Drizzled Public API Documentation

authorization.cc
1 /* -*- mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; -*-
2  * vim:expandtab:shiftwidth=2:tabstop=2:smarttab:
3  *
4  * Copyright (C) 2010 Monty Taylor
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 2 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, write to the Free Software
18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
19  */
20 
21 #include <config.h>
22 
23 #include <vector>
24 
25 #include <drizzled/plugin/authorization.h>
26 #include <drizzled/identifier.h>
27 #include <drizzled/error.h>
28 #include <drizzled/session.h>
29 #include <drizzled/gettext.h>
30 
31 namespace drizzled
32 {
33 
34 std::vector<plugin::Authorization *> authorization_plugins;
35 
36 
38 {
39  if (auth != NULL)
40  authorization_plugins.push_back(auth);
41 
42  return false;
43 }
44 
45 void plugin::Authorization::removePlugin(plugin::Authorization *auth)
46 {
47  if (auth != NULL)
48  {
49  authorization_plugins.erase(std::find(authorization_plugins.begin(),
50  authorization_plugins.end(),
51  auth));
52  }
53 }
54 
55 namespace
56 {
57 
58 class RestrictDbFunctor :
59  public std::unary_function<plugin::Authorization *, bool>
60 {
61  const identifier::User &user_ctx;
62  const identifier::Schema& schema;
63 
64 public:
65  RestrictDbFunctor(const identifier::User &user_ctx_arg,
66  const identifier::Schema& schema_arg) :
67  std::unary_function<plugin::Authorization *, bool>(),
68  user_ctx(user_ctx_arg),
69  schema(schema_arg)
70  { }
71 
72  inline result_type operator()(argument_type auth)
73  {
74  return auth->restrictSchema(user_ctx, schema);
75  }
76 };
77 
78 class RestrictTableFunctor :
79  public std::unary_function<plugin::Authorization *, bool>
80 {
81  const identifier::User& user_ctx;
82  const identifier::Table& table;
83 public:
84  RestrictTableFunctor(const identifier::User& user_ctx_arg,
85  const identifier::Table& table_arg) :
86  std::unary_function<plugin::Authorization *, bool>(),
87  user_ctx(user_ctx_arg),
88  table(table_arg)
89  { }
90 
91  inline result_type operator()(argument_type auth)
92  {
93  return auth->restrictTable(user_ctx, table);
94  }
95 };
96 
97 class RestrictProcessFunctor :
98  public std::unary_function<plugin::Authorization *, bool>
99 {
100  const identifier::User &user_ctx;
101  const identifier::User &session_ctx;
102 public:
103  RestrictProcessFunctor(const identifier::User &user_ctx_arg,
104  const identifier::User &session_ctx_arg) :
105  std::unary_function<plugin::Authorization *, bool>(),
106  user_ctx(user_ctx_arg),
107  session_ctx(session_ctx_arg)
108  { }
109 
110  inline result_type operator()(argument_type auth)
111  {
112  return auth->restrictProcess(user_ctx, session_ctx);
113  }
114 };
115 
116 class PruneSchemaFunctor :
117  public std::unary_function<identifier::Schema&, bool>
118 {
119  const drizzled::identifier::User& user_ctx;
120 public:
121  PruneSchemaFunctor(const drizzled::identifier::User& user_ctx_arg) :
122  std::unary_function<identifier::Schema&, bool>(),
123  user_ctx(user_ctx_arg)
124  { }
125 
126  inline result_type operator()(argument_type auth)
127  {
128  return not plugin::Authorization::isAuthorized(user_ctx, auth, false);
129  }
130 };
131 
132 } /* namespace */
133 
135  const identifier::Schema& schema_identifier,
136  bool send_error)
137 {
138  /* If we never loaded any authorization plugins, just return true */
139  if (authorization_plugins.empty())
140  return true;
141 
142  /* Use find_if instead of foreach so that we can collect return codes */
143  std::vector<plugin::Authorization *>::const_iterator iter=
144  std::find_if(authorization_plugins.begin(),
145  authorization_plugins.end(),
146  RestrictDbFunctor(user_ctx, schema_identifier));
147 
148 
149  /*
150  * If iter is == end() here, that means that all of the plugins returned
151  * false, which means that that each of them believe the user is authorized
152  * to view the resource in question.
153  */
154  if (iter != authorization_plugins.end())
155  {
156  if (send_error)
157  {
158  error::access(user_ctx, schema_identifier);
159  }
160  return false;
161  }
162  return true;
163 }
164 
166  const identifier::Table& table_identifier,
167  bool send_error)
168 {
169  /* If we never loaded any authorization plugins, just return true */
170  if (authorization_plugins.empty())
171  return true;
172 
173  /* Use find_if instead of foreach so that we can collect return codes */
174  std::vector<plugin::Authorization *>::const_iterator iter=
175  std::find_if(authorization_plugins.begin(),
176  authorization_plugins.end(),
177  RestrictTableFunctor(user_ctx, table_identifier));
178 
179  /*
180  * If iter is == end() here, that means that all of the plugins returned
181  * false, which means that that each of them believe the user is authorized
182  * to view the resource in question.
183  */
184  if (iter != authorization_plugins.end())
185  {
186  if (send_error)
187  {
188  error::access(user_ctx, table_identifier);
189  }
190  return false;
191  }
192  return true;
193 }
194 
196  const Session& session,
197  bool send_error)
198 {
199  /* If we never loaded any authorization plugins, just return true */
200  if (authorization_plugins.empty())
201  return true;
202 
203  // To make sure we hold the user structure we need to have a shred_ptr so
204  // that we increase the count on the object.
205  drizzled::identifier::user::ptr session_ctx= session.user();
206 
207 
208  /* Use find_if instead of foreach so that we can collect return codes */
209  std::vector<plugin::Authorization *>::const_iterator iter=
210  std::find_if(authorization_plugins.begin(),
211  authorization_plugins.end(),
212  RestrictProcessFunctor(user_ctx, *session_ctx));
213 
214  /*
215  * If iter is == end() here, that means that all of the plugins returned
216  * false, which means that that each of them believe the user is authorized
217  * to view the resource in question.
218  */
219 
220  if (iter != authorization_plugins.end())
221  {
222  if (send_error)
223  {
224  my_error(ER_KILL_DENIED_ERROR, MYF(0), session.thread_id);
225  }
226  return false;
227  }
228 
229  return true;
230 }
231 
233  identifier::schema::vector &set_of_schemas)
234 {
235  /* If we never loaded any authorization plugins, just return true */
236  if (authorization_plugins.empty())
237  return;
238 
239  set_of_schemas.erase(std::remove_if(set_of_schemas.begin(),
240  set_of_schemas.end(),
241  PruneSchemaFunctor(user_ctx)),
242  set_of_schemas.end());
243 }
244 
245 } /* namespace drizzled */
A set of Session members describing the current authenticated user.
Definition: user.h:34
static bool isAuthorized(const drizzled::identifier::User &user_ctx, const identifier::Schema &schema_identifier, bool send_error=true)
static bool addPlugin(plugin::Authorization *auth)
Definition: schema.h:30
static void pruneSchemaNames(const drizzled::identifier::User &user_ctx, identifier::schema::vector &set_of_schemas)