refactor: refactoring AuthorizationBackend (#287)

Author: medcl

core/security/role_registry.go

@@ -181,6 +181,7 @@ func GetAllPermissionsForUser(user *UserSessionInfo) []PermissionKey {
 }
 
 func getPermissionKeysByUser(user *UserSessionInfo) ([]PermissionKey, error) {
+
 	ctx1 := context.Background()
 	if val, ok := user.GetStringArray(orm.TeamsIDKey); ok {
 		ctx1 = context.WithValue(ctx1, orm.TeamsIDKey, val)
@@ -191,7 +192,7 @@ func getPermissionKeysByUser(user *UserSessionInfo) ([]PermissionKey, error) {
 		p, ok := value.(AuthorizationBackend)
 		if ok {
 			hit = true
-			v := p.GetPermissionKeysByUserID(ctx1, user.UserID)
+			v := p.GetPermissionKeysByUserID(ctx1, user.Provider, user.UserID)
 			out = append(out, v...)
 		}
 		return true

core/security/service_registry.go

@@ -17,7 +17,7 @@ type AuthenticationBackend interface {
 }
 
 type AuthorizationBackend interface {
-	GetPermissionKeysByUserID(ctx context.Context, userID string) []PermissionKey
+	GetPermissionKeysByUserID(ctx context.Context, providerID, userID string) []PermissionKey
 	GetPermissionKeysByRoles(ctx context.Context, roles []string) []PermissionKey
 }
 

modules/security/account/profile.go

@@ -12,7 +12,7 @@ import (
 )
 
 func init() {
-	api.HandleUIMethod(api.GET, "/account/profile", Profile, api.OptionLogin(), api.AllowOPTIONSS(), api.Feature(api.FeatureCORS))
+	api.HandleUIMethod(api.GET, "/account/profile", Profile, api.RequireLogin(), api.AllowOPTIONSS(), api.Feature(api.FeatureCORS))
 }
 
 func Profile(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {

modules/security/oauth_client/provider/github/profile.go

@@ -53,6 +53,7 @@ func safeDereference(strPtr *string) string {
 }
 
 func (handler *ProfileAPI) GetProfile(ctx *orm.Context, appConfig *config.OAuthConfig, cfg *oauth2.Config, tkn *oauth2.Token) *security.UserExternalProfile {
+
 	//get user info
 	client := github.NewClient(cfg.Client(oauth2.NoContext, tkn))
 	user, res, err := client.Users.Get(oauth2.NoContext, "")
@@ -62,6 +63,7 @@ func (handler *ProfileAPI) GetProfile(ctx *orm.Context, appConfig *config.OAuthC
 	profile := security.UserExternalProfile{}
 	login := safeDereference(user.Login)
 	profile.ID = provider.GetExternalUserProfileID("github", login)
+	profile.SetOwnerID(login)
 	profile.AuthProvider = "github"
 	profile.Login = login
 	profile.Email = safeDereference(user.Email)

modules/security/oauth_client/provider/google/profile.go

@@ -75,6 +75,7 @@ func (handler *ProfileAPI) GetProfile(ctx *orm.Context, appConfig *config.OAuthC
 
 	profile := security.UserExternalProfile{}
 	profile.ID = provider.GetExternalUserProfileID("google", userInfo.Sub)
+	profile.SetOwnerID(userInfo.Sub)
 	profile.AuthProvider = "google"
 	profile.Login = userInfo.Sub
 	profile.Email = userInfo.Email

modules/security/rbac/role.go

@@ -194,7 +194,7 @@ func CreateRole(w http.ResponseWriter, req *http.Request, ps httprouter.Params)
 type SecurityBackendProvider struct {
 }
 
-func (provider *SecurityBackendProvider) GetPermissionKeysByUserID(ctx1 context.Context, userID string) []security.PermissionKey {
+func (provider *SecurityBackendProvider) GetPermissionKeysByUserID(ctx1 context.Context, providerID, userID string) []security.PermissionKey {
 	var allowedPermissions = []security.PermissionKey{}
 
 	//bypass managed mode