mirror of
https://github.com/bitechdev/ResolveSpec.git
synced 2026-10-02 11:31:57 +00:00
Hein
c9fa8c60f2
pkg/security no longer contains SQL. Every provider calls a store interface
from lookup, implemented by a procedure backend (Postgres stored procedures,
the default there) and a direct backend (dialect-driven SQL for postgres,
sqlite, mysql and mssql with configurable table and column names).
- add sectypes, lookup, lookup/{dialect,procedure,direct,backends,ddl,conformance}
- split totp and providers sub packages out of the core package
- replace SQLNames/TableNames/QueryMode with lookup.Config (see breaking_changes.md)
- direct backend now covers column/row security and API-key login
- move txsettings SQL to lookup.ApplyTxSettings; remove password.go
- move schema scripts under lookup/, add reference DDL per dialect
- add a shared conformance suite; run it on sqlite, and on Postgres in a
podman/docker container (RESOLVESPEC_TEST_CONTAINERS=1)
- fix procedure schema bugs found on real Postgres: duplicate p_data
parameter, JSON null arrays, expires_at timezone casts, passkey list
GROUP BY, missing resolvespec_passkey_login; accept zone-less timestamps
62 lines
1.6 KiB
Go
62 lines
1.6 KiB
Go
package providers
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/bitechdev/ResolveSpec/pkg/security/sectypes"
|
|
)
|
|
|
|
// ConfigColumnSecurityProvider provides static column security configuration
|
|
type ConfigColumnSecurityProvider struct {
|
|
rules map[string][]sectypes.ColumnSecurity
|
|
}
|
|
|
|
func NewConfigColumnSecurityProvider(rules map[string][]sectypes.ColumnSecurity) *ConfigColumnSecurityProvider {
|
|
return &ConfigColumnSecurityProvider{rules: rules}
|
|
}
|
|
|
|
func (p *ConfigColumnSecurityProvider) GetColumnSecurity(ctx context.Context, userID int, schema, table string) ([]sectypes.ColumnSecurity, error) {
|
|
key := fmt.Sprintf("%s.%s", schema, table)
|
|
rules, ok := p.rules[key]
|
|
if !ok {
|
|
return []sectypes.ColumnSecurity{}, nil
|
|
}
|
|
return rules, nil
|
|
}
|
|
|
|
// ConfigRowSecurityProvider provides static row security configuration
|
|
type ConfigRowSecurityProvider struct {
|
|
templates map[string]string
|
|
blocked map[string]bool
|
|
}
|
|
|
|
func NewConfigRowSecurityProvider(templates map[string]string, blocked map[string]bool) *ConfigRowSecurityProvider {
|
|
return &ConfigRowSecurityProvider{
|
|
templates: templates,
|
|
blocked: blocked,
|
|
}
|
|
}
|
|
|
|
func (p *ConfigRowSecurityProvider) GetRowSecurity(ctx context.Context, userRef any, schema, table string) (sectypes.RowSecurity, error) {
|
|
key := fmt.Sprintf("%s.%s", schema, table)
|
|
|
|
if p.blocked[key] {
|
|
return sectypes.RowSecurity{
|
|
Schema: schema,
|
|
Tablename: table,
|
|
UserID: userRef,
|
|
HasBlock: true,
|
|
}, nil
|
|
}
|
|
|
|
template := p.templates[key]
|
|
return sectypes.RowSecurity{
|
|
Schema: schema,
|
|
Tablename: table,
|
|
UserID: userRef,
|
|
Template: template,
|
|
HasBlock: false,
|
|
}, nil
|
|
}
|