feature: flag permissions
feature: flag permissions
This commit is contained in:
Gary Sharp
@@ -4,6 +4,7 @@ using Disco.Models.Services.Authorization;
|
||||
using Disco.Services.Interop.ActiveDirectory;
|
||||
using Newtonsoft.Json;
|
||||
using System;
|
||||
using System.Collections.Concurrent;
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
|
||||
@@ -16,41 +17,41 @@ namespace Disco.Services.Authorization.Roles
|
||||
internal const string ClaimsJsonEmpty = "null";
|
||||
internal static readonly string[] _RequiredAdministratorSubjectIds = new string[] { "Domain Admins" };
|
||||
|
||||
private static List<RoleToken> _Cache;
|
||||
private static ConcurrentDictionary<int, RoleToken> cache;
|
||||
private static RoleToken _AdministratorToken;
|
||||
|
||||
internal static void Initialize(DiscoDataContext Database)
|
||||
internal static void Initialize(DiscoDataContext database)
|
||||
{
|
||||
MigrateAuthorizationRoles(Database);
|
||||
MigrateAuthorizationRoles(database);
|
||||
|
||||
_Cache = Database.AuthorizationRoles.ToList().Select(ar => RoleToken.FromAuthorizationRole(ar)).ToList();
|
||||
cache = new ConcurrentDictionary<int, RoleToken>(database.AuthorizationRoles.ToList().Select(ar => RoleToken.FromAuthorizationRole(ar)).ToDictionary(r => r.Role.Id));
|
||||
|
||||
// Add System Roles
|
||||
AddSystemRoles(Database);
|
||||
AddSystemRoles(database);
|
||||
}
|
||||
|
||||
private static void AddSystemRoles(DiscoDataContext Database)
|
||||
private static void AddSystemRoles(DiscoDataContext database)
|
||||
{
|
||||
// Disco Administrators
|
||||
_AdministratorToken = RoleToken.FromAuthorizationRole(new AuthorizationRole()
|
||||
{
|
||||
Id = AdministratorsTokenId,
|
||||
Name = "Disco Administrators",
|
||||
SubjectIds = string.Join(",", GenerateAdministratorSubjectIds(Database))
|
||||
SubjectIds = string.Join(",", GenerateAdministratorSubjectIds(database))
|
||||
}, Claims.AdministratorClaims());
|
||||
_Cache.Add(_AdministratorToken);
|
||||
cache.TryAdd(AdministratorsTokenId, _AdministratorToken);
|
||||
|
||||
// Computer Accounts
|
||||
_Cache.Add(RoleToken.FromAuthorizationRole(new AuthorizationRole()
|
||||
cache.TryAdd(ComputerAccountTokenId, RoleToken.FromAuthorizationRole(new AuthorizationRole()
|
||||
{
|
||||
Id = ComputerAccountTokenId,
|
||||
Name = "Domain Computer Account"
|
||||
}, Claims.ComputerAccountClaims()));
|
||||
}
|
||||
|
||||
private static IEnumerable<string> GenerateAdministratorSubjectIds(DiscoDataContext Database)
|
||||
private static IEnumerable<string> GenerateAdministratorSubjectIds(DiscoDataContext database)
|
||||
{
|
||||
var configuredSubjectIds = Database.DiscoConfiguration.Administrators.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries).Select(s => ActiveDirectory.ParseDomainAccountId(s));
|
||||
var configuredSubjectIds = database.DiscoConfiguration.Administrators.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries).Select(s => ActiveDirectory.ParseDomainAccountId(s));
|
||||
|
||||
return RequiredAdministratorSubjectIds
|
||||
.Concat(configuredSubjectIds)
|
||||
@@ -58,94 +59,79 @@ namespace Disco.Services.Authorization.Roles
|
||||
.OrderBy(s => s);
|
||||
}
|
||||
public static IEnumerable<string> RequiredAdministratorSubjectIds
|
||||
{
|
||||
get
|
||||
{
|
||||
return _RequiredAdministratorSubjectIds.Select(s => ActiveDirectory.ParseDomainAccountId(s));
|
||||
}
|
||||
}
|
||||
=> _RequiredAdministratorSubjectIds.Select(s => ActiveDirectory.ParseDomainAccountId(s));
|
||||
public static IEnumerable<string> AdministratorSubjectIds
|
||||
{
|
||||
get
|
||||
{
|
||||
return _AdministratorToken.SubjectIds.ToList();
|
||||
}
|
||||
}
|
||||
=> _AdministratorToken.SubjectIds.ToList();
|
||||
|
||||
public static void UpdateAdministratorSubjectIds(DiscoDataContext Database, IEnumerable<string> SubjectIds)
|
||||
public static void UpdateAdministratorSubjectIds(DiscoDataContext database, IEnumerable<string> subjectIds)
|
||||
{
|
||||
// Clean
|
||||
SubjectIds = SubjectIds
|
||||
subjectIds = subjectIds
|
||||
.Where(s => !string.IsNullOrWhiteSpace(s))
|
||||
.Concat(RequiredAdministratorSubjectIds)
|
||||
.Distinct(StringComparer.OrdinalIgnoreCase)
|
||||
.OrderBy(s => s);
|
||||
|
||||
