C++ AuthorizationSession::isAuthorizedForActionsOnResource方法代码示例

Status checkAuthForRolesInfoCommand(ClientBasic* client,
                                    const std::string& dbname,
                                    const BSONObj& cmdObj) {
    AuthorizationSession* authzSession = AuthorizationSession::get(client);
    auth::RolesInfoArgs args;
    Status status = auth::parseRolesInfoCommand(cmdObj, dbname, &args);
    if (!status.isOK()) {
        return status;
    }

    if (args.allForDB) {
        if (!authzSession->isAuthorizedForActionsOnResource(
                ResourcePattern::forDatabaseName(dbname), ActionType::viewRole)) {
            return Status(ErrorCodes::Unauthorized,
                          str::stream() << "Not authorized to view roles from the " << dbname
                                        << " database");
        }
    } else {
        for (size_t i = 0; i < args.roleNames.size(); ++i) {
            if (authzSession->isAuthenticatedAsUserWithRole(args.roleNames[i])) {
                continue;  // Can always see roles that you are a member of
            }

            if (!authzSession->isAuthorizedForActionsOnResource(
                    ResourcePattern::forDatabaseName(args.roleNames[i].getDB()),
                    ActionType::viewRole)) {
                return Status(ErrorCodes::Unauthorized,
                              str::stream() << "Not authorized to view roles from the "
                                            << args.roleNames[i].getDB() << " database");
            }
        }
    }

    return Status::OK();
}

Status checkAuthForUsersInfoCommand(ClientBasic* client,
                                    const std::string& dbname,
                                    const BSONObj& cmdObj) {
    AuthorizationSession* authzSession = AuthorizationSession::get(client);
    auth::UsersInfoArgs args;
    Status status = auth::parseUsersInfoCommand(cmdObj, dbname, &args);
    if (!status.isOK()) {
        return status;
    }

    if (args.allForDB) {
        if (!authzSession->isAuthorizedForActionsOnResource(
                ResourcePattern::forDatabaseName(dbname), ActionType::viewUser)) {
            return Status(ErrorCodes::Unauthorized,
                          str::stream() << "Not authorized to view users from the " << dbname
                                        << " database");
        }
    } else {
        for (size_t i = 0; i < args.userNames.size(); ++i) {
            if (authzSession->lookupUser(args.userNames[i])) {
                continue;  // Can always view users you are logged in as
            }
            if (!authzSession->isAuthorizedForActionsOnResource(
                    ResourcePattern::forDatabaseName(args.userNames[i].getDB()),
                    ActionType::viewUser)) {
                return Status(ErrorCodes::Unauthorized,
                              str::stream() << "Not authorized to view users from the " << dbname
                                            << " database");
            }
        }
    }
    return Status::OK();
}

Status checkAuthForUpdateUserCommand(Client* client,
                                     const std::string& dbname,
                                     const BSONObj& cmdObj) {
    AuthorizationSession* authzSession = AuthorizationSession::get(client);
    auth::CreateOrUpdateUserArgs args;
    Status status = auth::parseCreateOrUpdateUserCommands(cmdObj, "updateUser", dbname, &args);
    if (!status.isOK()) {
        return status;
    }

    if (args.hasPassword) {
        if (!authzSession->isAuthorizedToChangeOwnPasswordAsUser(args.userName) &&
            !authzSession->isAuthorizedForActionsOnResource(
                ResourcePattern::forDatabaseName(args.userName.getDB()),
                ActionType::changePassword)) {
            return Status(ErrorCodes::Unauthorized,
                          str::stream() << "Not authorized to change password of user: "
                                        << args.userName.getFullName());
        }
    }

    if (args.hasCustomData) {
        if (!authzSession->isAuthorizedToChangeOwnCustomDataAsUser(args.userName) &&
            !authzSession->isAuthorizedForActionsOnResource(
                ResourcePattern::forDatabaseName(args.userName.getDB()),
                ActionType::changeCustomData)) {
            return Status(ErrorCodes::Unauthorized,
                          str::stream() << "Not authorized to change customData of user: "
                                        << args.userName.getFullName());
        }
    }

    if (args.hasRoles) {
        // You don't know what roles you might be revoking, so require the ability to
        // revoke any role in the system.
        if (!authzSession->isAuthorizedForActionsOnResource(ResourcePattern::forAnyNormalResource(),
                                                            ActionType::revokeRole)) {
            return Status(ErrorCodes::Unauthorized,
                          "In order to use updateUser to set roles array, must be "
                          "authorized to revoke any role in the system");
        }

