mirror of
https://github.com/status-im/consul.git
synced 2025-01-09 13:26:07 +00:00
5fb9df1640
* Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * add missing license headers * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>
72 lines
2.1 KiB
Go
72 lines
2.1 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package acl
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
|
|
"github.com/hashicorp/consul/acl"
|
|
"github.com/hashicorp/consul/agent/consul/auth"
|
|
external "github.com/hashicorp/consul/agent/grpc-external"
|
|
"github.com/hashicorp/consul/proto-public/pbacl"
|
|
)
|
|
|
|
// Logout destroys the given ACL token once the caller is done with it.
|
|
func (s *Server) Logout(ctx context.Context, req *pbacl.LogoutRequest) (*pbacl.LogoutResponse, error) {
|
|
logger := s.Logger.Named("logout").With("request_id", external.TraceID())
|
|
logger.Trace("request received")
|
|
|
|
if err := s.requireACLsEnabled(logger); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if req.Token == "" {
|
|
return nil, status.Error(codes.InvalidArgument, "token is required")
|
|
}
|
|
|
|
// Forward request to leader in the requested datacenter.
|
|
var rsp *pbacl.LogoutResponse
|
|
handled, err := s.forwardWriteDC(req.Datacenter, func(conn *grpc.ClientConn) error {
|
|
var err error
|
|
rsp, err = pbacl.NewACLServiceClient(conn).Logout(ctx, req)
|
|
return err
|
|
}, logger)
|
|
if handled || err != nil {
|
|
return rsp, err
|
|
}
|
|
|
|
if err := s.requireLocalTokens(logger); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
err = s.NewTokenWriter().Delete(req.Token, true)
|
|
switch {
|
|
case errors.Is(err, auth.ErrCannotWriteGlobalToken):
|
|
// Writes to global tokens must be forwarded to the primary DC.
|
|
req.Datacenter = s.PrimaryDatacenter
|
|
|
|
_, err = s.forwardWriteDC(s.PrimaryDatacenter, func(conn *grpc.ClientConn) error {
|
|
var err error
|
|
rsp, err = pbacl.NewACLServiceClient(conn).Logout(ctx, req)
|
|
return err
|
|
}, logger)
|
|
return rsp, err
|
|
case errors.Is(err, acl.ErrNotFound):
|
|
// No token? Pretend the delete was successful (for idempotency).
|
|
return &pbacl.LogoutResponse{}, nil
|
|
case errors.Is(err, acl.ErrPermissionDenied):
|
|
return nil, status.Error(codes.PermissionDenied, err.Error())
|
|
case err != nil:
|
|
logger.Error("failed to delete token", "error", err.Error())
|
|
return nil, status.Error(codes.Internal, "failed to delete token")
|
|
}
|
|
|
|
return &pbacl.LogoutResponse{}, nil
|
|
}
|