mirror of
https://github.com/0rangebananaspy/authelia.git
synced 2024-09-14 22:47:21 +07:00
4dce8f9496
* adjust session refresh to always occur (for disabled users) * feat: adds filtering option for Request Method in ACL's * simplify flow of internal/authorization/authorizer.go's methods * implement query string checking * utilize authorizer.Object fully * make matchers uniform * add tests * add missing request methods * add frontend enhancements to handle request method * add request method to 1FA Handler Suite * add internal ACL representations (preparsing) * expand on access_control next * add docs * remove unnecessary slice for network names and instead just use a plain string * add warning for ineffectual bypass policy (due to subjects) * add user/group wildcard support * fix(authorization): allow subject rules to match anonymous users * feat(api): add new params * docs(api): wording adjustments * test: add request method into testing and proxy docs * test: add several checks and refactor schema validation for ACL * test: add integration test for methods acl * refactor: apply suggestions from code review * docs(authorization): update description
52 lines
1.4 KiB
Go
52 lines
1.4 KiB
Go
package authorization
|
|
|
|
import (
|
|
"github.com/authelia/authelia/internal/configuration/schema"
|
|
"github.com/authelia/authelia/internal/logging"
|
|
)
|
|
|
|
// Authorizer the component in charge of checking whether a user can access a given resource.
|
|
type Authorizer struct {
|
|
defaultPolicy Level
|
|
rules []*AccessControlRule
|
|
}
|
|
|
|
// NewAuthorizer create an instance of authorizer with a given access control configuration.
|
|
func NewAuthorizer(configuration schema.AccessControlConfiguration) *Authorizer {
|
|
return &Authorizer{
|
|
defaultPolicy: PolicyToLevel(configuration.DefaultPolicy),
|
|
rules: NewAccessControlRules(configuration),
|
|
}
|
|
}
|
|
|
|
// IsSecondFactorEnabled return true if at least one policy is set to second factor.
|
|
func (p *Authorizer) IsSecondFactorEnabled() bool {
|
|
if p.defaultPolicy == TwoFactor {
|
|
return true
|
|
}
|
|
|
|
for _, rule := range p.rules {
|
|
if rule.Policy == TwoFactor {
|
|
return true
|
|
}
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
// GetRequiredLevel retrieve the required level of authorization to access the object.
|
|
func (p *Authorizer) GetRequiredLevel(subject Subject, object Object) Level {
|
|
logger := logging.Logger()
|
|
logger.Tracef("Check authorization of subject %s and url %s.", subject.String(), object.String())
|
|
|
|
for _, rule := range p.rules {
|
|
if rule.IsMatch(subject, object) {
|
|
return rule.Policy
|
|
}
|
|
}
|
|
|
|
logger.Tracef("No matching rule for subject %s and url %s... Applying default policy.", subject.String(), object.String())
|
|
|
|
return p.defaultPolicy
|
|
}
|