sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-16 19:59:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Replace RequireFlowInitiator with AuthzLevel and clear flow on switch profile

Browse Source
This commit is contained in:
Theodor S. Midtlien
2026-09-16 10:37:59 +02:00
parent 7705645492
commit 2d5ee900d0
4 changed files with 38 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/internal/ipcauth/authz_gate.go
+3 -7
View File
@@ -18,6 +18,9 @@ type DaemonState interface {
// whether one is held.
SessionHolder() (Principal, bool)
// OwnsProfile reports whether id owns the profile a request names. An empty
// handle is the active profile, which is what a method that acts on the
// live session resolves against.
OwnsProfile(id Identity, handle string) bool
}
@@ -74,13 +77,6 @@ func RequireLevel(want AuthzLevel) Rule {
}
}
// RequireFlowInitiator binds a pending authentication flow to the identity that
// started it.
func RequireFlowInitiator(r Request) error {
// TODO: needs the flow registry keyed by initiator.
return nil
}
func denyLevel(r Request, want AuthzLevel) error {
return status.Errorf(codes.PermissionDenied,
"%s requires %s, caller %s is %s", r.Method, want, r.Identity, r.Level)
client/internal/ipcauth/methods.go
+7 -7
View File
@@ -53,11 +53,6 @@ var methodPolicies = map[string]MethodPolicy{
servicePath + "GetFeatures": {Level: AuthzLevelIdentified},
servicePath + "WailsUIReady": {Level: AuthzLevelIdentified},
// Pending flows: bound to the principal that started them, at any level.
servicePath + "WaitSSOLogin": {Level: AuthzLevelIdentified, Rules: []Rule{RequireFlowInitiator}, Audit: true},
servicePath + "WaitJWTToken": {Level: AuthzLevelIdentified, Rules: []Rule{RequireFlowInitiator}, Audit: true},
servicePath + "WaitExtendAuthSession": {Level: AuthzLevelIdentified, Rules: []Rule{RequireFlowInitiator}},
// Owner of the profile the request names.
servicePath + "GetConfig": {Level: AuthzLevelProfileOwner, TargetsProfile: true, Audit: true},
servicePath + "SetConfig": {Level: AuthzLevelProfileOwner, TargetsProfile: true, Audit: true},
@@ -67,12 +62,14 @@ var methodPolicies = map[string]MethodPolicy{
servicePath + "RemoveProfile": {Level: AuthzLevelProfileOwner, TargetsProfile: true, Audit: true},
servicePath + "SwitchProfile": {Level: AuthzLevelSessionHolder, TargetsProfile: true, Audit: true},
// Owner of some profile
// Owner of the active profile, which is what an empty target resolves to.
servicePath + "GetLogLevel": {Level: AuthzLevelProfileOwner},
servicePath + "ListStates": {Level: AuthzLevelProfileOwner},
servicePath + "GetInstallerResult": {Level: AuthzLevelProfileOwner},
// Session holder: the live engine and everything daemon-wide.
// Session holder: the live engine and everything daemon-wide. A pending
// authentication flow belongs to the profile it was started for, so each
// Wait sits at the level of the RPC that starts it.
servicePath + "Up": {Level: AuthzLevelSessionHolder, TargetsProfile: true, Audit: true},
servicePath + "Down": {Level: AuthzLevelSessionHolder, Audit: true},
servicePath + "SubscribeStatus": {Level: AuthzLevelSessionHolder},
@@ -85,7 +82,10 @@ var methodPolicies = map[string]MethodPolicy{
servicePath + "ExposeService": {Level: AuthzLevelSessionHolder, Audit: true},
servicePath + "GetPeerSSHHostKey": {Level: AuthzLevelSessionHolder},
servicePath + "RequestJWTAuth": {Level: AuthzLevelSessionHolder, Audit: true},
servicePath + "WaitJWTToken": {Level: AuthzLevelSessionHolder, Audit: true},
servicePath + "RequestExtendAuthSession": {Level: AuthzLevelSessionHolder},
servicePath + "WaitExtendAuthSession": {Level: AuthzLevelSessionHolder},
servicePath + "WaitSSOLogin": {Level: AuthzLevelSessionHolder, Audit: true},
servicePath + "DismissSessionWarning": {Level: AuthzLevelSessionHolder},
servicePath + "DebugBundle": {Level: AuthzLevelSessionHolder, Audit: true},
servicePath + "SetLogLevel": {Level: AuthzLevelSessionHolder},