Implement missing funcs (still missing a few...)

Author: christeredvartsen

cmd/setup_local/main.go

@@ -20,7 +20,6 @@ import (
 	"github.com/nais/api/internal/graph/model"
 	"github.com/nais/api/internal/graph/pagination"
 	"github.com/nais/api/internal/logger"
-	"github.com/nais/api/internal/role"
 	"github.com/nais/api/internal/slug"
 	"github.com/nais/api/internal/team"
 	"github.com/nais/api/internal/user"
@@ -267,7 +266,6 @@ func run(ctx context.Context, cfg *seedConfig, log logrus.FieldLogger) error {
 			users = append(users, u)
 			emails[email] = struct{}{}
 		}
-		usersCreated := len(users)
 
 		var devteam *team.Team
 		devteam, err = team.Get(ctx, "devteam")
@@ -344,14 +342,14 @@ func run(ctx context.Context, cfg *seedConfig, log logrus.FieldLogger) error {
 			}
 
 			for o := 0; o < *cfg.NumOwnersPerTeam; o++ {
-				u := users[rand.IntN(usersCreated)]
+				u := users[rand.IntN(len(users))]
 				if err = authz.MakeUserTeamOwner(ctx, u.UUID, t.Slug); err != nil {
 					return fmt.Errorf("make user %q owner of team %q: %w", u.Email, t.Slug, err)
 				}
 			}
 
 			for o := 0; o < *cfg.NumMembersPerTeam; o++ {
-				u := users[rand.IntN(usersCreated)]
+				u := users[rand.IntN(len(users))]
 				if err = authz.MakeUserTeamMember(ctx, u.UUID, t.Slug); err != nil {
 					return fmt.Errorf("make user %q member of team %q: %w", u.Email, t.Slug, err)
 				}

internal/auth/authz/authorizations.go

@@ -10,29 +10,11 @@ const (
 	AuthorizationServiceAccountsRead   Authorization = "service_accounts:read"
 	AuthorizationServiceAccountsUpdate Authorization = "service_accounts:update"
 	AuthorizationTeamsCreate           Authorization = "teams:create"
-	AuthorizationTeamsDelete           Authorization = "teams:delete"
 	AuthorizationTeamsList             Authorization = "teams:list"
 	AuthorizationTeamsRead             Authorization = "teams:read"
-	AuthorizationTeamsMetadataUpdate   Authorization = "teams:metadata:update"
 	AuthorizationTeamsMembersAdmin     Authorization = "teams:members:admin"
-	AuthorizationSecretsCreate         Authorization = "teams:secrets:create"
-	AuthorizationSecretsDelete         Authorization = "teams:secrets:delete"
-	AuthorizationSecretsUpdate         Authorization = "teams:secrets:update"
-	AuthorizationSecretsRead           Authorization = "teams:secrets:read"
 	AuthorizationSecretsList           Authorization = "teams:secrets:list"
-	AuthorizationRepositoriesCreate    Authorization = "repositories:create"
-	AuthorizationRepositoriesDelete    Authorization = "repositories:delete"
-	AuthorizationApplicationsUpdate    Authorization = "applications:update"
-	AuthorizationApplicationsDelete    Authorization = "applications:delete"
-	AuthorizationJobsUpdate            Authorization = "jobs:update"
-	AuthorizationJobsDelete            Authorization = "jobs:delete"
 	AuthorizationUsersList             Authorization = "users:list"
-	AuthorizationTeamsSynchronize      Authorization = "teams:synchronize"
-	AuthorizationUsersyncSynchronize   Authorization = "usersync:synchronize"
-	AuthorizationDeployKeyRead         Authorization = "deploy_key:read"
-	AuthorizationDeployKeyUpdate       Authorization = "deploy_key:update"
-	AuthorizationUnleashCreate         Authorization = "unleash:create"
-	AuthorizationUnleashUpdate         Authorization = "unleash:update"
 )
 
 var roles = map[authzsql.RoleName][]Authorization{

internal/auth/authz/authz.go

@@ -4,7 +4,6 @@ import (
 	"context"
 
 	"github.com/google/uuid"
-	"github.com/nais/api/internal/graph/apierror"
 )
 
 type ContextKey string
@@ -20,16 +19,6 @@ type Actor struct {
 	Roles []*Role
 }
 
-var ErrNotAuthenticated = apierror.Errorf("Valid user required. You are not logged in.")
-
-func (u *Actor) Authenticated() bool {
-	if u == nil || u.User == nil {
-		return false
-	}
-
-	return true
-}
-
 const contextKeyUser ContextKey = "actor"
 
