opensource/magistrala
1
0
Fork 0
mirror of https://github.com/absmach/magistrala.git synced 2026-08-07 07:14:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

NOISSUE - Remove unwanted alarms operations (#3548)
Property Based Tests / api-test (push) Has been cancelled
Details
Continuous Delivery / lint-and-build (push) Has been cancelled
Details
Deploy GitHub Pages / swagger-ui (push) Has been cancelled
Details
CI Pipeline / Lint Proto (push) Has been cancelled
Details
CI Pipeline / Detect Changes (push) Has been cancelled
Details
Continuous Delivery / Build and Push Docker Images (push) Has been cancelled
Details
CI Pipeline / lint-and-build (push) Has been cancelled
Details
CI Pipeline / Test ${{ matrix.module }} (push) Has been cancelled
Details
CI Pipeline / Upload Coverage (push) Has been cancelled
Details

Browse Source 
Signed-off-by: Arvindh <arvindh91@gmail.com>
This commit is contained in:
Arvindh
2026-07-08 15:57:47 +05:30
committed by GitHub
parent 6ed7ca6a42
commit 513a84361b
5 changed files with 24 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
alarms/middleware/authorization.go
+14 -19
View File
@@ -140,11 +140,8 @@ func (am *authorizationMiddleware) ListAlarms(ctx context.Context, session authn
session.SuperAdmin = true
case errors.Contains(err, svcerr.ErrSuperAdminAction):
if err := am.authorizeTenantAlarm(ctx, operations.OpViewAlarm, session); err != nil {
if alarmErr := am.authorizeAlarmType(ctx, operations.OpViewAlarm, session, ""); alarmErr == nil {
break
}
if pm.RuleID != "" {
if ruleErr := am.authorizeRuleRead(ctx, session, pm.RuleID); ruleErr != nil {
if ruleErr := am.authorizeRuleAlarmRead(ctx, session, pm.RuleID); ruleErr != nil {
return alarms.AlarmsPage{}, errors.Wrap(errDomainViewAlarms, err)
}
break
@@ -186,9 +183,6 @@ func (am *authorizationMiddleware) authorizeAlarmOrRule(ctx context.Context, op
if tenantErr == nil {
return nil
}
if err := am.authorizeAlarmType(ctx, op, session, alarm.ID); err == nil {
return nil
}
if alarm.RuleID == "" {
return tenantErr
}
@@ -203,13 +197,10 @@ func (am *authorizationMiddleware) authorizeViewAlarm(ctx context.Context, sessi
if tenantErr == nil {
return nil
}
if err := am.authorizeAlarmType(ctx, operations.OpViewAlarm, session, alarm.ID); err == nil {
return nil
}
if alarm.RuleID == "" {
return tenantErr
}
if err := am.authorizeRuleRead(ctx, session, alarm.RuleID); err != nil {
if err := am.authorizeRuleAlarmRead(ctx, session, alarm.RuleID); err != nil {
return tenantErr
}
return nil
@@ -219,13 +210,13 @@ func (am *authorizationMiddleware) authorizeTenantAlarm(ctx context.Context, op
return am.authorize(ctx, op, session, policies.DomainType, session.DomainID, atom.KindAlarm)
}
func (am *authorizationMiddleware) authorizeAlarmType(ctx context.Context, op permissions.Operation, session authn.Session, alarmID string) error {
return am.authorize(ctx, op, session, policies.AlarmsType, alarmID, atom.KindAlarm)
}
func (am *authorizationMiddleware) authorizeRuleRead(ctx context.Context, session authn.Session, ruleID string) error {
func (am *authorizationMiddleware) authorizeRuleAlarmRead(ctx context.Context, session authn.Session, ruleID string) error {
if am.atomAuthz != nil {
return atom.Authorize(ctx, am.atomAuthz, session, policies.ViewPermission, policies.RulesType, ruleID, atom.KindRule)
return am.authorize(ctx, operations.OpViewAlarm, session, policies.RulesType, ruleID, atom.KindRule)
}
perm, err := am.entitiesOps.GetPermission(operations.EntityType, operations.OpViewAlarm)
if err != nil {
return err
}
pr := smqauthz.PolicyReq{
Domain: session.DomainID,
