github/distribution
1
0
Fork 0
mirror of https://github.com/distribution/distribution.git synced 2025-09-09 10:49:19 +00:00
Code Issues Projects Releases Wiki Activity

reg/auth: remove contexts from Authorized method

Browse Source 
The details of how request-scoped information is propagated through the
registry server app should be left as private implementation details so
they can be changed without fear of breaking compatibility with
third-party code which imports the distribution module. The
AccessController interface unnecessarily bakes into the public API
details of how authorization grants are propagated through request
contexts. In practice the only values the in-tree authorizers attach to
the request contexts are the UserInfo and Resources for the request.
Change the AccessController interface to return the UserInfo and
Resources directly to allow us to change how request contexts are used
within the app without altering the AccessController interface contract.

Signed-off-by: Cory Snider <csnider@mirantis.com>
This commit is contained in:
Cory Snider
2023-10-24 16:41:54 -04:00
parent 49e22cbf3e
commit bd80d7590d
8 changed files with 53 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
registry/auth/auth.go
View File

@@ -76,6 +76,12 @@ type Access struct {
Action string
}
// Grant describes the permitted level of access for an authorized request.
type Grant struct {
User UserInfo // The authenticated user for the request.
Resources []Resource // The list of resources which have been authorized for the request.
}
// Challenge is a special error type which is used for HTTP 401 Unauthorized
// responses and is able to write the response with WWW-Authenticate challenge
// header values based on the error.
@@ -93,15 +99,15 @@ type Challenge interface {
// and required access levels for a request. Implementations can support both
// complete denial and http authorization challenges.
type AccessController interface {
// Authorized returns a nil error if the request is granted access and
// returns a new authorized context. If one or more Access structs are
// provided, the requested access will be compared with what is available
// to the request. Access is denied if the error is non-nil. The error may
// be of type Challenge, in which case the caller may have the Challenge
// handle the request or choose what action to take based on the Challenge
// header or response status. The returned context object should be derived
// from r.Context() and have a "auth.user" value set to a UserInfo struct.
Authorized(r *http.Request, access ...Access) (context.Context, error)
// Authorized determines if the request is granted access. If one or more
// Access structs are provided, the requested access will be compared with
// what is available to the request.
//
// Return a Grant to grant the request access. Return an error to deny
// access. The error may be of type Challenge, in which case the caller may
// have the Challenge handle the request or choose what action to take based
// on the Challenge header or response status.
Authorized(r *http.Request, access ...Access) (*Grant, error)
}
// CredentialAuthenticator is an object which is able to authenticate credentials