2020-04-23 18:16:33 +00:00
|
|
|
use serde::{Deserialize, Serialize};
|
|
|
|
|
2021-03-10 15:21:56 +00:00
|
|
|
use garage_table::crdt::*;
|
2020-11-20 22:01:12 +00:00
|
|
|
use garage_table::*;
|
2021-12-14 12:55:11 +00:00
|
|
|
use garage_util::data::*;
|
|
|
|
|
|
|
|
use crate::permission::BucketKeyPerm;
|
2020-11-20 20:15:24 +00:00
|
|
|
|
2021-12-22 17:50:08 +00:00
|
|
|
use garage_model_050::key_table as old;
|
|
|
|
|
2021-03-26 20:53:28 +00:00
|
|
|
/// An api key
|
2020-04-23 18:16:33 +00:00
|
|
|
#[derive(PartialEq, Clone, Debug, Serialize, Deserialize)]
|
|
|
|
pub struct Key {
|
2021-04-06 03:25:28 +00:00
|
|
|
/// The id of the key (immutable), used as partition key
|
2020-04-23 20:25:45 +00:00
|
|
|
pub key_id: String,
|
2020-04-23 18:16:33 +00:00
|
|
|
|
2022-01-04 17:59:17 +00:00
|
|
|
/// Internal state of the key
|
|
|
|
pub state: crdt::Deletable<KeyParams>,
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Configuration for a key
|
|
|
|
#[derive(PartialEq, Clone, Debug, Serialize, Deserialize)]
|
|
|
|
pub struct KeyParams {
|
|
|
|
/// The secret_key associated (immutable)
|
2020-04-23 20:25:45 +00:00
|
|
|
pub secret_key: String,
|
|
|
|
|
2021-03-26 20:53:28 +00:00
|
|
|
/// Name for the key
|
2021-05-02 21:13:08 +00:00
|
|
|
pub name: crdt::Lww<String>,
|
2020-04-23 18:16:33 +00:00
|
|
|
|
2022-01-04 17:59:17 +00:00
|
|
|
/// Flag to allow users having this key to create buckets
|
|
|
|
pub allow_create_bucket: crdt::Lww<bool>,
|
|
|
|
|
2021-12-14 12:55:11 +00:00
|
|
|
/// If the key is present: it gives some permissions,
|
|
|
|
/// a map of bucket IDs (uuids) to permissions.
|
|
|
|
/// Otherwise no permissions are granted to key
|
|
|
|
pub authorized_buckets: crdt::Map<Uuid, BucketKeyPerm>,
|
2022-01-04 17:59:17 +00:00
|
|
|
|
|
|
|
/// A key can have a local view of buckets names it is
|
|
|
|
/// the only one to see, this is the namespace for these aliases
|
2022-01-03 17:32:15 +00:00
|
|
|
pub local_aliases: crdt::LwwMap<String, Option<Uuid>>,
|
2021-12-14 12:55:11 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
impl KeyParams {
|
2022-01-04 17:59:17 +00:00
|
|
|
fn new(secret_key: &str, name: &str) -> Self {
|
2021-12-14 12:55:11 +00:00
|
|
|
KeyParams {
|
2022-01-04 17:59:17 +00:00
|
|
|
secret_key: secret_key.to_string(),
|
|
|
|
name: crdt::Lww::new(name.to_string()),
|
2021-12-16 10:47:58 +00:00
|
|
|
allow_create_bucket: crdt::Lww::new(false),
|
2021-12-14 12:55:11 +00:00
|
|
|
authorized_buckets: crdt::Map::new(),
|
|
|
|
local_aliases: crdt::LwwMap::new(),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
impl Crdt for KeyParams {
|
|
|
|
fn merge(&mut self, o: &Self) {
|
2022-01-04 17:59:17 +00:00
|
|
|
self.name.merge(&o.name);
|
2021-12-16 10:47:58 +00:00
|
|
|
self.allow_create_bucket.merge(&o.allow_create_bucket);
|
2021-12-14 12:55:11 +00:00
|
|
|
self.authorized_buckets.merge(&o.authorized_buckets);
|
|
|
|
self.local_aliases.merge(&o.local_aliases);
|
|
|
|
}
|
2020-04-23 18:16:33 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
impl Key {
|
2021-04-08 13:13:02 +00:00
|
|
|
