Class: Puppet::Network::Rights::Right

Inherits:
AuthStore show all
Defined in:
lib/puppet/network/rights.rb

Overview

A right.

Constant Summary collapse

ALL = 
[:save, :destroy, :find, :search]

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods inherited from AuthStore

#allow, #allow_ip, #deny, #deny_ip, #empty?, #globalallow?, #interpolate, #reset_interpolation

Methods included from Util::Logging

#clear_deprecation_warnings, #debug, #deprecation_warning, #format_exception, #get_deprecation_offender, #log_and_raise, #log_deprecations_to_file, #log_exception, #puppet_deprecation_warning, #send_log, setup_facter_logging!

Constructor Details

#initialize(name, line, file) ⇒ Right

Returns a new instance of Right.



120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
 
# File 'lib/puppet/network/rights.rb', line 120

def initialize(name, line, file)
  @methods = []
  @environment = []
  @authentication = true # defaults to authenticated
  @name = name
  @line = line || 0
  @file = file
  @methods = ALL

  case name
  when /^\//
    @key = Regexp.new("^" + Regexp.escape(name))
  when /^~/ # this is a regex
    @name = name.gsub(/^~\s+/,'')
    @key = Regexp.new(@name)
  else
    raise ArgumentError, "Unknown right type '#{name}'"
  end

  super()
end

Instance Attribute Details

#authentication ⇒ Object

Overriding Object#methods sucks for debugging. If we’re in here in the future, it would be nice to rename Right#methods



113
114
115
 
# File 'lib/puppet/network/rights.rb', line 113

def authentication
  @authentication
end

#environment ⇒ Object

Overriding Object#methods sucks for debugging. If we’re in here in the future, it would be nice to rename Right#methods



113
114
115
 
# File 'lib/puppet/network/rights.rb', line 113

def environment
  @environment
end

#file ⇒ Object 



114
115
116
 
# File 'lib/puppet/network/rights.rb', line 114

def file
  @file
end

#key ⇒ Object 



110
111
112
 
# File 'lib/puppet/network/rights.rb', line 110

def key
  @key
end

#line ⇒ Object 



114
115
116
 
# File 'lib/puppet/network/rights.rb', line 114

def line
  @line
end

#methods ⇒ Object

Overriding Object#methods sucks for debugging. If we’re in here in the future, it would be nice to rename Right#methods



113
114
115
 
# File 'lib/puppet/network/rights.rb', line 113

def methods
  @methods
end

#name ⇒ Object 



110
111
112
 
# File 'lib/puppet/network/rights.rb', line 110

def name
  @name
end

Instance Method Details

#==(name) ⇒ Object 



214
215
216
 
# File 'lib/puppet/network/rights.rb', line 214

def ==(name)
  self.name == name.gsub(/^~\s+/,'')
end

#allowed?(name, ip, args = {}) ⇒ Boolean

does this right is allowed for this triplet? if this right is too restrictive (ie we don’t match this access method) then return :dunno so that upper layers have a chance to try another right tailored to the given method

Returns:

  • (Boolean) 


155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
 
# File 'lib/puppet/network/rights.rb', line 155

def allowed?(name, ip, args = {})
  if not @methods.include?(args[:method])
    return :dunno
  elsif @environment.size > 0 and not @environment.include?(args[:environment])
    return :dunno
  elsif (@authentication and not args[:authenticated])
    return :dunno
  end

  begin
    # make sure any capture are replaced if needed
    interpolate(args[:match]) if args[:match]
    res = super(name,ip)
  ensure
    reset_interpolation
  end
  res
end

#match?(key) ⇒ Boolean

Returns:

  • (Boolean) 


209
210
211
212
 
# File 'lib/puppet/network/rights.rb', line 209

def match?(key)
  # otherwise match with the regex
  self.key.match(key)
end

#restrict_authenticated(authentication) ⇒ Object 



197
198
199
200
201
202
203
204
205
206
207
 
# File 'lib/puppet/network/rights.rb', line 197

def restrict_authenticated(authentication)
  case authentication
  when "yes", "on", "true", true
    authentication = true
  when "no", "off", "false", false, "all" ,"any", :all, :any
    authentication = false
  else
    raise ArgumentError, "'#{name}' incorrect authenticated value: #{authentication}"
  end
  @authentication = authentication
end

#restrict_environment(environment) ⇒ Object

Raises:

  • (ArgumentError) 


190
191
192
193
194
195
 
# File 'lib/puppet/network/rights.rb', line 190

def restrict_environment(environment)
  env = Puppet.lookup(:environments).get(environment)
  raise ArgumentError, "'#{env}' is already in the '#{name}' ACL" if @environment.include?(env)

  @environment << env
end

#restrict_method(m) ⇒ Object

restrict this right to some method only

Raises:

  • (ArgumentError) 


175
176
177
178
179
180
181
182
183
184
185
186
187
188
 
# File 'lib/puppet/network/rights.rb', line 175

def restrict_method(m)
  m = m.intern if m.is_a?(String)

  raise ArgumentError, "'#{m}' is not an allowed value for method directive" unless ALL.include?(m)

  # if we were allowing all methods, then starts from scratch
  if @methods === ALL
    @methods = []
  end

  raise ArgumentError, "'#{m}' is already in the '#{name}' ACL" if @methods.include?(m)

  @methods << m
end

#to_s ⇒ Object 



142
143
144
 
# File 'lib/puppet/network/rights.rb', line 142

def to_s
  "access[#{@name}]"
end

#valid? ⇒ Boolean

There’s no real check to do at this point

Returns:

  • (Boolean) 


147
148
149
 
# File 'lib/puppet/network/rights.rb', line 147

def valid?
  true
end