Refactor gatePolicy to gateRule

client/internal/ipcauth/policy.go

@@ -10,70 +10,78 @@ import (
 	"google.golang.org/grpc/status"
 )
 
-type Policy interface {
+type DaemonState interface {
 	SessionHolder() (Identity, bool)
 }
 
-type PolicyGate struct {
-	mu     sync.Mutex
-	policy Policy
+type Rule func(id Identity, st DaemonState) error
+
+type RuleGate struct {
+	mu    sync.Mutex
+	rules []Rule
+	st    DaemonState
 }
 
-func NewPolicyGate() *PolicyGate {
-	return &PolicyGate{}
+func NewRuleGate() *RuleGate {
+	return &RuleGate{}
 }
 
-func (g *PolicyGate) SetPolicy(p Policy) {
+func (g *RuleGate) SetState(st DaemonState) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
-	g.policy = p
+	g.st = st
 }
 
-func (g *PolicyGate) SessionHolder() (Identity, bool) {
+func (g *RuleGate) SetRule(r Rule) {
 	g.mu.Lock()
 	defer g.mu.Unlock()
-	if g.policy == nil {
-		return Identity{}, false
+	g.rules = append(g.rules, r)
+}
+
+func (g *RuleGate) state() DaemonState {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return g.st
+}
+
+func RequireSessionHolder(id Identity, st DaemonState) error {
+	holder, running := st.SessionHolder()
+	log.Debugf("id : %v, session holder: %v", id, holder)
+	if !running || holder.SameUser(id) || holder.IsPrivileged() {
+		return nil
 	}
-	return g.policy.SessionHolder()
+	return status.Errorf(codes.PermissionDenied, "session is held by another user (%v)", holder)
 }
 
-func (g *PolicyGate) StreamPolicyInterceptor() grpc.StreamServerInterceptor {
+func (g *RuleGate) StreamPolicyInterceptor() grpc.StreamServerInterceptor {
 	return func(srv any, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
-		if !g.authorize(ss.Context()) {
-			return status.Error(codes.PermissionDenied, "caller is not session owner")
+		if authErr := g.authorize(ss.Context()); authErr != nil {
+			return authErr
 		}
 		return handler(ss.Context(), ss)
 	}
 }
 
-func (g *PolicyGate) UnaryPolicyInterceptor() grpc.UnaryServerInterceptor {
+func (g *RuleGate) UnaryPolicyInterceptor() grpc.UnaryServerInterceptor {
 	return func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp any, err error) {
-		if !g.authorize(ctx) {
-			return nil, status.Error(codes.PermissionDenied, "caller is not session owner")
+		if authErr := g.authorize(ctx); authErr != nil {
+			return nil, authErr
 		}
 		return handler(ctx, req)
 	}
 }
 
-func (g *PolicyGate) authorize(ctx context.Context) bool {
+func (g *RuleGate) authorize(ctx context.Context) error {
 	id, ok := CallerIdentity(ctx)
 	if !ok {
-		return false
+		return status.Error(codes.PermissionDenied, "caller cannot be verified")
 	}
-	g.mu.Lock()
-	if g.policy == nil {
-		g.mu.Unlock()
-		return false
+	state := g.state()
+	for _, rule := range g.rules {
+		ruleErr := rule(id, state)
+		if ruleErr != nil {
+			return ruleErr
+		}
 	}
-	sessionId, running := g.policy.SessionHolder()
-	// TODO improve logging
-	log.Infof("id : %v, session holder: %v", id, sessionId)
-	g.mu.Unlock()
-	// TODO windows
-	// TODO allow root
-	if running && sessionId.UID != id.UID {
-		return false
-	}
-	return true
+	return nil
 }