// Updates or creates a principal from a PrincipalConfig structure.
func updatePrincipal(dbc *db.DatabaseContext, newInfo PrincipalConfig, isUser bool, allowReplace bool) (replaced bool, err error) {
// Get the existing principal, or if this is a POST make sure there isn't one:
var princ auth.Principal
var user auth.User
authenticator := dbc.Authenticator()
if isUser {
user, err = authenticator.GetUser(internalUserName(*newInfo.Name))
princ = user
} else {
princ, err = authenticator.GetRole(*newInfo.Name)
}
if err != nil {
return
}
replaced = (princ != nil)
if !replaced {
// If user/role didn't exist already, instantiate a new one:
if isUser {
user, err = authenticator.NewUser(internalUserName(*newInfo.Name), "", nil)
princ = user
} else {
princ, err = authenticator.NewRole(*newInfo.Name, nil)
}
if err != nil {
return
}
} else if !allowReplace {
err = base.HTTPErrorf(http.StatusConflict, "Already exists")
return
}
// Now update the Principal object from the properties in the request, first the channels:
updatedChannels := princ.ExplicitChannels()
if updatedChannels == nil {
updatedChannels = ch.TimedSet{}
}
lastSeq, err := dbc.LastSequence()
if err != nil {
return
}
updatedChannels.UpdateAtSequence(newInfo.ExplicitChannels, lastSeq+1)
princ.SetExplicitChannels(updatedChannels)
// Then the roles:
if isUser {
user.SetEmail(newInfo.Email)
if newInfo.Password != nil {
user.SetPassword(*newInfo.Password)
}
user.SetDisabled(newInfo.Disabled)
user.SetExplicitRoleNames(newInfo.ExplicitRoleNames)
}
// And finally save the Principal:
err = authenticator.Save(princ)
return
}
// Common behavior of putUser and putRole
func putPrincipal(r http.ResponseWriter, rq *http.Request, context *context, name string, princ auth.Principal) error {
context.auth.InvalidateChannels(princ)
if rq.Method == "POST" {
name = princ.Name()
if name == "" {
return &base.HTTPError{http.StatusBadRequest, "Missing name property"}
}
} else if princ.Name() != name {
return &base.HTTPError{http.StatusBadRequest, "Name mismatch (can't change name)"}
}
err := context.auth.Save(princ)
if err == nil {
r.WriteHeader(http.StatusCreated)
}
return err
}
// Recomputes the set of channels a User/Role has been granted access to by sync() functions.
// This is part of the ChannelComputer interface defined by the Authenticator.
func (context *DatabaseContext) ComputeChannelsForPrincipal(princ auth.Principal) (channels.TimedSet, error) {
key := princ.Name()
if _, ok := princ.(auth.User); !ok {
key = "role:" + key // Roles are identified in access view by a "role:" prefix
}
var vres struct {
Rows []struct {
Value channels.TimedSet
}
}
opts := map[string]interface{}{"stale": false, "key": key}
if verr := context.Bucket.ViewCustom("sync_gateway", "access", opts, &vres); verr != nil {
return nil, verr
}
channelSet := channels.TimedSet{}
for _, row := range vres.Rows {
channelSet.Add(row.Value)
}
return channelSet, nil
}
func (dbc *DatabaseContext) GetPrincipal(name string, isUser bool) (info *PrincipalConfig, err error) {
var princ auth.Principal
if isUser {
princ, err = dbc.Authenticator().GetUser(name)
} else {
princ, err = dbc.Authenticator().GetRole(name)
}
if princ == nil {
return
}
info = new(PrincipalConfig)
info.Name = &name
info.ExplicitChannels = princ.ExplicitChannels().AsSet()
if user, ok := princ.(auth.User); ok {
info.Channels = user.InheritedChannels().AsSet()
info.Email = user.Email()
info.Disabled = user.Disabled()
info.ExplicitRoleNames = user.ExplicitRoles().AllChannels()
info.RoleNames = user.RoleNames().AllChannels()
} else {
info.Channels = princ.Channels().AsSet()
}
return
}
func marshalPrincipal(princ auth.Principal) ([]byte, error) {
name := externalUserName(princ.Name())
info := PrincipalJSON{
Name: &name,
ExplicitChannels: princ.ExplicitChannels().AsSet(),
Channels: princ.Channels().AsSet(),
}
if user, ok := princ.(auth.User); ok {
info.Email = user.Email()
info.Disabled = user.Disabled()
info.ExplicitRoleNames = user.ExplicitRoleNames()
info.RoleNames = user.RoleNames()
}
return json.Marshal(info)
}
// Handles PUT and POST for a user or a role.