        status = checkAuthorizedToGrantRoles(authzSession, args.roles);
        if (!status.isOK()) {
            return status;
        }
    }

    status = checkAuthorizedToSetRestrictions(
        authzSession, static_cast<bool>(args.authenticationRestrictions), args.userName.getDB());
    if (!status.isOK()) {
        return status;
    }

    return Status::OK();
}

Status checkAuthForCreateUserCommand(Client* client,
                                     const std::string& dbname,
                                     const BSONObj& cmdObj) {
    AuthorizationSession* authzSession = AuthorizationSession::get(client);
    auth::CreateOrUpdateUserArgs args;
    Status status = auth::parseCreateOrUpdateUserCommands(cmdObj, "createUser", dbname, &args);
    if (!status.isOK()) {
        return status;
    }

    if (!authzSession->isAuthorizedForActionsOnResource(
            ResourcePattern::forDatabaseName(args.userName.getDB()), ActionType::createUser)) {
        return Status(ErrorCodes::Unauthorized,
                      str::stream() << "Not authorized to create users on db: "
                                    << args.userName.getDB());
    }

    status = checkAuthorizedToGrantRoles(authzSession, args.roles);
    if (!status.isOK()) {
        return status;
    }

    status = checkAuthorizedToSetRestrictions(
        authzSession, static_cast<bool>(args.authenticationRestrictions), args.userName.getDB());
    if (!status.isOK()) {
        return status;
    }

    return Status::OK();
}

Status checkAuthForUpdateRoleCommand(ClientBasic* client,
                                     const std::string& dbname,
                                     const BSONObj& cmdObj) {
    AuthorizationSession* authzSession = AuthorizationSession::get(client);
    auth::CreateOrUpdateRoleArgs args;
    Status status = auth::parseCreateOrUpdateRoleCommands(cmdObj, "updateRole", dbname, &args);
    if (!status.isOK()) {
        return status;
    }

    // You don't know what roles or privileges you might be revoking, so require the ability
    // to revoke any role (or privilege) in the system.
    if (!authzSession->isAuthorizedForActionsOnResource(ResourcePattern::forAnyNormalResource(),
                                                        ActionType::revokeRole)) {
        return Status(ErrorCodes::Unauthorized,
                      "updateRole command required the ability to revoke any role in the "
                      "system");
    }

    status = checkAuthorizedToGrantRoles(authzSession, args.roles);
    if (!status.isOK()) {
        return status;
    }

    return checkAuthorizedToGrantPrivileges(authzSession, args.privileges);
}

Status checkAuthForAuthSchemaUpgradeCommand(ClientBasic* client) {
    AuthorizationSession* authzSession = AuthorizationSession::get(client);
    if (!authzSession->isAuthorizedForActionsOnResource(ResourcePattern::forClusterResource(),
                                                        ActionType::authSchemaUpgrade)) {
        return Status(ErrorCodes::Unauthorized, "Not authorized to run authSchemaUpgrade command.");
    }
    return Status::OK();
}

Status checkAuthForInvalidateUserCacheCommand(Client* client) {
    AuthorizationSession* authzSession = AuthorizationSession::get(client);
    if (!authzSession->isAuthorizedForActionsOnResource(ResourcePattern::forClusterResource(),
                                                        ActionType::invalidateUserCache)) {
        return Status(ErrorCodes::Unauthorized, "Not authorized to invalidate user cache");
    }
    return Status::OK();
}

Status checkAuthForGetUserCacheGenerationCommand(Client* client) {
    AuthorizationSession* authzSession = AuthorizationSession::get(client);
    if (!authzSession->isAuthorizedForActionsOnResource(ResourcePattern::forClusterResource(),
                                                        ActionType::internal)) {
        return Status(ErrorCodes::Unauthorized, "Not authorized to get cache generation");
    }
    return Status::OK();
}

    virtual Status checkAuthForCommand(ClientBasic* client,
                                       const std::string& dbname,
                                       const BSONObj& cmdObj) {
        AuthorizationSession* authzSession = AuthorizationSession::get(client);

        // Check for the listCollections ActionType on the database
        // or find on system.namespaces for pre 3.0 systems.
        if (authzSession->isAuthorizedForActionsOnResource(ResourcePattern::forDatabaseName(dbname),
                                                           ActionType::listCollections) ||
            authzSession->isAuthorizedForActionsOnResource(
                ResourcePattern::forExactNamespace(NamespaceString(dbname, "system.namespaces")),
                ActionType::find)) {
            return Status::OK();
        }

        return Status(ErrorCodes::Unauthorized,
                      str::stream() << "Not authorized to create users on db: " << dbname);
    }

