Authorization refactor in preparation for fine-grained authorization

lxd/auth/authorization.go

@@ -1,62 +1,140 @@
 package auth
 
 import (
+	"context"
 	"fmt"
 	"net/http"
 
+	"github.com/canonical/lxd/lxd/certificate"
 	"github.com/canonical/lxd/shared/logger"
 )
 
+const (
+	// DriverTLS is the default TLS authorization driver. It is not compatible with OIDC or Candid authentication.
+	DriverTLS string = "tls"
+
+	// DriverRBAC is role-based authorization. It is not compatible with TLS authentication.
+	DriverRBAC string = "rbac"
+)
+
 // ErrUnknownDriver is the "Unknown driver" error.
 var ErrUnknownDriver = fmt.Errorf("Unknown driver")
 
 var authorizers = map[string]func() authorizer{
-	"tls": func() authorizer { return &tls{} },
-	"rbac": func() authorizer {
+	DriverTLS: func() authorizer { return &tls{} },
+	DriverRBAC: func() authorizer {
 		return &rbac{
 			resources:   map[string]string{},
-			permissions: map[string]map[string][]string{},
+			permissions: map[string]map[string][]Permission{},
 		}
 	},
 }
 
 type authorizer interface {
 	Authorizer
 
-	init(name string, config map[string]any, logger logger.Logger, projectsGetFunc func() (map[int64]string, error))
-	load() error
+	init(driverName string, logger logger.Logger) error
+	load(ctx context.Context, certificateCache *certificate.Cache, opts Opts) error
 }
 
+// PermissionChecker is a type alias for a function that returns whether a user has required permissions on an object.
+// It is returned by Authorizer.GetPermissionChecker.
+type PermissionChecker func(object Object) bool
+
+// Authorizer is the primary external API for this package.
 type Authorizer interface {
-	AddProject(projectID int64, name string) error
-	DeleteProject(projectID int64) error
-	RenameProject(projectID int64, newName string) error
+	Driver() string
+	StopService(ctx context.Context) error
+
+	CheckPermission(ctx context.Context, r *http.Request, object Object, entitlement Entitlement) error
+	GetPermissionChecker(ctx context.Context, r *http.Request, entitlement Entitlement, objectType ObjectType) (PermissionChecker, error)
+
+	AddProject(ctx context.Context, projectID int64, projectName string) error
+	DeleteProject(ctx context.Context, projectID int64, projectName string) error
+	RenameProject(ctx context.Context, projectID int64, oldName string, newName string) error
+
+	AddCertificate(ctx context.Context, fingerprint string) error
+	DeleteCertificate(ctx context.Context, fingerprint string) error
+
+	AddStoragePool(ctx context.Context, storagePoolName string) error
+	DeleteStoragePool(ctx context.Context, storagePoolName string) error
+
+	AddImage(ctx context.Context, projectName string, fingerprint string) error
+	DeleteImage(ctx context.Context, projectName string, fingerprint string) error
+
+	AddImageAlias(ctx context.Context, projectName string, imageAliasName string) error
+	DeleteImageAlias(ctx context.Context, projectName string, imageAliasName string) error
+	RenameImageAlias(ctx context.Context, projectName string, oldAliasName string, newAliasName string) error
+
+	AddInstance(ctx context.Context, projectName string, instanceName string) error
+	DeleteInstance(ctx context.Context, projectName string, instanceName string) error
+	RenameInstance(ctx context.Context, projectName string, oldInstanceName string, newInstanceName string) error
+
+	AddNetwork(ctx context.Context, projectName string, networkName string) error
+	DeleteNetwork(ctx context.Context, projectName string, networkName string) error
+	RenameNetwork(ctx context.Context, projectName string, oldNetworkName string, newNetworkName string) error
+
+	AddNetworkZone(ctx context.Context, projectName string, networkZoneName string) error
+	DeleteNetworkZone(ctx context.Context, projectName string, networkZoneName string) error
 
-	StopStatusCheck()
+	AddNetworkACL(ctx context.Context, projectName string, networkACLName string) error
+	DeleteNetworkACL(ctx context.Context, projectName string, networkACLName string) error
+	RenameNetworkACL(ctx context.Context, projectName string, oldNetworkACLName string, newNetworkACLName string) error
 
-	UserAccess(username string) (*UserAccess, error)
-	UserIsAdmin(r *http.Request) bool
-	UserHasPermission(r *http.Request, projectName string, permission string) bool
+	AddProfile(ctx context.Context, projectName string, profileName string) error
+	DeleteProfile(ctx context.Context, projectName string, profileName string) error
+	RenameProfile(ctx context.Context, projectName string, oldProfileName string, newProfileName string) error
+
+	AddStoragePoolVolume(ctx context.Context, projectName string, storagePoolName string, storageVolumeType string, storageVolumeName string) error
+	DeleteStoragePoolVolume(ctx context.Context, projectName string, storagePoolName string, storageVolumeType string, storageVolumeName string) error
+	RenameStoragePoolVolume(ctx context.Context, projectName string, storagePoolName string, storageVolumeType string, oldStorageVolumeName string, newStorageVolumeName string) error
+
+	AddStorageBucket(ctx context.Context, projectName string, storagePoolName string, storageBucketName string) error
+	DeleteStorageBucket(ctx context.Context, projectName string, storagePoolName string, storageBucketName string) error
+}
+
+// Opts is used as part of the LoadAuthorizer function so that only the relevant configuration fields are passed into a
+// particular driver.
+type Opts struct {
+	config          map[string]any
+	projectsGetFunc func(ctx context.Context) (map[int64]string, error)
+}
+
+// WithConfig can be passed into LoadAuthorizer to pass in driver specific configuration.
+func WithConfig(c map[string]any) func(*Opts) {
+	return func(o *Opts) {
+		o.config = c
+	}
 }
 
-// UserAccess struct for permission checks.
-type UserAccess struct {
-	Admin    bool
-	Projects map[string][]string
+// WithProjectsGetFunc should be passed into LoadAuthorizer when DriverRBAC is used.
+func WithProjectsGetFunc(f func(ctx context.Context) (map[int64]string, error)) func(*Opts) {
+	return func(o *Opts) {
+		o.projectsGetFunc = f
+	}
 }
 
-func LoadAuthorizer(name string, config map[string]any, logger logger.Logger, projectsGetFunc func() (map[int64]string, error)) (Authorizer, error) {
-	driverFunc, ok := authorizers[name]
+// LoadAuthorizer instantiates, configures, and initialises an Authorizer.
+func LoadAuthorizer(ctx context.Context, driver string, logger logger.Logger, certificateCache *certificate.Cache, options ...func(opts *Opts)) (Authorizer, error) {
+	opts := &Opts{}
+	for _, o := range options {
+		o(opts)
+	}
+
+	driverFunc, ok := authorizers[driver]
 	if !ok {
 		return nil, ErrUnknownDriver
 	}
 
 	d := driverFunc()
-	d.init(name, config, logger, projectsGetFunc)
+	err := d.init(driver, logger)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to initialize authorizer: %w", err)
+	}
 
-	err := d.load()
+	err = d.load(ctx, certificateCache, *opts)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("Failed to load authorizer: %w", err)
 	}
 
 	return d, nil