Class: Puppet::Network::Rights

Inherits:
Object
  • Object
show all
Defined in:
lib/puppet/network/rights.rb

Overview

Rights class manages a list of ACLs for paths.

Defined Under Namespace

Classes: Right

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Rights

Returns a new instance of Rights.



71
72
73
 
# File 'lib/puppet/network/rights.rb', line 71

def initialize
  @rights = []
end

Instance Method Details

#[](name) ⇒ Object 



75
76
77
 
# File 'lib/puppet/network/rights.rb', line 75

def [](name)
  @rights.find { |acl| acl == name }
end

#allowed?(name, *args) ⇒ Boolean

Check that name is allowed or not

Returns:

  • (Boolean) 


12
13
14
 
# File 'lib/puppet/network/rights.rb', line 12

def allowed?(name, *args)
  !is_forbidden_and_why?(name, :node => args[0], :ip => args[1])
end

#each ⇒ Object 



87
88
89
 
# File 'lib/puppet/network/rights.rb', line 87

def each
  @rights.each { |r| yield r.name,r }
end

#empty? ⇒ Boolean

Returns:

  • (Boolean) 


79
80
81
 
# File 'lib/puppet/network/rights.rb', line 79

def empty?
  @rights.empty?
end

#include?(name) ⇒ Boolean

Returns:

  • (Boolean) 


83
84
85
 
# File 'lib/puppet/network/rights.rb', line 83

def include?(name)
  @rights.include?(name)
end

#is_forbidden_and_why?(name, args = {}) ⇒ Boolean

Returns:

  • (Boolean) 


35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
 
# File 'lib/puppet/network/rights.rb', line 35

def is_forbidden_and_why?(name, args = {})
  res = :nomatch
  right = @rights.find do |acl|
    found = false
    # an acl can return :dunno, which means "I'm not qualified to answer your question,
    # please ask someone else". This is used when for instance an acl matches, but not for the
    # current rest method, where we might think some other acl might be more specific.
    if match = acl.match?(name)
      args[:match] = match
      if (res = acl.allowed?(args[:node], args[:ip], args)) != :dunno
        # return early if we're allowed
        return nil if res
        # we matched, select this acl
        found = true
      end
    end
    found
  end

  # if we end up here, then that means we either didn't match or failed, in any
  # case will return an error to the outside world
  host_description = args[:node] ? "#{args[:node]}(#{args[:ip]})" : args[:ip]

  msg = "#{host_description} access to #{name} [#{args[:method]}]"

  if args[:authenticated]
    msg += " authenticated "
  end

  if right
    msg += " at #{right.file}:#{right.line}"
  end

  AuthorizationError.new("Forbidden request: #{msg}")
end

#is_request_forbidden_and_why?(method, path, params) ⇒ Boolean

Returns:

  • (Boolean) 


16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/puppet/network/rights.rb', line 16

def is_request_forbidden_and_why?(method, path, params)
  methods_to_check = if method == :head
                       # :head is ok if either :find or :save is ok.
                       [:find, :save]
                     else
                       [method]
                     end
  authorization_failure_exceptions = methods_to_check.map do |method|
    is_forbidden_and_why?(path, params.merge({:method => method}))
  end
  if authorization_failure_exceptions.include? nil
    # One of the methods we checked is ok, therefore this request is ok.
    nil
  else
    # Just need to return any of the failure exceptions.
    authorization_failure_exceptions.first
  end
end

#newright(name, line = nil, file = nil) ⇒ Object

Define a new right to which access can be provided.



92
93
94
 
# File 'lib/puppet/network/rights.rb', line 92

def newright(name, line=nil, file=nil)
  add_right( Right.new(name, line, file) )
end