allextClients { for _, extClient := range allextClients {
node, ok := userGwNodes[extClient.IngressGatewayID] node, ok := userGwNodes[extClient.IngressGatewayID]
if !ok { if !ok {

49
pro/logic/user_mgmt.go
View file

@ -1140,55 +1140,6 @@ func CreateDefaultUserPolicies(netID models.NetworkID) {
if netID.String() == "" { if netID.String() == "" {
return return
} }
// if !logic.IsAclExists(models.AclID(fmt.Sprintf("%s.%s", netID, models.NetworkAdmin))) {
// defaultUserAcl := models.Acl{
// ID: models.AclID(fmt.Sprintf("%s.%s", netID, models.NetworkAdmin)),
// Name: models.NetworkAdmin.String(),
// Default: true,
// NetworkID: netID,
// RuleType: models.UserPolicy,
// Src: []models.AclPolicyTag{
// {
// ID: models.UserRoleAclID,
// Value: fmt.Sprintf("%s-%s", netID, models.NetworkAdmin),
// }},
// Dst: []models.AclPolicyTag{
// {
// ID: models.DeviceAclID,
// Value: fmt.Sprintf("%s.%s", netID, models.RemoteAccessTagName),
// },
// },
// AllowedDirection: models.TrafficDirectionUni,
// Enabled: true,
// CreatedBy: "auto",
// CreatedAt: time.Now().UTC(),
// }
// logic.InsertAcl(defaultUserAcl)
// }
// if !logic.IsAclExists(models.AclID(fmt.Sprintf("%s.%s", netID, models.NetworkUser))) {
// defaultUserAcl := models.Acl{
// ID: models.AclID(fmt.Sprintf("%s.%s", netID, models.NetworkUser)),
// Name: models.NetworkUser.String(),
// Default: true,
// NetworkID: netID,
// RuleType: models.UserPolicy,
// Src: []models.AclPolicyTag{
// {
// ID: models.UserRoleAclID,
// Value: fmt.Sprintf("%s-%s", netID, models.NetworkUser),
// }},
// Dst: []models.AclPolicyTag{
// {
// ID: models.DeviceAclID,
// Value: fmt.Sprintf("%s.%s", netID, models.RemoteAccessTagName),
// }},
// AllowedDirection: models.TrafficDirectionUni,
// Enabled: true,
// CreatedBy: "auto",
// CreatedAt: time.Now().UTC(),
// }
// logic.InsertAcl(defaultUserAcl)
// }
if !logic.IsAclExists(models.AclID(fmt.Sprintf("%s.%s-grp", netID, models.NetworkAdmin))) { if !logic.IsAclExists(models.AclID(fmt.Sprintf("%s.%s-grp", netID, models.NetworkAdmin))) {
defaultUserAcl := models.Acl{ defaultUserAcl := models.Acl{