var subjectIdsString = string.Join(",", SubjectIds);
|
||||
var subjectIdsString = string.Join(",", subjectIds);
|
||||
|
||||
// Update Database
|
||||
Database.DiscoConfiguration.Administrators = subjectIdsString;
|
||||
Database.SaveChanges();
|
||||
database.DiscoConfiguration.Administrators = subjectIdsString;
|
||||
database.SaveChanges();
|
||||
|
||||
// Update State
|
||||
_AdministratorToken.SubjectIds = SubjectIds.ToList();
|
||||
_AdministratorToken.SubjectIdHashes = new HashSet<string>(SubjectIds, StringComparer.OrdinalIgnoreCase);
|
||||
_AdministratorToken.SubjectIds = subjectIds.ToList();
|
||||
_AdministratorToken.SubjectIdHashes = new HashSet<string>(subjectIds, StringComparer.OrdinalIgnoreCase);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Create a clone of an Authorization Role
|
||||
/// <para>Creates immutable clones to avoid side-effects</para>
|
||||
/// </summary>
|
||||
/// <param name="TemplateRole">Authorization Role to Clone</param>
|
||||
/// <param name="templateRole">Authorization Role to Clone</param>
|
||||
/// <returns>A copy of the Authorization Role</returns>
|
||||
private static AuthorizationRole CloneAuthoriationRole(AuthorizationRole TemplateRole)
|
||||
private static AuthorizationRole CloneAuthoriationRole(AuthorizationRole templateRole)
|
||||
{
|
||||
return new AuthorizationRole()
|
||||
{
|
||||
Id = TemplateRole.Id,
|
||||
Name = TemplateRole.Name,
|
||||
ClaimsJson = TemplateRole.ClaimsJson,
|
||||
SubjectIds = TemplateRole.SubjectIds
|
||||
Id = templateRole.Id,
|
||||
Name = templateRole.Name,
|
||||
ClaimsJson = templateRole.ClaimsJson,
|
||||
SubjectIds = templateRole.SubjectIds
|
||||
};
|
||||
}
|
||||
|
||||
internal static RoleToken AddRole(AuthorizationRole Role)
|
||||
{
|
||||
var token = RoleToken.FromAuthorizationRole(CloneAuthoriationRole(Role));
|
||||
_Cache.Add(token);
|
||||
return token;
|
||||
}
|
||||
|
||||
internal static void RemoveRole(AuthorizationRole Role)
|
||||
{
|
||||
var token = GetRoleToken(Role.Id);
|
||||
if (token != null)
|
||||
_Cache.Remove(token);
|
||||
cache.TryRemove(Role.Id, out _);
|
||||
}
|
||||
|
||||
internal static RoleToken UpdateRole(AuthorizationRole Role)
|
||||
internal static RoleToken AddOrUpdateRole(AuthorizationRole role)
|
||||
{
|
||||
RemoveRole(Role);
|
||||
return AddRole(Role);
|
||||
var token = RoleToken.FromAuthorizationRole(CloneAuthoriationRole(role));
|
||||
cache.AddOrUpdate(token.Role.Id, token, (i, e) => token);
|
||||
return token;
|
||||
}
|
||||
|
||||
internal static RoleToken GetRoleToken(int Id)
|
||||
internal static RoleToken GetRoleToken(int id)
|
||||
{
|
||||
return _Cache.FirstOrDefault(t => t.Role.Id == Id);
|
||||
if (cache.TryGetValue(id, out var result))
|
||||
return result;
|
||||
else
|
||||
return null;
|
||||
}
|
||||
internal static RoleToken GetRoleToken(string SecurityGroup)
|
||||
internal static RoleToken GetRoleToken(string securityGroup)
|
||||
{
|
||||
return _Cache.FirstOrDefault(t => t.SubjectIdHashes.Contains(SecurityGroup));
|
||||
return cache.Values.FirstOrDefault(t => t.SubjectIdHashes.Contains(securityGroup));
|
||||
}
|
||||
internal static List<IRoleToken> GetRoleTokens(IEnumerable<string> SecurityGroup)
|
||||
internal static List<IRoleToken> GetRoleTokens(IEnumerable<string> securityGroups)
|
||||
{
|
||||
return _Cache.Where(t => SecurityGroup.Any(sg => t.SubjectIdHashes.Contains(sg))).Cast<IRoleToken>().ToList();
|
||||
return cache.Values.Where(t => securityGroups.Any(sg => t.SubjectIdHashes.Contains(sg))).Cast<IRoleToken>().ToList();
|
||||
}
|
||||
internal static List<IRoleToken> GetRoleTokens(IEnumerable<string> SecurityGroup, User User)
|
||||
internal static List<IRoleToken> GetRoleTokens(IEnumerable<string> securityGroups, User user)
|
||||
{
|
||||
var subjectIds = SecurityGroup.Concat(new string[] { User.UserId });
|
||||
var subjectIds = securityGroups.Concat(new string[] { user.UserId });
|
||||
|
||||
return _Cache.Where(t => subjectIds.Any(sg => t.SubjectIdHashes.Contains(sg))).Cast<IRoleToken>().ToList();
|
||||
return cache.Values.Where(t => subjectIds.Any(sg => t.SubjectIdHashes.Contains(sg))).Cast<IRoleToken>().ToList();
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
|
||||
Reference in New Issue
Block a user