func (h *handler) updatePrincipal(name string, isUser bool) error {
h.assertAdminOnly()
// Unmarshal the request body into a PrincipalJSON struct:
body, _ := ioutil.ReadAll(h.rq.Body)
var newInfo PrincipalJSON
var err error
if err = json.Unmarshal(body, &newInfo); err != nil {
return err
}
var princ auth.Principal
var user auth.User
if h.rq.Method == "POST" {
// On POST, take the name from the "name" property in the request body:
if newInfo.Name == nil {
return &base.HTTPError{http.StatusBadRequest, "Missing name property"}
}
name = *newInfo.Name
} else {
// ON PUT, verify the name matches, if given:
if newInfo.Name != nil && *newInfo.Name != name {
return &base.HTTPError{http.StatusBadRequest, "Name mismatch (can't change name)"}
}
}
// Get the existing principal, or if this is a POST make sure there isn't one:
if isUser {
user, err = h.db.Authenticator().GetUser(internalUserName(name))
princ = user
} else {
princ, err = h.db.Authenticator().GetRole(name)
}
if err != nil {
return err
}
status := http.StatusOK
if princ == nil {
// If user/role didn't exist already, instantiate a new one:
status = http.StatusCreated
if isUser {
user, err = h.db.Authenticator().NewUser(internalUserName(name), "", nil)
princ = user
} else {
princ, err = h.db.Authenticator().NewRole(name, nil)
}
if err != nil {
return err
}
} else if h.rq.Method == "POST" {
return &base.HTTPError{http.StatusConflict, "Already exists"}
}
// Now update the Principal object from the properties in the request, first the channels:
updatedChannels := princ.ExplicitChannels()
if updatedChannels == nil {
updatedChannels = ch.TimedSet{}
}
updatedChannels.UpdateAtSequence(newInfo.ExplicitChannels, h.db.LastSequence()+1)
princ.SetExplicitChannels(updatedChannels)
// Then the roles:
if isUser {
user.SetEmail(newInfo.Email)
if newInfo.Password != nil {
user.SetPassword(*newInfo.Password)
}
user.SetDisabled(newInfo.Disabled)
user.SetExplicitRoleNames(newInfo.ExplicitRoleNames)
}
// And finally save the Principal:
if err = h.db.Authenticator().Save(princ); err != nil {
return err
}
h.response.WriteHeader(status)
return nil
}
// Updates or creates a principal from a PrincipalConfig structure.
