extern/zrok
1
1
Fork 0
mirror of https://github.com/openziti/zrok.git synced 2025-06-19 17:27:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

check limit journals for creating environments or shares (#281)

Browse Source
This commit is contained in:
Michael Quigley 2023-03-29 13:29:12 -04:00
parent b8aec46548
commit f9dc0f6ba1
No known key found for this signature in database
GPG Key ID: 9B60314A9DD20A62
2 changed files with 55 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
controller/limits/agent.go
View File

@ -69,35 +69,71 @@ func (a *Agent) Stop() {
} }
func (a *Agent) CanCreateEnvironment(acctId int, trx *sqlx.Tx) (bool, error) { func (a *Agent) CanCreateEnvironment(acctId int, trx *sqlx.Tx) (bool, error) {
if a.cfg.Enforcing && a.cfg.Environments > Unlimited { if a.cfg.Enforcing {
envs, err := a.str.FindEnvironmentsForAccount(acctId, trx) alj, err := a.str.FindLatestAccountLimitJournal(acctId, trx)
if err != nil { if err != nil {
return false, err return false, err
} }
if len(envs)+1 > a.cfg.Environments { if alj.Action == store.LimitAction {
return false, nil return false, nil
} }
if a.cfg.Environments > Unlimited {
envs, err := a.str.FindEnvironmentsForAccount(acctId, trx)
if err != nil {
return false, err
}
if len(envs)+1 > a.cfg.Environments {
return false, nil
}
}
} }
return true, nil return true, nil
} }
func (a *Agent) CanCreateShare(acctId int, trx *sqlx.Tx) (bool, error) { func (a *Agent) CanCreateShare(acctId, envId int, trx *sqlx.Tx) (bool, error) {
if a.cfg.Enforcing && a.cfg.Shares > Unlimited { if a.cfg.Enforcing {
envs, err := a.str.FindEnvironmentsForAccount(acctId, trx) if empty, err := a.str.IsAccountLimitJournalEmpty(acctId, trx); err == nil && !empty {
if err != nil { alj, err := a.str.FindLatestAccountLimitJournal(acctId, trx)
return false, err
}
total := 0
for i := range envs {
shrs, err := a.str.FindSharesForEnvironment(envs[i].Id, trx)
if err != nil { if err != nil {
return false, errors.Wrapf(err, "unable to find shares for environment '%v'", envs[i].ZId) return false, err
} }
total += len(shrs) if alj.Action == store.LimitAction {
if total+1 > a.cfg.Shares {
return false, nil return false, nil
} }
logrus.Infof("total = %d", total) } else if err != nil {
return false, err
}
if empty, err := a.str.IsEnvironmentLimitJournalEmpty(envId, trx); err == nil && !empty {
elj, err := a.str.FindLatestEnvironmentLimitJournal(envId, trx)
if err != nil {
return false, err
}
if elj.Action == store.LimitAction {
return false, nil
}
} else if err != nil {
return false, err
}
if a.cfg.Shares > Unlimited {
envs, err := a.str.FindEnvironmentsForAccount(acctId, trx)
if err != nil {
return false, err
}
total := 0
for i := range envs {
shrs, err := a.str.FindSharesForEnvironment(envs[i].Id, trx)
if err != nil {
return false, errors.Wrapf(err, "unable to find shares for environment '%v'", envs[i].ZId)
}
total += len(shrs)
if total+1 > a.cfg.Shares {
return false, nil
}
logrus.Infof("total = %d", total)
}
} }
} }
return true, nil return true, nil

6
controller/share.go
View File

@ -47,7 +47,7 @@ func (h *shareHandler) Handle(params share.ShareParams, principal *rest_model_zr
return share.NewShareInternalServerError() return share.NewShareInternalServerError()
} }
if err := h.checkLimits(principal, trx); err != nil { if err := h.checkLimits(envId, principal, trx); err != nil {
logrus.Errorf("limits error: %v", err) logrus.Errorf("limits error: %v", err)
return share.NewShareUnauthorized() return share.NewShareUnauthorized()
} }
@ -142,10 +142,10 @@ func (h *shareHandler) Handle(params share.ShareParams, principal *rest_model_zr
}) })
} }
func (h *shareHandler) checkLimits(principal *rest_model_zrok.Principal, trx *sqlx.Tx) error { func (h *shareHandler) checkLimits(envId int, principal *rest_model_zrok.Principal, trx *sqlx.Tx) error {
if !principal.Limitless { if !principal.Limitless {
if limitsAgent != nil { if limitsAgent != nil {
ok, err := limitsAgent.CanCreateShare(int(principal.ID), trx) ok, err := limitsAgent.CanCreateShare(int(principal.ID), envId, trx)
if err != nil { if err != nil {
return errors.Wrapf(err, "error checking share limits for '%v'", principal.Email) return errors.Wrapf(err, "error checking share limits for '%v'", principal.Email)
} }