/// Initialize a new Key, generating a random identifier and associated secret key
|
2022-01-04 17:59:17 +00:00
|
|
|
pub fn new(name: &str) -> Self {
|
2020-04-23 20:25:45 +00:00
|
|
|
let key_id = format!("GK{}", hex::encode(&rand::random::<[u8; 12]>()[..]));
|
|
|
|
let secret_key = hex::encode(&rand::random::<[u8; 32]>()[..]);
|
2020-11-20 22:20:20 +00:00
|
|
|
Self {
|
2020-04-23 20:25:45 +00:00
|
|
|
key_id,
|
2022-01-04 17:59:17 +00:00
|
|
|
state: crdt::Deletable::present(KeyParams::new(&secret_key, name)),
|
2020-11-20 22:20:20 +00:00
|
|
|
}
|
2020-04-23 18:16:33 +00:00
|
|
|
}
|
2021-03-26 20:53:28 +00:00
|
|
|
|
|
|
|
/// Import a key from it's parts
|
2021-03-18 18:24:59 +00:00
|
|
|
pub fn import(key_id: &str, secret_key: &str, name: &str) -> Self {
|
|
|
|
Self {
|
|
|
|
key_id: key_id.to_string(),
|
2022-01-04 17:59:17 +00:00
|
|
|
state: crdt::Deletable::present(KeyParams::new(secret_key, name)),
|
2021-03-18 18:24:59 +00:00
|
|
|
}
|
|
|
|
}
|
2021-03-26 20:53:28 +00:00
|
|
|
|
|
|
|
/// Create a new Key which can me merged to mark an existing key deleted
|
2020-04-23 20:25:45 +00:00
|
|
|
pub fn delete(key_id: String) -> Self {
|
2020-04-23 18:16:33 +00:00
|
|
|
Self {
|
2020-04-23 20:25:45 +00:00
|
|
|
key_id,
|
2021-12-14 12:55:11 +00:00
|
|
|
state: crdt::Deletable::Deleted,
|
2020-04-23 18:16:33 +00:00
|
|
|
}
|
|
|
|
}
|
2021-03-26 20:53:28 +00:00
|
|
|
|
2022-01-04 17:59:17 +00:00
|
|
|
/// Returns true if this represents a deleted bucket
|
|
|
|
pub fn is_deleted(&self) -> bool {
|
|
|
|
self.state.is_deleted()
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Returns an option representing the params (None if in deleted state)
|
|
|
|
pub fn params(&self) -> Option<&KeyParams> {
|
|
|
|
self.state.as_option()
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Mutable version of `.state()`
|
|
|
|
pub fn params_mut(&mut self) -> Option<&mut KeyParams> {
|
|
|
|
self.state.as_option_mut()
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Get permissions for a bucket
|
|
|
|
pub fn bucket_permissions(&self, bucket: &Uuid) -> BucketKeyPerm {
|
|
|
|
self.params()
|
2022-03-14 11:00:23 +00:00
|
|
|
.and_then(|params| params.authorized_buckets.get(bucket))
|
2022-01-04 17:59:17 +00:00
|
|
|
.cloned()
|
|
|
|
.unwrap_or(BucketKeyPerm::NO_PERMISSIONS)
|
|
|
|
}
|
|
|
|
|
2021-03-26 20:53:28 +00:00
|
|
|
/// Check if `Key` is allowed to read in bucket
|
2021-12-14 12:55:11 +00:00
|
|
|
pub fn allow_read(&self, bucket: &Uuid) -> bool {
|
2022-01-04 17:59:17 +00:00
|
|
|
self.bucket_permissions(bucket).allow_read
|
2020-04-23 20:25:45 +00:00
|
|
|
}
|
2021-03-26 20:53:28 +00:00
|
|
|
|
|
|
|
/// Check if `Key` is allowed to write in bucket
|
2021-12-14 12:55:11 +00:00
|
|
|
pub fn allow_write(&self, bucket: &Uuid) -> bool {
|
2022-01-04 17:59:17 +00:00
|
|
|
self.bucket_permissions(bucket).allow_write
|
2020-04-23 20:25:45 +00:00
|
|
|
}
|
2021-12-16 10:47:58 +00:00
|
|
|
|
|
|
|
/// Check if `Key` is owner of bucket
|
|
|
|
pub fn allow_owner(&self, bucket: &Uuid) -> bool {
|
2022-01-04 17:59:17 +00:00
|
|
|
