Class: Puppet::Network::Rights::Right

Inherits:
AuthStore show all
Defined in:
lib/puppet/network/rights.rb

Overview

A right.

Constant Summary collapse

ALL = 
[:save, :destroy, :find, :search]

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods inherited from AuthStore

#allow, #allow_ip, #deny, #deny_ip, #empty?, #globalallow?, #interpolate, #reset_interpolation

Methods included from Util::Logging

#clear_deprecation_warnings, #debug, #deprecation_warning, #format_backtrace, #format_exception, #get_deprecation_offender, #log_and_raise, #log_deprecations_to_file, #log_exception, #puppet_deprecation_warning, #send_log, setup_facter_logging!, #warn_once

Constructor Details

#initialize(name, line, file) ⇒ Right

Returns a new instance of Right.



111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
 
# File 'lib/puppet/network/rights.rb', line 111

def initialize(name, line, file)
  @methods = []
  @environment = []
  @authentication = true # defaults to authenticated
  @name = name
  @line = line || 0
  @file = file
  @methods = ALL

  case name
  when /^\//
    @key = Regexp.new("^" + Regexp.escape(name))
  when /^~/ # this is a regex
    @name = name.gsub(/^~\s+/,'')
    @key = Regexp.new(@name)
  else
    raise ArgumentError, _("Unknown right type '%{name}'") % { name: name }
  end

  super()
end

Instance Attribute Details

#authentication ⇒ Object

Overriding Object#methods sucks for debugging. If we’re in here in the future, it would be nice to rename Right#methods



104
105
106
 
# File 'lib/puppet/network/rights.rb', line 104

def authentication
  @authentication
end

#environment ⇒ Object

Overriding Object#methods sucks for debugging. If we’re in here in the future, it would be nice to rename Right#methods



104
105
106
 
# File 'lib/puppet/network/rights.rb', line 104

def environment
  @environment
end

#file ⇒ Object

Returns the value of attribute file.



105
106
107
 
# File 'lib/puppet/network/rights.rb', line 105

def file
  @file
end

#key ⇒ Object

Returns the value of attribute key.



101
102
103
 
# File 'lib/puppet/network/rights.rb', line 101

def key
  @key
end

#line ⇒ Object

Returns the value of attribute line.



105
106
107
 
# File 'lib/puppet/network/rights.rb', line 105

def line
  @line
end

#methods ⇒ Object

Overriding Object#methods sucks for debugging. If we’re in here in the future, it would be nice to rename Right#methods



104
105
106
 
# File 'lib/puppet/network/rights.rb', line 104

def methods
  @methods
end

#name ⇒ Object

Returns the value of attribute name.



101
102
103
 
# File 'lib/puppet/network/rights.rb', line 101

def name
  @name
end

Instance Method Details

#==(name) ⇒ Object 



205
206
207
 
# File 'lib/puppet/network/rights.rb', line 205

def ==(name)
  self.name == name.gsub(/^~\s+/,'')
end

#allowed?(name, ip, args = {}) ⇒ Boolean

does this right is allowed for this triplet? if this right is too restrictive (ie we don’t match this access method) then return :dunno so that upper layers have a chance to try another right tailored to the given method

Returns:

  • (Boolean) 


146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
 
# File 'lib/puppet/network/rights.rb', line 146

def allowed?(name, ip, args = {})
  if not @methods.include?(args[:method])
    return :dunno
  elsif @environment.size > 0 and not @environment.include?(args[:environment])
    return :dunno
  elsif (@authentication and not args[:authenticated])
    return :dunno
  end

  begin
    # make sure any capture are replaced if needed
    interpolate(args[:match]) if args[:match]
    res = super(name,ip)
  ensure
    reset_interpolation
  end
  res
end

#match?(key) ⇒ Boolean

Returns:

  • (Boolean) 


200
201
202
203
 
# File 'lib/puppet/network/rights.rb', line 200

def match?(key)
  # otherwise match with the regex
  self.key.match(key)
end

#restrict_authenticated(authentication) ⇒ Object 



188
189
190
191
192
193
194
195
196
197
198
 
# File 'lib/puppet/network/rights.rb', line 188

def restrict_authenticated(authentication)
  case authentication
  when "yes", "on", "true", true
    authentication = true
  when "no", "off", "false", false, "all" ,"any", :all, :any
    authentication = false
  else
    raise ArgumentError, _("'%{name}' incorrect authenticated value: %{authentication}") % { name: name, authentication: authentication }
  end
  @authentication = authentication
end

#restrict_environment(environment) ⇒ Object

Raises:

  • (ArgumentError) 


181
182
183
184
185
186
 
# File 'lib/puppet/network/rights.rb', line 181

def restrict_environment(environment)
  env = Puppet.lookup(:environments).get(environment)
  raise ArgumentError, _("'%{env}' is already in the '%{name}' ACL") % { env: env, name: name } if @environment.include?(env)

  @environment << env
end

#restrict_method(m) ⇒ Object

restrict this right to some method only

Raises:

  • (ArgumentError) 


166
167
168
169
170
171
172
173
174
175
176
177
178
179
 
# File 'lib/puppet/network/rights.rb', line 166

def restrict_method(m)
  m = m.intern if m.is_a?(String)

  raise ArgumentError, _("'%{m}' is not an allowed value for method directive") % { m: m } unless ALL.include?(m)

  # if we were allowing all methods, then starts from scratch
  if @methods === ALL
    @methods = []
  end

  raise ArgumentError, _("'%{m}' is already in the '%{name}' ACL") % { m: m, name: name } if @methods.include?(m)

  @methods << m
end

#to_s ⇒ Object 



133
134
135
 
# File 'lib/puppet/network/rights.rb', line 133

def to_s
  "access[#{@name}]"
end

#valid? ⇒ Boolean

There’s no real check to do at this point

Returns:

  • (Boolean) 


138
139
140
 
# File 'lib/puppet/network/rights.rb', line 138

def valid?
  true
end