extern/zrok
1
1
Fork 0
mirror of https://github.com/openziti/zrok.git synced 2024-11-21 23:53:19 +01:00
Code Issues Packages Projects Releases Wiki Activity

limits.CanAccessShare

Browse Source
This commit is contained in:
Michael Quigley 2023-06-06 11:29:22 -04:00
parent 243261d70a
commit 0fa1a350cd
No known key found for this signature in database
GPG Key ID: 9B60314A9DD20A62
2 changed files with 57 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
controller/access.go
View File

@ -57,7 +57,7 @@ func (h *accessHandler) Handle(params share.AccessParams, principal *rest_model_
return share.NewAccessNotFound()
}
if err := h.checkLimits(shrToken, trx); err != nil {
if err := h.checkLimits(shr, trx); err != nil {
logrus.Errorf("cannot access limited share for '%v': %v", principal.Email, err)
return share.NewAccessNotFound()
}
@ -99,14 +99,14 @@ func (h *accessHandler) Handle(params share.AccessParams, principal *rest_model_
})
}
func (h *accessHandler) checkLimits(shrToken string, trx *sqlx.Tx) error {
func (h *accessHandler) checkLimits(shr *store.Share, trx *sqlx.Tx) error {
if limitsAgent != nil {
ok, err := limitsAgent.CanAccessShare(shrToken, trx)
ok, err := limitsAgent.CanAccessShare(shr.Id, trx)
if err != nil {
return errors.Wrapf(err, "error checking share limits for '%v'", shrToken)
return errors.Wrapf(err, "error checking share limits for '%v'", shr.Token)
}
if !ok {
return errors.Errorf("share limit check failed for '%v'", shrToken)
return errors.Errorf("share limit check failed for '%v'", shr.Token)
}
}
return nil

53
controller/limits/agent.go
View File

@ -139,7 +139,58 @@ func (a *Agent) CanCreateShare(acctId, envId int, trx *sqlx.Tx) (bool, error) {
return true, nil
}
func (a *Agent) CanAccessShare(shrToken string, trx *sqlx.Tx) (bool, error) {
func (a *Agent) CanAccessShare(shrId int, trx *sqlx.Tx) (bool, error) {
if a.cfg.Enforcing {
shr, err := a.str.GetShare(shrId, trx)
if err != nil {
return false, err
}
if empty, err := a.str.IsShareLimitJournalEmpty(shr.Id, trx); err == nil && !empty {
slj, err := a.str.FindLatestShareLimitJournal(shr.Id, trx)
if err != nil {
return false, err
}
if slj.Action == store.LimitAction {
return false, nil
}
} else if err != nil {
return false, err
}
env, err := a.str.GetEnvironment(shr.EnvironmentId, trx)
if err != nil {
return false, err
}
if empty, err := a.str.IsEnvironmentLimitJournalEmpty(env.Id, trx); err == nil && !empty {
elj, err := a.str.FindLatestEnvironmentLimitJournal(env.Id, trx)
if err != nil {
return false, err
}
if elj.Action == store.LimitAction {
return false, nil
}
} else if err != nil {
return false, err
}
if env.AccountId != nil {
acct, err := a.str.GetAccount(*env.AccountId, trx)
if err != nil {
return false, err
}
if empty, err := a.str.IsAccountLimitJournalEmpty(acct.Id, trx); err == nil && !empty {
alj, err := a.str.FindLatestAccountLimitJournal(acct.Id, trx)
if err != nil {
return false, err
}
if alj.Action == store.LimitAction {
return false, nil
}
} else if err != nil {
return false, err
}
}
}
return true, nil
}