mirror of https://github.com/status-im/consul.git
69 lines
2.7 KiB
JavaScript
69 lines
2.7 KiB
JavaScript
import Adapter from './application';
|
|
import { inject as service } from '@ember/service';
|
|
|
|
export default class PermissionAdapter extends Adapter {
|
|
@service('env') env;
|
|
@service('settings') settings;
|
|
|
|
requestForAuthorize(request, { dc, ns, partition, resources = [], index }) {
|
|
// the authorize endpoint is slightly different to all others in that it
|
|
// ignores an ns parameter, but accepts a Namespace property on each
|
|
// resource. Here we hide this difference from the rest of the app as
|
|
// currently we never need to ask for permissions/resources for multiple
|
|
// different namespaces in one call so here we use the ns param and add
|
|
// this to the resources instead of passing through on the queryParameter
|
|
//
|
|
// ^ same goes for Partitions
|
|
|
|
if (this.env.var('CONSUL_NSPACES_ENABLED')) {
|
|
resources = resources.map(item => ({ ...item, Namespace: ns }));
|
|
}
|
|
if (this.env.var('CONSUL_PARTITIONS_ENABLED')) {
|
|
resources = resources.map(item => ({ ...item, Partition: partition }));
|
|
}
|
|
return request`
|
|
POST /v1/internal/acl/authorize?${{ dc }}
|
|
|
|
${resources}
|
|
`;
|
|
}
|
|
|
|
authorize(store, type, id, snapshot) {
|
|
return this.rpc(
|
|
async (adapter, request, serialized, unserialized) => {
|
|
// the authorize endpoint does not automatically take into account the
|
|
// default namespace of the token on the backend. This means that we
|
|
// need to add the default namespace of the token on the frontend
|
|
// instead. Decided this is the best place for it as its almost hidden
|
|
// from the rest of the app so from an app eng point of view it almost
|
|
// feels like it does happen on the backend.
|
|
// Same goes ^ for partitions
|
|
const nspacesEnabled = this.env.var('CONSUL_NSPACES_ENABLED');
|
|
const partitionsEnabled = this.env.var('CONSUL_PARTITIONS_ENABLED');
|
|
if(nspacesEnabled || partitionsEnabled) {
|
|
const token = await this.settings.findBySlug('token');
|
|
if(nspacesEnabled) {
|
|
if(typeof serialized.ns === 'undefined' || serialized.ns.length === 0) {
|
|
serialized.ns = token.Namespace;
|
|
}
|
|
}
|
|
if(partitionsEnabled) {
|
|
if(typeof serialized.partition === 'undefined' || serialized.partition.length === 0) {
|
|
serialized.partition = token.Partition;
|
|
}
|
|
}
|
|
}
|
|
return adapter.requestForAuthorize(request, serialized);
|
|
},
|
|
function(serializer, respond, serialized, unserialized) {
|
|
// Completely skip the serializer here
|
|
return respond(function(headers, body) {
|
|
return body;
|
|
});
|
|
},
|
|
snapshot,
|
|
type.modelName
|
|
);
|
|
}
|
|
}
|