func cacheKey(ctx kapi.Context, a authorizer.Action) (string, error) { if a.GetRequestAttributes() != nil { // TODO: see if we can serialize this? return "", errors.New("cannot cache request attributes") } keyData := map[string]interface{}{ "verb": a.GetVerb(), "apiVersion": a.GetAPIVersion(), "apiGroup": a.GetAPIGroup(), "resource": a.GetResource(), "resourceName": a.GetResourceName(), "nonResourceURL": a.IsNonResourceURL(), "url": a.GetURL(), } if namespace, ok := kapi.NamespaceFrom(ctx); ok { keyData["namespace"] = namespace } if user, ok := kapi.UserFrom(ctx); ok { keyData["user"] = user.GetName() keyData["groups"] = user.GetGroups() keyData["scopes"] = user.GetExtra()[authorizationapi.ScopesKey] } key, err := json.Marshal(keyData) return string(key), err }
func getAction(namespace string, attributes authorizer.Action) authzapi.Action { return authzapi.Action{ Namespace: namespace, Verb: attributes.GetVerb(), Group: attributes.GetAPIGroup(), Version: attributes.GetAPIVersion(), Resource: attributes.GetResource(), ResourceName: attributes.GetResourceName(), // TODO: missing from authorizer.Action: // Content // TODO: missing from authzapi.Action // RequestAttributes (unserializable?) // IsNonResourceURL // URL (doesn't make sense for remote authz?) } }