@@ -234,7 +225,7 @@ func (am *authorizationMiddleware) authorizeRuleRead(ctx context.Context, sessio
Subject: session.DomainUserID,
Object: ruleID,
ObjectType: policies.RulesType,
Permission: policies.ViewPermission,
Permission: perm.String(),
}
return am.authz.Authorize(ctx, pr, nil)
}
@@ -244,12 +235,16 @@ func (am *authorizationMiddleware) authorizedReadableRuleIDs(ctx context.Context
if !ok {
return nil, errors.ErrAuthorization
}
perm, err := am.entitiesOps.GetPermission(operations.EntityType, operations.OpViewAlarm)
if err != nil {
return nil, err
}
var ids []string
for offset := uint64(0); ; offset += atomAuthorizedRulePageLimit {
page, err := lister.AuthorizedObjectIDs(ctx, atom.AuthorizedObjectIDsQuery{
SubjectID: atom.SubjectID(session),
Action: atom.CapabilityName(policies.ViewPermission),
Action: atom.CapabilityName(perm.String()),
ObjectKind: atomObjectKindResource,
ObjectType: atomObjectTypeResourceRule,
TenantID: session.DomainID,
alarms/middleware/authorization_test.go
+8 -76
View File
@@ -85,16 +85,13 @@ func TestListAlarmsFiltersToReadableRulesWhenTenantAlarmReadDenied(t *testing.T)
_, err = wrapped.ListAlarms(context.Background(), authn.Session{UserID: "user-1", DomainID: "domain-1"}, pm)
require.NoError(t, err)
require.Len(t, authz.reqs, 2)
require.Len(t, authz.reqs, 1)
assert.Equal(t, "alarm_read", authz.reqs[0].Action)
assert.Equal(t, "tenant", authz.reqs[0].ObjectKind)
assert.Equal(t, "alarm_read", authz.reqs[1].Action)
assert.Equal(t, "resource", authz.reqs[1].ObjectKind)
assert.Equal(t, "alarms", authz.reqs[1].Context["legacy_object_type"])
require.Len(t, authz.queries, 1)
assert.Equal(t, atom.AuthorizedObjectIDsQuery{
SubjectID: "user-1",
Action: "read",
Action: "alarm_read",
ObjectKind: "resource",
ObjectType: "resource:rule",
TenantID: "domain-1",
@@ -110,35 +107,7 @@ func TestListAlarmsWithRuleFilterAuthorizesRuleRead(t *testing.T) {
session := authn.Session{UserID: "user-1", DomainID: "domain-1"}
authz := &recordingAtomAuthorizer{
allow: func(req atom.AuthzRequest) bool {
return req.Action == "read" && req.ObjectKind == "resource" && req.ObjectID == "rule-1"
},
}
wrapped, err := NewAtomAuthorizationMiddleware(svc, authz, testEntitiesOps(t))
require.NoError(t, err)
svc.On("ListAlarms", mock.Anything, session, expectedPM).Return(alarms.AlarmsPage{Limit: 10}, nil).Once()
_, err = wrapped.ListAlarms(context.Background(), session, pm)
require.NoError(t, err)
require.Len(t, authz.reqs, 3)
assert.Equal(t, "alarm_read", authz.reqs[0].Action)
assert.Equal(t, "alarm_read", authz.reqs[1].Action)
assert.Equal(t, "resource", authz.reqs[1].ObjectKind)
assert.Equal(t, "alarms", authz.reqs[1].Context["legacy_object_type"])
assert.Equal(t, "read", authz.reqs[2].Action)
}
func TestListAlarmsAuthorizesAlarmTypeWhenTenantDenied(t *testing.T) {
svc := mocks.NewService(t)
pm := alarms.PageMetadata{Limit: 10}
expectedPM := pm
expectedPM.DomainID = "domain-1"
session := authn.Session{UserID: "user-1", DomainID: "domain-1"}
authz := &recordingAtomAuthorizer{
allow: func(req atom.AuthzRequest) bool {
return req.Action == "alarm_read" &&
req.ObjectKind == "resource" &&
req.Context["legacy_object_type"] == "alarms"
return req.Action == "alarm_read" && req.ObjectKind == "resource" && req.ObjectID == "rule-1"
},
}
wrapped, err := NewAtomAuthorizationMiddleware(svc, authz, testEntitiesOps(t))
@@ -149,9 +118,10 @@ func TestListAlarmsAuthorizesAlarmTypeWhenTenantDenied(t *testing.T) {
require.NoError(t, err)
require.Len(t, authz.reqs, 2)
assert.Equal(t, "tenant", authz.reqs[0].ObjectKind)
assert.Equal(t, "alarm_read", authz.reqs[0].Action)
assert.Equal(t, "alarm_read", authz.reqs[1].Action)
