kuma

1
package access
2

3
import (
4
	"context"
5

6
	config_access "github.com/kumahq/kuma/pkg/config/access"
7
	"github.com/kumahq/kuma/pkg/core/access"
8
	"github.com/kumahq/kuma/pkg/core/user"
9
)
10

11
type staticZoneTokenAccess struct {
12
	usernames map[string]bool
13
	groups    map[string]bool
14
}
15

16
var _ ZoneTokenAccess = &staticZoneTokenAccess{}
17

18
func NewStaticZoneTokenAccess(cfg config_access.GenerateZoneTokenStaticAccessConfig) ZoneTokenAccess {
19
	s := &staticZoneTokenAccess{
20
		usernames: map[string]bool{},
21
		groups:    map[string]bool{},
22
	}
23
	for _, user := range cfg.Users {
24
		s.usernames[user] = true
25
	}
26
	for _, group := range cfg.Groups {
27
		s.groups[group] = true
28
	}
29
	return s
30
}
31

32
func (s *staticZoneTokenAccess) ValidateGenerateZoneToken(ctx context.Context, zone string, user user.User) error {
33
	allowed := s.usernames[user.Name]
34
	for _, group := range user.Groups {
35
		if s.groups[group] {
36
			allowed = true
37
		}
38
	}
39
	if !allowed {
40
		return &access.AccessDeniedError{Reason: "action not allowed"}
41
	}
42
	return nil
43
}
44