luxolus
/
open-consul
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity

Merge pull request #12780 from hashicorp/oss-expanded-token-fix 

oss: Fix namespace default field names in expanded token output
This commit is contained in:
Kyle Havlovitz 2022-04-13 17:35:01 -07:00 committed by GitHub
parent 5eea62b47a 199f1c7200
commit 34280fc648
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 20 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
agent/consul/acl_endpoint.go
View File

@ -381,6 +381,9 @@ func (a *ACL) lookupExpandedTokenInfo(ws memdb.WatchSet, state *state.Store, tok
if err != nil {
return tokenInfo, err
}
if role == nil {
continue
}
for _, policy := range role.Policies {
policyIDs[policy.ID] = struct{}{}
@ -404,6 +407,9 @@ func (a *ACL) lookupExpandedTokenInfo(ws memdb.WatchSet, state *state.Store, tok
if err != nil {
return tokenInfo, err
}
if policy == nil {
continue
}
policies = append(policies, policy)
}
for _, policy := range identityPolicies {

4
api/acl.go
View File

@ -66,8 +66,8 @@ type ACLTokenExpanded struct {
ExpandedPolicies []ACLPolicy
ExpandedRoles []ACLRole
NamespaceDefaultPolicies []string
NamespaceDefaultRoles []string
NamespaceDefaultPolicyIDs []string
NamespaceDefaultRoleIDs []string
AgentACLDefaultPolicy string
AgentACLDownPolicy string

6
command/acl/token/formatter.go
View File

@ -239,17 +239,17 @@ func (f *prettyFormatter) FormatTokenExpanded(token *api.ACLTokenExpanded) (stri
buffer.WriteString("=== End of Authorizer Layer 0: Token ===\n")
if len(token.NamespaceDefaultPolicies) > 0 || len(token.NamespaceDefaultRoles) > 0 {
if len(token.NamespaceDefaultPolicyIDs) > 0 || len(token.NamespaceDefaultRoleIDs) > 0 {
buffer.WriteString("=== Start of Authorizer Layer 1: Token Namespace’s Defaults (Inherited) ===\n")
buffer.WriteString(fmt.Sprintf("Description: ACL Roles inherited by all Tokens in Namespace %q\n\n", token.Namespace))
buffer.WriteString("Namespace Policy Defaults:\n")
for _, policyID := range token.NamespaceDefaultPolicies {
for _, policyID := range token.NamespaceDefaultPolicyIDs {
formatPolicy(policies[policyID], WHITESPACE_2)
}
buffer.WriteString("Namespace Role Defaults:\n")
for _, roleID := range token.NamespaceDefaultRoles {
for _, roleID := range token.NamespaceDefaultRoleIDs {
formatRole(roles[roleID], WHITESPACE_2)
}

10
command/acl/token/formatter_test.go
View File

@ -408,11 +408,11 @@ var expandedTokenTestCases = map[string]testCase{
},
},
},
NamespaceDefaultPolicies: []string{"2b582ff1-4a43-457f-8a2b-30a8265e29a5"},
NamespaceDefaultRoles: []string{"56033f2b-e1a6-4905-b71d-e011c862bc65"},
AgentACLDefaultPolicy: "deny",
AgentACLDownPolicy: "extend-cache",
ResolvedByAgent: "server-1",
NamespaceDefaultPolicyIDs: []string{"2b582ff1-4a43-457f-8a2b-30a8265e29a5"},
NamespaceDefaultRoleIDs: []string{"56033f2b-e1a6-4905-b71d-e011c862bc65"},
AgentACLDefaultPolicy: "deny",
AgentACLDownPolicy: "extend-cache",
ResolvedByAgent: "server-1",
ACLToken: api.ACLToken{
AccessorID: "fbd2447f-7479-4329-ad13-b021d74f86ba",
SecretID: "869c6e91-4de9-4dab-b56e-87548435f9c6",

4
command/acl/token/testdata/FormatTokenExpanded/oss/basic.json.golden vendored
View File

@ -22,8 +22,8 @@
}
],
"ExpandedRoles": null,
"NamespaceDefaultPolicies": null,
"NamespaceDefaultRoles": null,
"NamespaceDefaultPolicyIDs": null,
"NamespaceDefaultRoleIDs": null,
"AgentACLDefaultPolicy": "allow",
"AgentACLDownPolicy": "deny",
"ResolvedByAgent": "leader",

4
command/acl/token/testdata/FormatTokenExpanded/oss/complex.json.golden vendored
View File

@ -133,10 +133,10 @@
"ModifyIndex": 0
}
],
"NamespaceDefaultPolicies": [
"NamespaceDefaultPolicyIDs": [
"2b582ff1-4a43-457f-8a2b-30a8265e29a5"
],
"NamespaceDefaultRoles": [
"NamespaceDefaultRoleIDs": [
"56033f2b-e1a6-4905-b71d-e011c862bc65"
],
"AgentACLDefaultPolicy": "deny",