assert.Equal(t, "resource", authz.reqs[1].ObjectKind)
require.Empty(t, authz.queries)
assert.Equal(t, "rules", authz.reqs[1].Context["legacy_object_type"])
}
func TestListAlarmsSuperAdminSkipsListAuthorization(t *testing.T) {
@@ -192,7 +162,7 @@ func TestAcknowledgeAlarmAuthorizesRuleAlarmActionWhenTenantDenied(t *testing.T)
_, err = wrapped.UpdateAlarm(context.Background(), session, update)
require.NoError(t, err)
require.Len(t, authz.reqs, 3)
require.Len(t, authz.reqs, 2)
assert.Equal(t, atom.AuthzRequest{
SubjectID: "user-1",
Action: "alarm_acknowledge",
@@ -204,17 +174,6 @@ func TestAcknowledgeAlarmAuthorizesRuleAlarmActionWhenTenantDenied(t *testing.T)
"legacy_object_type": "domain",
},
}, authz.reqs[0])
assert.Equal(t, atom.AuthzRequest{
SubjectID: "user-1",
Action: "alarm_acknowledge",
ResourceID: "alarm-1",
ObjectKind: "resource",
ObjectID: "alarm-1",
Context: map[string]any{
"domain_id": "domain-1",
"legacy_object_type": "alarms",
},
}, authz.reqs[1])
assert.Equal(t, atom.AuthzRequest{
SubjectID: "user-1",
Action: "alarm_acknowledge",
@@ -225,34 +184,7 @@ func TestAcknowledgeAlarmAuthorizesRuleAlarmActionWhenTenantDenied(t *testing.T)
"domain_id": "domain-1",
"legacy_object_type": "rules",
},
}, authz.reqs[2])
}
func TestAcknowledgeAlarmAuthorizesAlarmTypeWhenTenantDenied(t *testing.T) {
svc := mocks.NewService(t)
session := authn.Session{UserID: "user-1", DomainID: "domain-1"}
current := alarms.Alarm{ID: "alarm-1", RuleID: "rule-1", DomainID: "domain-1"}
update := alarms.Alarm{ID: "alarm-1", AcknowledgedBy: "user-1"}
authz := &recordingAtomAuthorizer{
allow: func(req atom.AuthzRequest) bool {
return req.Action == "alarm_acknowledge" &&
req.ObjectKind == "resource" &&
req.ObjectID == "alarm-1" &&
req.Context["legacy_object_type"] == "alarms"
},
}
wrapped, err := NewAtomAuthorizationMiddleware(svc, authz, testEntitiesOps(t))
require.NoError(t, err)
svc.On("ViewAlarm", mock.Anything, session, "alarm-1").Return(current, nil).Once()
svc.On("UpdateAlarm", mock.Anything, session, update).Return(update, nil).Once()
_, err = wrapped.UpdateAlarm(context.Background(), session, update)
require.NoError(t, err)
require.Len(t, authz.reqs, 2)
assert.Equal(t, "tenant", authz.reqs[0].ObjectKind)
assert.Equal(t, "resource", authz.reqs[1].ObjectKind)
assert.Equal(t, "alarms", authz.reqs[1].Context["legacy_object_type"])
}, authz.reqs[1])
}
func testEntitiesOps(t *testing.T) permissions.EntitiesOperations[permissions.Operation] {
internal/atom/bootstrap.go
+1 -12
View File
@@ -54,6 +54,7 @@ var magistralaActionApplicability = []CapabilityApplicabilitySpec{
{ActionName: atomActionManage, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceRule},
{ActionName: atomActionExecute, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceRule},
{ActionName: atomActionList, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceRule},
{ActionName: atomActionAlarmRead, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceRule},
{ActionName: atomActionAlarmUpdate, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceRule},
{ActionName: atomActionAlarmDelete, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceRule},
{ActionName: atomActionAlarmAssign, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceRule},
@@ -66,18 +67,6 @@ var magistralaActionApplicability = []CapabilityApplicabilitySpec{
{ActionName: atomActionManage, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceReport},
{ActionName: atomActionExecute, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceReport},
{ActionName: atomActionList, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceReport},
