-
Notifications
You must be signed in to change notification settings - Fork 17
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Allow authorisation on Fetch and Push endpoints
Currently we support the authentication policies from bb-storage by way of using the common gRPC server, but we don't allow for granular authorisation on our endpoints! This adds the ability to configure authorizers (as in other Buildbarn components) to the two endpoints we expose. These are added at the top-level of configuration to simplify use, even though one could technically expose this as a configuration option to decorate fetchers and asset stores. In particular, a single global fetch authorizer is much simpler than having to configure a policy for remote fetching and fetching from assets that were explicitly Push'd.
- Loading branch information
1 parent
d3fcdae
commit 544ae68
Showing
18 changed files
with
535 additions
and
116 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| diff --git language/go/generate.go language/go/generate.go | ||
| index 53e397a..38855c6 100644 | ||
| --- language/go/generate.go | ||
| +++ language/go/generate.go | ||
| @@ -483,7 +483,7 @@ func (g *generator) generateLib(pkg *goPackage, embed string) *rule.Rule { | ||
| } else { | ||
| visibility = g.commonVisibility(pkg.importPath) | ||
| } | ||
| - g.setCommonAttrs(goLibrary, pkg.rel, visibility, pkg.library, embed) | ||
| + g.setCommonAttrs(goLibrary, pkg.rel, visibility, pkg.library, embed, true) | ||
| g.setImportAttrs(goLibrary, pkg.importPath) | ||
| return goLibrary | ||
| } | ||
| @@ -512,7 +512,7 @@ func (g *generator) generateBin(pkg *goPackage, library string) *rule.Rule { | ||
| return goBinary // empty | ||
| } | ||
| visibility := g.commonVisibility(pkg.importPath) | ||
| - g.setCommonAttrs(goBinary, pkg.rel, visibility, pkg.binary, library) | ||
| + g.setCommonAttrs(goBinary, pkg.rel, visibility, pkg.binary, library, true) | ||
| return goBinary | ||
| } | ||
|
|
||
| @@ -552,7 +552,7 @@ func (g *generator) generateTests(pkg *goPackage, library string) []*rule.Rule { | ||
| if test.hasInternalTest { | ||
| embed = library | ||
| } | ||
| - g.setCommonAttrs(goTest, pkg.rel, nil, test, embed) | ||
| + g.setCommonAttrs(goTest, pkg.rel, nil, test, embed, false) | ||
| if pkg.hasTestdata { | ||
| goTest.SetAttr("data", rule.GlobValue{Patterns: []string{"testdata/**"}}) | ||
| } | ||
| @@ -629,9 +629,13 @@ func (g *generator) maybeGenerateExtraLib(lib *rule.Rule, pkg *goPackage) *rule. | ||
| return r | ||
| } | ||
|
|
||
| -func (g *generator) setCommonAttrs(r *rule.Rule, pkgRel string, visibility []string, target goTarget, embed string) { | ||
| +func (g *generator) setCommonAttrs(r *rule.Rule, pkgRel string, visibility []string, target goTarget, embed string, flattenSrcs bool) { | ||
| if !target.sources.isEmpty() { | ||
| - r.SetAttr("srcs", target.sources.buildFlat()) | ||
| + if flattenSrcs { | ||
| + r.SetAttr("srcs", target.sources.buildFlat()) | ||
| + } else { | ||
| + r.SetAttr("srcs", target.sources.build()) | ||
| + } | ||
| } | ||
| if !target.embedSrcs.isEmpty() { | ||
| r.SetAttr("embedsrcs", target.embedSrcs.build()) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| package fetch | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| remoteasset "github.com/bazelbuild/remote-apis/build/bazel/remote/asset/v1" | ||
| "github.com/buildbarn/bb-storage/pkg/auth" | ||
| bb_digest "github.com/buildbarn/bb-storage/pkg/digest" | ||
| ) | ||
|
|
||
| // AuthorizingFetcher decorates Fetcher and validates the requests against an Authorizer | ||
| type AuthorizingFetcher struct { | ||
| Fetcher | ||
| authorizer auth.Authorizer | ||
| } | ||
|
|
||
| // NewAuthorizingFetcher creates a new AuthorizingFetcher | ||
| func NewAuthorizingFetcher(f Fetcher, authorizer auth.Authorizer) *AuthorizingFetcher { | ||
| return &AuthorizingFetcher{ | ||
| f, | ||
| authorizer, | ||
| } | ||
| } | ||
|
|
||
| // FetchBlob wraps FetchBlob requests, validate request against authorizer | ||
| func (af *AuthorizingFetcher) FetchBlob(ctx context.Context, req *remoteasset.FetchBlobRequest) (*remoteasset.FetchBlobResponse, error) { | ||
| instanceName, err := bb_digest.NewInstanceName(req.InstanceName) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| if err = auth.AuthorizeSingleInstanceName(ctx, af.authorizer, instanceName); err != nil { | ||
| return nil, err | ||
| } | ||
| return af.Fetcher.FetchBlob(ctx, req) | ||
| } | ||
|
|
||
| // FetchDirectory wraps FetchDirectory requests, validate request against authorizer | ||
| func (af *AuthorizingFetcher) FetchDirectory(ctx context.Context, req *remoteasset.FetchDirectoryRequest) (*remoteasset.FetchDirectoryResponse, error) { | ||
| instanceName, err := bb_digest.NewInstanceName(req.InstanceName) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| if err = auth.AuthorizeSingleInstanceName(ctx, af.authorizer, instanceName); err != nil { | ||
| return nil, err | ||
| } | ||
| return af.Fetcher.FetchDirectory(ctx, req) | ||
| } |
Oops, something went wrong.