Class: Conjur::Rack::User

Inherits:
Object
  • Object
show all
Defined in:
lib/conjur/rack/user.rb

Overview

Token data can be a string (which is the user login), or a Hash. If it’s a hash, it should contain the user login keyed by the string ‘login’. The rest of the payload is available as attributes.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(token, account, options = {}) ⇒ User

Returns a new instance of User.



11
12
13
14
15
16
17
18
19
20
21
22
23
24
 
# File 'lib/conjur/rack/user.rb', line 11

def initialize(token, , options = {})
  @token = token
  @account = 
  # Third argument used to be the name of privilege, be
  # backwards compatible:
  if options.respond_to?(:to_str)
    @privilege = options
  else
    @privilege = options[:privilege]
    @remote_ip = options[:remote_ip]
    @audit_roles = options[:audit_roles]
    @audit_resources = options[:audit_resources]
  end
end

Instance Attribute Details

#account ⇒ Object (readonly) Also known as: conjur_account

Returns the value of attribute account.



9
10
11
 
# File 'lib/conjur/rack/user.rb', line 9

def 
  @account
end

#audit_resources ⇒ Object (readonly)

Returns the value of attribute audit_resources.



9
10
11
 
# File 'lib/conjur/rack/user.rb', line 9

def audit_resources
  @audit_resources
end

#audit_roles ⇒ Object (readonly)

Returns the value of attribute audit_roles.



9
10
11
 
# File 'lib/conjur/rack/user.rb', line 9

def audit_roles
  @audit_roles
end

#privilege ⇒ Object (readonly)

Returns the value of attribute privilege.



9
10
11
 
# File 'lib/conjur/rack/user.rb', line 9

def privilege
  @privilege
end

#remote_ip ⇒ Object (readonly)

Returns the value of attribute remote_ip.



9
10
11
 
# File 'lib/conjur/rack/user.rb', line 9

def remote_ip
  @remote_ip
end

#token ⇒ Object (readonly)

Returns the value of attribute token.



9
10
11
 
# File 'lib/conjur/rack/user.rb', line 9

def token
  @token
end

Instance Method Details

#api(cls = Conjur::API) ⇒ Object 



90
91
92
93
94
95
96
97
98
99
 
# File 'lib/conjur/rack/user.rb', line 90

def api(cls = Conjur::API)
  args = [ token ]
  args.push remote_ip if remote_ip
  api = cls.new_from_token(*args)
  api = api.with_privilege(privilege) if privilege
  api = api.with_audit_resources(audit_resources) if audit_resources
  api = api.with_audit_roles(audit_roles) if audit_roles

  api
end

#attributes ⇒ Object 



62
63
64
65
66
 
# File 'lib/conjur/rack/user.rb', line 62

def attributes
  parse_token

  @attributes || {}
end

#global_elevate? ⇒ Boolean

True if and only if the user has valid global ‘elevate’ privilege.

Returns:

  • (Boolean) 


52
53
54
 
# File 'lib/conjur/rack/user.rb', line 52

def global_elevate?
  validated_global_privilege == "elevate"
end

#global_reveal? ⇒ Boolean

True if and only if the user has valid global ‘reveal’ privilege.

Returns:

  • (Boolean) 


47
48
49
 
# File 'lib/conjur/rack/user.rb', line 47

def global_reveal?
  validated_global_privilege == "reveal"
end

#login ⇒ Object 



56
57
58
59
60
 
# File 'lib/conjur/rack/user.rb', line 56

def 
  parse_token

  @login
end

#role ⇒ Object 



78
79
80
 
# File 'lib/conjur/rack/user.rb', line 78

def role
  api.role(roleid)
end

#roleid ⇒ Object 



68
69
70
71
72
73
74
75
76
 
# File 'lib/conjur/rack/user.rb', line 68

def roleid
  tokens = .split('/')
  role_kind, roleid = if tokens.length == 1
    [ 'user',  ]
  else
    [ tokens[0], tokens[1..-1].join('/') ]
  end
  [ , role_kind, roleid ].join(':')
end

#validated_global_privilege ⇒ Object

Returns the global privilege which was present on the request, if and only if the user actually has that privilege.

Returns nil if no global privilege was present in the request headers, or if a global privilege was present in the request headers, but the user doesn’t actually have that privilege according to the Conjur server.



38
39
40
41
42
43
44
 
# File 'lib/conjur/rack/user.rb', line 38

def validated_global_privilege
  unless @validated_global_privilege
    @privilege = nil if @privilege && !api.global_privilege_permitted?(@privilege)
    @validated_global_privilege = true
  end
  @privilege
end