func updatePrincipal(dbc *db.DatabaseContext, newInfo PrincipalConfig, isUser bool, allowReplace bool) (replaced bool, err error) {
// Get the existing principal, or if this is a POST make sure there isn't one:
var princ auth.Principal
var user auth.User
authenticator := dbc.Authenticator()
if isUser {
user, err = authenticator.GetUser(internalUserName(*newInfo.Name))
princ = user
} else {
princ, err = authenticator.GetRole(*newInfo.Name)
}
if err != nil {
return
}
replaced = (princ != nil)
if !replaced {
// If user/role didn't exist already, instantiate a new one:
if isUser {
user, err = authenticator.NewUser(internalUserName(*newInfo.Name), "", nil)
princ = user
} else {
princ, err = authenticator.NewRole(*newInfo.Name, nil)
}
if err != nil {
return
}
} else if !allowReplace {
err = base.HTTPErrorf(http.StatusConflict, "Already exists")
return
}
// Now update the Principal object from the properties in the request, first the channels:
updatedChannels := princ.ExplicitChannels()
if updatedChannels == nil {
updatedChannels = ch.TimedSet{}
}
lastSeq, err := dbc.LastSequence()
if err != nil {
return
}
updatedChannels.UpdateAtSequence(newInfo.ExplicitChannels, lastSeq+1)
princ.SetExplicitChannels(updatedChannels)
// Then the user-specific fields like roles:
if isUser {
user.SetEmail(newInfo.Email)
if newInfo.Password != nil {
user.SetPassword(*newInfo.Password)
}
user.SetDisabled(newInfo.Disabled)
// Convert the array of role strings into a TimedSet by reapplying the current sequences
// for existing roles, and using the database's last sequence for any new roles.
newRoles := ch.TimedSet{}
oldRoles := user.ExplicitRoles()
var currentSequence uint64
for _, roleName := range newInfo.ExplicitRoleNames {
since, found := oldRoles[roleName]
if !found {
if currentSequence == 0 {
currentSequence, _ = dbc.LastSequence()
if currentSequence == 0 {
currentSequence = 1
}
}
since = currentSequence
}
newRoles[roleName] = since
}
user.SetExplicitRoles(newRoles)
}
// And finally save the Principal:
err = authenticator.Save(princ)
return
}
// Updates or creates a principal from a PrincipalConfig structure.
func (dbc *DatabaseContext) UpdatePrincipal(newInfo PrincipalConfig, isUser bool, allowReplace bool) (replaced bool, err error) {
// Get the existing principal, or if this is a POST make sure there isn't one:
var princ auth.Principal
var user auth.User
authenticator := dbc.Authenticator()
if isUser {
if newInfo.Password != nil && len(*(newInfo.Password)) < 3 {
err = base.HTTPErrorf(http.StatusBadRequest, "Passwords must be at least three 3 characters")
return
}
user, err = authenticator.GetUser(*newInfo.Name)
princ = user
} else {
princ, err = authenticator.GetRole(*newInfo.Name)
}
if err != nil {
return
}
changed := false
replaced = (princ != nil)
if !replaced {
// If user/role didn't exist already, instantiate a new one:
if isUser {
user, err = authenticator.NewUser(*newInfo.Name, "", nil)
princ = user
} else {
princ, err = authenticator.NewRole(*newInfo.Name, nil)
}
if err != nil {
return
}
changed = true
} else if !allowReplace {
err = base.HTTPErrorf(http.StatusConflict, "Already exists")
return
}
// Update the persistent sequence number of this principal:
nextSeq, err := dbc.sequences.nextSequence()
if err != nil {
return
}
princ.SetSequence(nextSeq)
// Now update the Principal object from the properties in the request, first the channels:
updatedChannels := princ.ExplicitChannels()
if updatedChannels == nil {
updatedChannels = ch.TimedSet{}
}
if updatedChannels.UpdateAtSequence(newInfo.ExplicitChannels, nextSeq) {
princ.SetExplicitChannels(updatedChannels)
changed = true
}
// Then the user-specific fields like roles:
if isUser {
if newInfo.Email != user.Email() {
user.SetEmail(newInfo.Email)
changed = true
}
if newInfo.Password != nil {
user.SetPassword(*newInfo.Password)
changed = true
}
if newInfo.Disabled != user.Disabled() {
user.SetDisabled(newInfo.Disabled)
changed = true
}
updatedRoles := user.ExplicitRoles()
if updatedRoles == nil {
updatedRoles = ch.TimedSet{}
}
if updatedRoles.UpdateAtSequence(base.SetFromArray(newInfo.ExplicitRoleNames), nextSeq) {
user.SetExplicitRoles(updatedRoles)
changed = true
}
}
// And finally save the Principal:
if changed {
err = authenticator.Save(princ)
}
return
}
