// NewControllerAPI creates a new api server endpoint for managing
// environments.
func NewControllerAPI(
st *state.State,
resources *common.Resources,
authorizer common.Authorizer,
) (*ControllerAPI, error) {
if !authorizer.AuthClient() {
return nil, errors.Trace(common.ErrPerm)
}
// Since we know this is a user tag (because AuthClient is true),
// we just do the type assertion to the UserTag.
apiUser, _ := authorizer.GetAuthTag().(names.UserTag)
isAdmin, err := st.IsControllerAdministrator(apiUser)
if err != nil {
return nil, errors.Trace(err)
}
// The entire end point is only accessible to controller administrators.
if !isAdmin {
return nil, errors.Trace(common.ErrPerm)
}
return &ControllerAPI{
state: st,
authorizer: authorizer,
apiUser: apiUser,
resources: resources,
}, nil
}
func checkAuth(authorizer common.Authorizer, st *state.State) error {
if !authorizer.AuthClient() {
return errors.Trace(common.ErrPerm)
}
// Type assertion is fine because AuthClient is true.
apiUser := authorizer.GetAuthTag().(names.UserTag)
if isAdmin, err := st.IsControllerAdministrator(apiUser); err != nil {
return errors.Trace(err)
} else if !isAdmin {
// The entire facade is only accessible to controller administrators.
return errors.Trace(common.ErrPerm)
}
return nil
}
func NewUserManagerAPI(
st *state.State,
resources *common.Resources,
authorizer common.Authorizer,
) (*UserManagerAPI, error) {
if !authorizer.AuthClient() {
return nil, common.ErrPerm
}
// Since we know this is a user tag (because AuthClient is true),
// we just do the type assertion to the UserTag.
apiUser, _ := authorizer.GetAuthTag().(names.UserTag)
// Pretty much all of the user manager methods have special casing for admin
// users, so look once when we start and remember if the user is an admin.
isAdmin, err := st.IsControllerAdministrator(apiUser)
if err != nil {
return nil, errors.Trace(err)
}
resource, ok := resources.Get("createLocalLoginMacaroon").(common.ValueResource)
if !ok {
return nil, errors.NotFoundf("userAuth resource")
}
createLocalLoginMacaroon, ok := resource.Value.(func(names.UserTag) (*macaroon.Macaroon, error))
if !ok {
return nil, errors.NotValidf("userAuth resource")
}
return &UserManagerAPI{
state: st,
authorizer: authorizer,
createLocalLoginMacaroon: createLocalLoginMacaroon,
check: common.NewBlockChecker(st),
apiUser: apiUser,
isAdmin: isAdmin,
}, nil
}