 // ContextWithActor Return a context with an actor attached to it.
@@ -46,94 +35,3 @@ func ActorFromContext(ctx context.Context) *Actor {
 	actor, _ := ctx.Value(contextKeyUser).(*Actor)
 	return actor
 }
-
-/*
-// requireGlobalAuthorization Require an actor to have a specific authorization through a globally assigned role.
-func requireGlobalAuthorization(actor *Actor, requiredAuthzName string) error {
-	if !actor.Authenticated() {
-		return ErrNotAuthenticated
-	}
-
-	authorizations := make(map[string]struct{})
-
-	for _, r := range actor.Roles {
-		if r.Name == "Admin" {
-			return nil
-		}
-
-		authorizations, err := ListAuthorizationsInRole(r.Name)
-		roleAuthz, err := r.Authorizations()
-		if err != nil {
-			return err
-		}
-		if r.IsGlobal() {
-			for _, authorization := range roleAuthz {
-				authorizations[authorization] = struct{}{}
-			}
-		}
-	}
-
-	return authorized(authorizations, requiredAuthzName)
-}
-
-
-
-// requireTeamAuthorization Require an actor to have a specific authorization through a globally assigned or a correctly
-// targeted role.
-func requireTeamAuthorization(actor *Actor, requiredAuthzName string, targetTeamSlug slug.Slug) error {
-	if !actor.Authenticated() {
-		return ErrNotAuthenticated
-	}
-
-	authorizations := make(map[string]struct{})
-
-	for _, r := range actor.Roles {
-		if r.Name == "Admin" {
-			return nil
-		}
-
-		roleAuthz, err := r.Authorizations()
-		if err != nil {
-			return err
-		}
-		if r.IsGlobal() || r.TargetsTeam(targetTeamSlug) {
-			for _, authorization := range roleAuthz {
-				authorizations[authorization] = struct{}{}
-			}
-		}
-	}
-
-	return authorized(authorizations, requiredAuthzName)
-}
-
-// RequireTeamAuthorizationCtx fetches the actor from the context and checks if it has the required authorization.
-func RequireTeamAuthorizationCtx(ctx context.Context, requiredAuthzName string, targetTeamSlug slug.Slug) error {
-	return RequireTeamAuthorization(ActorFromContext(ctx), requiredAuthzName, targetTeamSlug)
-}
-*/
-
-// authorized Check if one of the authorizations in the map matches the required authorization.
-func authorized(authorizations map[string]struct{}, requiredAuthzName string) error {
-	for authorization := range authorizations {
-		if authorization == requiredAuthzName {
-			return nil
-		}
-	}
-
-	return ErrMissingAuthorization{authorization: string(requiredAuthzName)}
-}
-
-func RequireGlobalAdmin(ctx context.Context) error {
-	actor := ActorFromContext(ctx)
-	if !actor.Authenticated() {
-		return ErrNotAuthenticated
-	}
-
-	for _, r := range actor.Roles {
-		if r.Name == "Admin" {
-			return nil
-		}
-	}
-
-	return ErrMissingAuthorization{authorization: "global:admin"}
-}

internal/auth/authz/authz_test.go

@@ -2,20 +2,13 @@ package authz_test
 
 import (
 	"context"
-	"errors"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	"github.com/nais/api/internal/auth/authz/authzsql"
-	"github.com/nais/api/internal/slug"
+	"github.com/nais/api/internal/auth/authz"
 	"github.com/nais/api/internal/user"
 )
 
