gonfluent/rbac.go at main · OneMount/gonfluent · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
package confluent

import (
	"bytes"
	"encoding/json"
)

const (
	principalPath = "/security/1.0/principals/"
)

type ClusterDetails struct {
	ClusterName string             `json:"clusterName,omitempty"`
	Clusters    Clusters `json:"clusters"`
}

type ResourcePattern struct {
	ResourceType string `json:"resourceType,omitempty"`
	Name         string `json:"name,omitempty"`
	PatternType  string `json:"patternType,omitempty"`
}

type RoleBinding struct {
	Scope            ClusterDetails `json:"scope"`
	ResourcePatterns []ResourcePattern `json:"resourcePatterns"`
}

// BindPrincipalToRole will bind the principal to a cluster-scoped role for a specific cluster or in a given scope
func (c *Client) BindPrincipalToRole(principal, roleName string, cDetails ClusterDetails) error {
	u := principalPath + principal + "/roles/" + roleName

	payloadBuf := new(bytes.Buffer)
	json.NewEncoder(payloadBuf).Encode(cDetails)

	_, err := c.DoRequest("POST", u, payloadBuf)
	if err != nil {
		return err
	}
	return nil
}

// DeleteRoleBinding remove the role (cluster or resource scoped) from the principal at the give scope/cluster
func (c *Client) DeleteRoleBinding(principal, roleName string, cDetails ClusterDetails) error {
	u := principalPath + principal + "/roles/" + roleName

	payloadBuf := new(bytes.Buffer)
	json.NewEncoder(payloadBuf).Encode(cDetails)

	_, err := c.DoRequest("DELETE", u, payloadBuf)
	if err != nil {
		return err
	}
	return nil
}

// LookupRoleBinding will lookup the role-bindings for the principal at the given scope/cluster using the given role
func (c *Client) LookupRoleBinding(principal, roleName string, cDetails ClusterDetails) ([]ResourcePattern, error) {
	u := principalPath + principal + "/roles/" + roleName + "/resources"

	payloadBuf := new(bytes.Buffer)
	json.NewEncoder(payloadBuf).Encode(cDetails)

	r, err := c.DoRequest("POST", u, payloadBuf)
	if err != nil {
		return nil, err
	}

	var patterns []ResourcePattern

	err = json.Unmarshal(r, &patterns)
	if err != nil {
		return nil, err
	}
	return patterns, nil
}

// IncreaseRoleBinding : incrementally grant the resources to the principal at the given scope/cluster using the given role
func (c *Client) IncreaseRoleBinding(principal, roleName string, uRoleBinding RoleBinding) error {
	u := principalPath + principal + "/roles/" + roleName + "/bindings"

	payloadBuf := new(bytes.Buffer)
	json.NewEncoder(payloadBuf).Encode(uRoleBinding)

	_, err := c.DoRequest("POST", u, payloadBuf)
	if err != nil {
		return err
	}
	return nil
}

// DecreaseRoleBinding : Incrementally remove the resources from the principal at the given scope/cluster using the given role
func (c *Client) DecreaseRoleBinding(principal, roleName string, uRoleBinding RoleBinding) error {
	u := principalPath + principal + "/roles/" + roleName + "/bindings"

	payloadBuf := new(bytes.Buffer)
	json.NewEncoder(payloadBuf).Encode(uRoleBinding)

	_, err := c.DoRequest("DELETE", u, payloadBuf)
	if err != nil {
		return err
	}
	return nil
}

// OverwriteRoleBinding will overwrite existing resource grants
func (c *Client) OverwriteRoleBinding(principal, roleName string, uRoleBinding RoleBinding) error {
	u := principalPath + principal + "/roles/" + roleName + "/bindings"

	payloadBuf := new(bytes.Buffer)
	json.NewEncoder(payloadBuf).Encode(uRoleBinding)

	_, err := c.DoRequest("PUT", u, payloadBuf)
	if err != nil {
		return err
	}
	return nil
}