forked from grpc/grpc
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
RBAC engine matchers implementation. (grpc#25997)
- Loading branch information
1 parent
d4f6cfd
commit 628bf7f
Showing
11 changed files
with
993 additions
and
63 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -13,8 +13,8 @@ | |
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| #ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H | ||
| #define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H | ||
| #ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_CEL_AUTHORIZATION_ENGINE_H | ||
| #define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_CEL_AUTHORIZATION_ENGINE_H | ||
|
|
||
| #include <grpc/support/port_platform.h> | ||
|
|
||
|
|
@@ -34,7 +34,7 @@ | |
|
|
||
| namespace grpc_core { | ||
|
|
||
| // AuthorizationEngine makes an AuthorizationDecision to ALLOW or DENY the | ||
| // CelAuthorizationEngine makes an AuthorizationDecision to ALLOW or DENY the | ||
| // current action based on the condition fields in provided RBAC policies. | ||
| // The engine may be constructed with one or two policies. If two polcies, | ||
| // the first policy is deny-if-matched and the second is allow-if-matched. | ||
|
|
@@ -44,19 +44,19 @@ namespace grpc_core { | |
| // are compatible with this engine. | ||
| // | ||
| // Example: | ||
| // AuthorizationEngine* | ||
| // auth_engine = AuthorizationEngine::CreateAuthorizationEngine(rbac_policies); | ||
| // auth_engine->Evaluate(evaluate_args); // returns authorization decision. | ||
| class AuthorizationEngine { | ||
| // CelAuthorizationEngine* engine = | ||
| // CelAuthorizationEngine::CreateCelAuthorizationEngine(rbac_policies); | ||
| // engine->Evaluate(evaluate_args); // returns authorization decision. | ||
| class CelAuthorizationEngine { | ||
| public: | ||
| // rbac_policies must be a vector containing either a single policy of any | ||
| // kind, or one deny policy and one allow policy, in that order. | ||
| static std::unique_ptr<AuthorizationEngine> CreateAuthorizationEngine( | ||
| static std::unique_ptr<CelAuthorizationEngine> CreateCelAuthorizationEngine( | ||
| const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies); | ||
|
|
||
| // Users should use the CreateAuthorizationEngine factory function | ||
| // instead of calling the AuthorizationEngine constructor directly. | ||
| explicit AuthorizationEngine( | ||
| // Users should use the CreateCelAuthorizationEngine factory function | ||
| // instead of calling the CelAuthorizationEngine constructor directly. | ||
| explicit CelAuthorizationEngine( | ||
| const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies); | ||
| // TODO([email protected]): add an Evaluate member function. | ||
|
|
||
|
|
@@ -81,4 +81,4 @@ class AuthorizationEngine { | |
|
|
||
| } // namespace grpc_core | ||
|
|
||
| #endif /* GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H */ | ||
| #endif /* GRPC_CORE_LIB_SECURITY_AUTHORIZATION_CEL_AUTHORIZATION_ENGINE_H */ | ||
Oops, something went wrong.