{ActionName: atomActionRead, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceAlarm},
{ActionName: atomActionWrite, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceAlarm},
{ActionName: atomActionDelete, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceAlarm},
{ActionName: atomActionManage, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceAlarm},
{ActionName: atomActionList, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceAlarm},
{ActionName: atomActionAlarmRead, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceAlarm},
{ActionName: atomActionAlarmUpdate, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceAlarm},
{ActionName: atomActionAlarmDelete, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceAlarm},
{ActionName: atomActionAlarmAssign, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceAlarm},
{ActionName: atomActionAlarmAcknowledge, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceAlarm},
{ActionName: atomActionAlarmResolve, ObjectKind: atomObjectKindResource, ObjectType: atomObjectTypeResourceAlarm},
}
var magistralaActionAssignmentRules = []ActionAssignmentRuleSpec{
internal/atom/bootstrap_test.go
+1 -8
View File
@@ -126,6 +126,7 @@ func TestBootstrapMagistralaActionsCreatesMissingActionsAndApplicability(t *test
assertApplicability(t, applicability, "publish-id", atomObjectKindResource, "resource:channel")
assertApplicability(t, applicability, "execute-id", atomObjectKindResource, "resource:rule")
assertApplicability(t, applicability, "list-id", atomObjectKindResource, "resource:rule")
assertApplicability(t, applicability, "alarm_read-id", atomObjectKindResource, "resource:rule")
assertApplicability(t, applicability, "alarm_update-id", atomObjectKindResource, "resource:rule")
assertApplicability(t, applicability, "alarm_delete-id", atomObjectKindResource, "resource:rule")
assertApplicability(t, applicability, "alarm_assign-id", atomObjectKindResource, "resource:rule")
@@ -133,14 +134,6 @@ func TestBootstrapMagistralaActionsCreatesMissingActionsAndApplicability(t *test
assertApplicability(t, applicability, "alarm_resolve-id", atomObjectKindResource, "resource:rule")
assertApplicability(t, applicability, "execute-id", atomObjectKindResource, "resource:report")
assertApplicability(t, applicability, "list-id", atomObjectKindResource, "resource:report")
assertApplicability(t, applicability, "manage-id", atomObjectKindResource, "resource:alarm")
assertApplicability(t, applicability, "list-id", atomObjectKindResource, "resource:alarm")
assertApplicability(t, applicability, "alarm_read-id", atomObjectKindResource, "resource:alarm")
assertApplicability(t, applicability, "alarm_update-id", atomObjectKindResource, "resource:alarm")
assertApplicability(t, applicability, "alarm_delete-id", atomObjectKindResource, "resource:alarm")
assertApplicability(t, applicability, "alarm_assign-id", atomObjectKindResource, "resource:alarm")
assertApplicability(t, applicability, "alarm_acknowledge-id", atomObjectKindResource, "resource:alarm")
assertApplicability(t, applicability, "alarm_resolve-id", atomObjectKindResource, "resource:alarm")
if len(assignmentRules) != len(magistralaActionAssignmentRules) {
t.Fatalf("unexpected assignment guardrail count: got %d want %d", len(assignmentRules), len(magistralaActionAssignmentRules))
}
internal/atom/constants.go
-1
View File
@@ -50,7 +50,6 @@ const (
atomObjectTypeResourceChannel = "resource:channel"
atomObjectTypeResourceRule = "resource:rule"
atomObjectTypeResourceReport = "resource:report"
atomObjectTypeResourceAlarm = "resource:alarm"
)
const atomDecisionAllow = "allow"