github/distribution
1
0
Fork 0
mirror of https://github.com/distribution/distribution.git synced 2025-09-07 01:41:02 +00:00
Code Issues Projects Releases Wiki Activity

reg/auth: remove contexts from Authorized method

Browse Source 
The details of how request-scoped information is propagated through the
registry server app should be left as private implementation details so
they can be changed without fear of breaking compatibility with
third-party code which imports the distribution module. The
AccessController interface unnecessarily bakes into the public API
details of how authorization grants are propagated through request
contexts. In practice the only values the in-tree authorizers attach to
the request contexts are the UserInfo and Resources for the request.
Change the AccessController interface to return the UserInfo and
Resources directly to allow us to change how request contexts are used
within the app without altering the AccessController interface contract.

Signed-off-by: Cory Snider <csnider@mirantis.com>
This commit is contained in:
Cory Snider
2023-10-24 16:41:54 -04:00
parent 49e22cbf3e
commit bd80d7590d
8 changed files with 53 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
registry/auth/token/token_test.go
View File

@@ -465,7 +465,7 @@ func TestAccessController(t *testing.T) {
Action: "baz",
}
authCtx, err := accessController.Authorized(req, testAccess)
grant, err := accessController.Authorized(req, testAccess)
challenge, ok := err.(auth.Challenge)
if !ok {
t.Fatal("accessController did not return a challenge")
@@ -475,8 +475,8 @@ func TestAccessController(t *testing.T) {
t.Fatalf("accessControler did not get expected error - got %s - expected %s", challenge, ErrTokenRequired)
}
if authCtx != nil {
t.Fatalf("expected nil auth context but got %s", authCtx)
if grant != nil {
t.Fatalf("expected nil auth grant but got %#v", grant)
}
// 2. Supply an invalid token.
@@ -500,7 +500,7 @@ func TestAccessController(t *testing.T) {
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token.Raw))
authCtx, err = accessController.Authorized(req, testAccess)
grant, err = accessController.Authorized(req, testAccess)
challenge, ok = err.(auth.Challenge)
if !ok {
t.Fatal("accessController did not return a challenge")
@@ -510,8 +510,8 @@ func TestAccessController(t *testing.T) {
t.Fatalf("accessControler did not get expected error - got %s - expected %s", challenge, ErrTokenRequired)
}
if authCtx != nil {
t.Fatalf("expected nil auth context but got %s", authCtx)
if grant != nil {
t.Fatalf("expected nil auth grant but got %#v", grant)
}
// create a valid jwk
@@ -532,7 +532,7 @@ func TestAccessController(t *testing.T) {
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token.Raw))
authCtx, err = accessController.Authorized(req, testAccess)
grant, err = accessController.Authorized(req, testAccess)
challenge, ok = err.(auth.Challenge)
if !ok {
t.Fatal("accessController did not return a challenge")
@@ -542,8 +542,8 @@ func TestAccessController(t *testing.T) {
t.Fatalf("accessControler did not get expected error - got %s - expected %s", challenge, ErrInsufficientScope)
}
if authCtx != nil {
t.Fatalf("expected nil auth context but got %s", authCtx)
if grant != nil {
t.Fatalf("expected nil auth grant but got %#v", grant)
}
// 4. Supply the token we need, or deserve, or whatever.
@@ -562,18 +562,13 @@ func TestAccessController(t *testing.T) {
req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token.Raw))
authCtx, err = accessController.Authorized(req, testAccess)
grant, err = accessController.Authorized(req, testAccess)
if err != nil {
t.Fatalf("accessController returned unexpected error: %s", err)
}
userInfo, ok := authCtx.Value(auth.UserKey).(auth.UserInfo)
if !ok {
t.Fatal("token accessController did not set auth.user context")
}
if userInfo.Name != "foo" {
t.Fatalf("expected user name %q, got %q", "foo", userInfo.Name)
if grant.User.Name != "foo" {
t.Fatalf("expected user name %q, got %q", "foo", grant.User.Name)
}
// 5. Supply a token with full admin rights, which is represented as "*".