 Status checkAuthForCommand(Client* client,
                            const std::string& dbname,
                            const BSONObj& cmdObj) final {
     AuthorizationSession* authzSession = AuthorizationSession::get(client);
     if (authzSession->isAuthorizedForActionsOnResource(ResourcePattern::forClusterResource(),
                                                        ActionType::replSetResizeOplog)) {
         return Status::OK();
     }
     return Status(ErrorCodes::Unauthorized, "Unauthorized");
 }

Status checkAuthForDropAllRolesFromDatabaseCommand(Client* client, const std::string& dbname) {
    AuthorizationSession* authzSession = AuthorizationSession::get(client);
    if (!authzSession->isAuthorizedForActionsOnResource(ResourcePattern::forDatabaseName(dbname),
                                                        ActionType::dropRole)) {
        return Status(ErrorCodes::Unauthorized,
                      str::stream() << "Not authorized to drop roles from the " << dbname
                                    << " database");
    }
    return Status::OK();
}

    Status checkAuthForCommand(Client* client, const std::string& dbname, const BSONObj& cmdObj) {
        AuthorizationSession* authzSession = AuthorizationSession::get(client);
        ResourcePattern pattern = parseResourcePattern(dbname, cmdObj);

        if (authzSession->isAuthorizedForActionsOnResource(pattern, _actionType)) {
            return Status::OK();
        }

        return Status(ErrorCodes::Unauthorized, "unauthorized");
    }

Status IndexFilterCommand::checkAuthForCommand(ClientBasic* client, const std::string& dbname,
        const BSONObj& cmdObj) {
    AuthorizationSession* authzSession = client->getAuthorizationSession();
    ResourcePattern pattern = parseResourcePattern(dbname, cmdObj);

    if (authzSession->isAuthorizedForActionsOnResource(pattern, ActionType::planCacheIndexFilter)) {
        return Status::OK();
    }

    return Status(ErrorCodes::Unauthorized, "unauthorized");
}

    Status checkAuthForCommand(Client* client,
                               const std::string& dbname,
                               const BSONObj& cmdObj) const override {
        AuthorizationSession* authzSession = AuthorizationSession::get(client);

        // Check for the listIndexes ActionType on the database, or find on system.indexes for pre
        // 3.0 systems.
        const NamespaceString ns(parseNs(dbname, cmdObj));

        if (authzSession->isAuthorizedForActionsOnResource(ResourcePattern::forExactNamespace(ns),
                                                           ActionType::listIndexes) ||
            authzSession->isAuthorizedForActionsOnResource(
                ResourcePattern::forExactNamespace(NamespaceString(dbname, "system.indexes")),
                ActionType::find)) {
            return Status::OK();
        }

        return Status(ErrorCodes::Unauthorized,
                      str::stream() << "Not authorized to list indexes on collection: "
                                    << ns.coll());
    }

Status checkAuthForMergeAuthzCollectionsCommand(Client* client, const BSONObj& cmdObj) {
    auth::MergeAuthzCollectionsArgs args;
    Status status = auth::parseMergeAuthzCollectionsCommand(cmdObj, &args);
    if (!status.isOK()) {
        return status;
    }

    AuthorizationSession* authzSession = AuthorizationSession::get(client);
    ActionSet actions;
    actions.addAction(ActionType::createUser);
    actions.addAction(ActionType::createRole);
    actions.addAction(ActionType::grantRole);
    actions.addAction(ActionType::revokeRole);
    if (args.drop) {
        actions.addAction(ActionType::dropUser);
        actions.addAction(ActionType::dropRole);
    }
    if (!authzSession->isAuthorizedForActionsOnResource(ResourcePattern::forAnyNormalResource(),
                                                        actions)) {
        return Status(ErrorCodes::Unauthorized,
                      "Not authorized to update user/role data using _mergeAuthzCollections"
                      " command");
    }
    if (!args.usersCollName.empty() &&
        !authzSession->isAuthorizedForActionsOnResource(
            ResourcePattern::forExactNamespace(NamespaceString(args.usersCollName)),
            ActionType::find)) {
        return Status(ErrorCodes::Unauthorized,
                      str::stream() << "Not authorized to read " << args.usersCollName);
    }
    if (!args.rolesCollName.empty() &&
        !authzSession->isAuthorizedForActionsOnResource(
            ResourcePattern::forExactNamespace(NamespaceString(args.rolesCollName)),
            ActionType::find)) {
        return Status(ErrorCodes::Unauthorized,
                      str::stream() << "Not authorized to read " << args.rolesCollName);
    }
    return Status::OK();
}