mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
Alex ShtinandGitHub
8e8f1b0f7c
## What changed?
<!-- Describe what has changed in this PR -->
Remove license header from every file. Because it is really hard to
follow in this PR here is the summary:
1. License header is removed from all `.go` and `.proto` files
:fireworks::fireworks:🎆.
2. `LICENSE` file in the root directory has only Temporal and Uber
copyrights.
3. 5 other `LICENSE` files added to the packages which have copyrights
different from Temporal and Uber: Datadog, Xargin, "Mat Ryer, Tyler
Bunnell and contributors".
4. `license_file` flag is removed from all code generation tools.
5. `copyright_file` flag is removed from `go:generate mockgen`
directive.
6. All copyright related targets are removed from `Makefile`.
7. Updated Temporal copyright year to 2025 everywhere.
## Why?
<!-- Tell your future self why have you made these changes -->
I double checked with legal department that it is not needed to have
license header in every file. One file per repo is enough. I put all
copyrights to the root `LICENSE` file and removed header from all other
files. Also updated tools and `Makefile`.
75 lines
2.1 KiB
Go
75 lines
2.1 KiB
Go
package authorization
|
|
|
|
import (
|
|
"context"
|
|
|
|
"go.temporal.io/server/common/api"
|
|
)
|
|
|
|
type (
|
|
defaultAuthorizer struct {
|
|
}
|
|
)
|
|
|
|
var _ Authorizer = (*defaultAuthorizer)(nil)
|
|
|
|
// NewDefaultAuthorizer creates a default authorizer
|
|
func NewDefaultAuthorizer() Authorizer {
|
|
return &defaultAuthorizer{}
|
|
}
|
|
|
|
var resultAllow = Result{Decision: DecisionAllow}
|
|
var resultDeny = Result{Decision: DecisionDeny}
|
|
|
|
// Authorize determines if an API call by given claims should be allowed or denied.
|
|
// Rules:
|
|
//
|
|
// Health check APIs are allowed to everyone.
|
|
// System Admin is allowed to access all APIs on all namespaces and cluster-level.
|
|
// System Writer is allowed to access non admin APIs on all namespaces and cluster-level.
|
|
// System Reader is allowed to access readonly APIs on all namespaces and cluster-level.
|
|
// Namespace Admin is allowed to access all APIs on their namespaces.
|
|
// Namespace Writer is allowed to access non admin APIs on their namespaces.
|
|
// Namespace Reader is allowed to access non admin readonly APIs on their namespaces.
|
|
func (a *defaultAuthorizer) Authorize(_ context.Context, claims *Claims, target *CallTarget) (Result, error) {
|
|
// APIs that are essentially read-only health checks with no sensitive information are
|
|
// always allowed
|
|
if IsHealthCheckAPI(target.APIName) {
|
|
return resultAllow, nil
|
|
}
|
|
if claims == nil {
|
|
return resultDeny, nil
|
|
}
|
|
|
|
metadata := api.GetMethodMetadata(target.APIName)
|
|
|
|
var hasRole Role
|
|
switch metadata.Scope {
|
|
case api.ScopeCluster:
|
|
hasRole = claims.System
|
|
case api.ScopeNamespace:
|
|
// Note: system-level claims apply across all namespaces.
|
|
// Note: if claims.Namespace is nil or target.Namespace is not found, the lookup will return zero.
|
|
hasRole = claims.System | claims.Namespaces[target.Namespace]
|
|
default:
|
|
return resultDeny, nil
|
|
}
|
|
|
|
if hasRole >= getRequiredRole(metadata.Access) {
|
|
return resultAllow, nil
|
|
}
|
|
return resultDeny, nil
|
|
}
|
|
|
|
// Convert from api.Access to Role
|
|
func getRequiredRole(access api.Access) Role {
|
|
switch access {
|
|
case api.AccessReadOnly:
|
|
return RoleReader
|
|
case api.AccessWrite:
|
|
return RoleWriter
|
|
default:
|
|
return RoleAdmin
|
|
}
|
|
}
|