-const (
-	authTeamCreateError = `required authorization: "teams:create"`
-	authTeamUpdateError = `required authorization: "teams:metadata:update"`
-)
-
 func TestContextWithUser(t *testing.T) {
 	ctx := context.Background()
 	if authz.ActorFromContext(ctx) != nil {
@@ -41,108 +34,3 @@ func TestContextWithUser(t *testing.T) {
 		t.Errorf("diff: -want +got\n%s", diff)
 	}
 }
-
-func TestRequireGlobalAuthorization(t *testing.T) {
-	u := &user.User{
-		Name:  "User Name",
-		Email: "[email protected]",
-	}
-
-	t.Run("Nil user", func(t *testing.T) {
-		if !errors.Is(authz.RequireGlobalAuthorization(nil, authz.AuthorizationTeamsCreate), authz.ErrNotAuthenticated) {
-			t.Fatal("RequireGlobalAuthorization(ctx): expected ErrNotAuthenticated")
-		}
-	})
-
-	t.Run("User with no roles", func(t *testing.T) {
-		contextUser := authz.ActorFromContext(authz.ContextWithActor(context.Background(), u, []*authz.Role{}))
-		if authz.RequireGlobalAuthorization(contextUser, authz.AuthorizationTeamsCreate).Error() != authTeamCreateError {
-			t.Fatalf("RequireGlobalAuthorization(ctx): expected error text to match %q", authTeamCreateError)
-		}
-	})
-
-	t.Run("User with insufficient roles", func(t *testing.T) {
-		userRoles := []*authz.Role{{Name: authzsql.RoleNameTeamviewer}}
-		contextUser := authz.ActorFromContext(authz.ContextWithActor(context.Background(), u, userRoles))
-		if authz.RequireGlobalAuthorization(contextUser, authz.AuthorizationTeamsCreate).Error() != authTeamCreateError {
-			t.Fatalf("RequireGlobalAuthorization(ctx): expected error text to match %q", authTeamCreateError)
-		}
-	})
-
-	t.Run("User with sufficient role", func(t *testing.T) {
-		userRoles := []*authz.Role{{Name: authzsql.RoleNameTeamcreator}}
-		contextUser := authz.ActorFromContext(authz.ContextWithActor(context.Background(), u, userRoles))
-		if authz.RequireGlobalAuthorization(contextUser, authz.AuthorizationTeamsCreate) != nil {
-			t.Fatal("RequireGlobalAuthorization(ctx): expected nil error")
-		}
-	})
-}
-
-func TestRequireAuthorizationForTeamTarget(t *testing.T) {
-	u := &user.User{
-		Name:  "User Name",
-		Email: "[email protected]",
-	}
-	targetTeamSlug := slug.Slug("slug")
-
-	t.Run("Nil user", func(t *testing.T) {
-		if !errors.Is(authz.RequireTeamAuthorization(nil, authz.AuthorizationTeamsCreate, targetTeamSlug), authz.ErrNotAuthenticated) {
-			t.Fatal("RequireTeamAuthorization(ctx): expected ErrNotAuthenticated")
-		}
-	})
-
-	t.Run("User with no roles", func(t *testing.T) {
-		contextUser := authz.ActorFromContext(authz.ContextWithActor(context.Background(), u, []*authz.Role{}))
-		if authz.RequireTeamAuthorization(contextUser, authz.AuthorizationTeamsCreate, targetTeamSlug).Error() != authTeamCreateError {
-			t.Fatalf("RequireTeamAuthorization(ctx): expected error text to match %q", authTeamCreateError)
-		}
-	})
-
-	t.Run("User with insufficient roles", func(t *testing.T) {
-		userRoles := []*authz.Role{{Name: authzsql.RoleNameTeamviewer}}
-		contextUser := authz.ActorFromContext(authz.ContextWithActor(context.Background(), u, userRoles))
-		err := authz.RequireTeamAuthorization(contextUser, authz.AuthorizationTeamsMetadataUpdate, targetTeamSlug)
-		if err.Error() != authTeamUpdateError {
-			t.Fatalf("RequireTeamAuthorization(ctx): expected error text to match %q", authTeamUpdateError)
-		}
-	})
-
-	t.Run("User with targeted role", func(t *testing.T) {
-		userRoles := []*authz.Role{
-			{
-				Name:           authzsql.RoleNameTeamowner,
-				TargetTeamSlug: &targetTeamSlug,
-			},
-		}
-		contextUser := authz.ActorFromContext(authz.ContextWithActor(context.Background(), u, userRoles))
-		if authz.RequireTeamAuthorization(contextUser, authz.AuthorizationTeamsMetadataUpdate, targetTeamSlug) != nil {
-			t.Fatal("RequireTeamAuthorization(ctx): expected nil error")
-		}
-	})
-
-	t.Run("User with targeted role for wrong target", func(t *testing.T) {
-		wrongSlug := slug.Slug("other-team")
-		userRoles := []*authz.Role{
-			{
-				Name:           authzsql.RoleNameTeamowner,
-				TargetTeamSlug: &wrongSlug,
-			},
-		}
-		contextUser := authz.ActorFromContext(authz.ContextWithActor(context.Background(), u, userRoles))
-		if authz.RequireTeamAuthorization(contextUser, authz.AuthorizationTeamsMetadataUpdate, targetTeamSlug).Error() != authTeamUpdateError {
-			t.Fatalf("RequireTeamAuthorization(ctx): expected error text to match %q", authTeamUpdateError)
-		}
-	})
-
-	t.Run("User with global role", func(t *testing.T) {
-		userRoles := []*authz.Role{
-			{
-				Name: authzsql.RoleNameAdmin,
-			},
-		}
-		contextUser := authz.ActorFromContext(authz.ContextWithActor(context.Background(), u, userRoles))
-		if authz.RequireTeamAuthorization(contextUser, authz.AuthorizationTeamsMetadataUpdate, targetTeamSlug) != nil {
-			t.Fatal("RequireTeamAuthorization(ctx): expected nil error")
-		}
-	})
-}