self.bucket_permissions(bucket).allow_owner
|
2021-12-16 10:47:58 +00:00
|
|
|
}
|
2020-04-23 18:16:33 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
impl Entry<EmptyKey, String> for Key {
|
|
|
|
fn partition_key(&self) -> &EmptyKey {
|
|
|
|
&EmptyKey
|
|
|
|
}
|
|
|
|
fn sort_key(&self) -> &String {
|
2020-04-23 20:25:45 +00:00
|
|
|
&self.key_id
|
2020-04-23 18:16:33 +00:00
|
|
|
}
|
2021-03-10 15:21:56 +00:00
|
|
|
}
|
2020-04-23 18:16:33 +00:00
|
|
|
|
2021-05-02 21:13:08 +00:00
|
|
|
impl Crdt for Key {
|
2020-04-23 18:16:33 +00:00
|
|
|
fn merge(&mut self, other: &Self) {
|
2021-12-14 12:55:11 +00:00
|
|
|
self.state.merge(&other.state);
|
2020-04-23 18:16:33 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
pub struct KeyTable;
|
|
|
|
|
2021-03-15 18:14:26 +00:00
|
|
|
#[derive(Clone, Debug, Serialize, Deserialize)]
|
|
|
|
pub enum KeyFilter {
|
|
|
|
Deleted(DeletedFilter),
|
2022-01-03 17:03:12 +00:00
|
|
|
MatchesAndNotDeleted(String),
|
2021-03-15 18:14:26 +00:00
|
|
|
}
|
|
|
|
|
2020-04-23 18:16:33 +00:00
|
|
|
impl TableSchema for KeyTable {
|
2021-12-14 11:34:01 +00:00
|
|
|
const TABLE_NAME: &'static str = "key";
|
|
|
|
|
2020-04-23 18:16:33 +00:00
|
|
|
type P = EmptyKey;
|
|
|
|
type S = String;
|
|
|
|
type E = Key;
|
2021-03-15 18:14:26 +00:00
|
|
|
type Filter = KeyFilter;
|
2020-04-23 18:16:33 +00:00
|
|
|
|
2020-11-20 19:11:04 +00:00
|
|
|
fn matches_filter(entry: &Self::E, filter: &Self::Filter) -> bool {
|
2021-03-15 18:14:26 +00:00
|
|
|
match filter {
|
2021-12-14 12:55:11 +00:00
|
|
|
KeyFilter::Deleted(df) => df.apply(entry.state.is_deleted()),
|
2022-01-03 17:03:12 +00:00
|
|
|
KeyFilter::MatchesAndNotDeleted(pat) => {
|
2021-03-15 18:16:42 +00:00
|
|
|
let pat = pat.to_lowercase();
|
2022-01-04 17:59:17 +00:00
|
|
|
entry
|
|
|
|
.params()
|
|
|
|
.map(|p| {
|
|
|
|
entry.key_id.to_lowercase().starts_with(&pat)
|
|
|
|
|| p.name.get().to_lowercase() == pat
|
|
|
|
})
|
|
|
|
.unwrap_or(false)
|
2021-03-15 18:14:26 +00:00
|
|
|
}
|
|
|
|
}
|
2020-11-20 20:15:24 +00:00
|
|
|
}
|
2021-12-16 12:17:09 +00:00
|
|
|
|
|
|
|
fn try_migrate(bytes: &[u8]) -> Option<Self::E> {
|
2021-12-22 17:50:08 +00:00
|
|
|
let old_k = rmp_serde::decode::from_read_ref::<_, old::Key>(bytes).ok()?;
|
2022-01-04 17:59:17 +00:00
|
|
|
let name = crdt::Lww::raw(old_k.name.timestamp(), old_k.name.get().clone());
|
2021-12-22 17:50:08 +00:00
|
|
|
|
2021-12-16 12:17:09 +00:00
|
|
|
let state = if old_k.deleted.get() {
|
|
|
|
crdt::Deletable::Deleted
|
|
|
|
} else {
|
|
|
|
// Authorized buckets is ignored here,
|
|
|
|
// migration is performed in specific migration code in
|
|
|
|
// garage/migrate.rs
|
|
|
|
crdt::Deletable::Present(KeyParams {
|
2022-01-04 17:59:17 +00:00
|
|
|
secret_key: old_k.secret_key,
|
|
|
|
name,
|
2021-12-16 12:17:09 +00:00
|
|
|
allow_create_bucket: crdt::Lww::new(false),
|
|
|
|
authorized_buckets: crdt::Map::new(),
|
|
|
|
local_aliases: crdt::LwwMap::new(),
|
|
|
|
})
|
|
|
|
};
|
|
|
|
Some(Key {
|
|
|
|
key_id: old_k.key_id,
|
|
|
|
state,
|
|
|
|
})
|
|
|
|
}
|
2020-04-23 18:16:33 +00:00
|
|
|
}
|