scylladb/auth/resource.hh

/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

/*
 * Copyright (C) 2016 ScyllaDB
 *
 * Modified by ScyllaDB
 */

/*
 * This file is part of Scylla.
 *
 * Scylla is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * Scylla is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Scylla.  If not, see <http://www.gnu.org/licenses/>.
 */

#pragma once

#include <experimental/optional>
#include <experimental/string_view>
#include <iostream>
#include <memory>
#include <stdexcept>
#include <tuple>
#include <vector>
#include <unordered_set>

#include <seastar/core/print.hh>
#include <seastar/core/sstring.hh>

#include "seastarx.hh"
#include "stdx.hh"
#include "utils/hash.hh"

namespace auth {

//
// Resources are entities that users can be granted permissions on.
//
// Currently, the only known resources are keyspaces and tables. However, we shortly anticipate other kinds of resources
// like roles.
//
// When they are stored as system metadata, resources have the form `root/part_0/part_1/.../part_n`.
// Each kind of resource has a specific root prefix, followed by a maximum of `n` parts (where `n` is distinct for each
// kind of resource as well). In this code, this form is called the "name".
//
// Since all resources have this same structure, all the different kinds are stored in instances of the same class:
// `resource`. When we wish to query a resource for kind-specific data (like the table of a `data` resource), we create
// a kind-specific "view" of the resource.
//

class invalid_resource_name : public std::invalid_argument {
    std::shared_ptr<sstring> _name;

public:
    explicit invalid_resource_name(stdx::string_view name)
            : std::invalid_argument(sprint("The resource name '%s' is invalid.", name))
            , _name(std::make_shared<sstring>(name)) {
    }

    stdx::string_view name() const noexcept {
        return *_name;
    }
};

enum class resource_kind {
    data
};

std::ostream& operator<<(std::ostream&, resource_kind);

class resource final {
    resource_kind _kind;

    std::vector<sstring> _parts;

public:
    static resource root_of(resource_kind);

    static resource data(stdx::string_view keyspace);
    static resource data(stdx::string_view keyspace, stdx::string_view table);

    // Throws `invalid_resource_name` when the name is malformed.
    static resource from_name(stdx::string_view);

    resource_kind kind() const noexcept {
        return _kind;
    }

    // A machine-friendly identifier unique to each resource.
    sstring name() const;

    stdx::optional<resource> parent() const;

private:
    // A root resource.
    explicit resource(resource_kind kind);

    resource(resource_kind, std::vector<sstring> parts);

    friend class std::hash<resource>;
    friend class data_resource_view;

    friend bool operator<(const resource&, const resource&);
    friend bool operator==(const resource&, const resource&);
};

bool operator<(const resource&, const resource&);

inline bool operator==(const resource& r1, const resource& r2) {
    return (r1._kind == r2._kind) && (r1._parts == r2._parts);
}

inline bool operator!=(const resource& r1, const resource& r2) {
    return !(r1 == r2);
}

std::ostream& operator<<(std::ostream&, const resource&);

class resource_kind_mismatch : public std::invalid_argument {
public:
    explicit resource_kind_mismatch(resource_kind expected, resource_kind actual)
        : std::invalid_argument(
            sprint("This resource has kind '%s', but was expected to have kind '%s'.", actual, expected)) {
    }
};

// A `data` view of `resource`.
//
// If neither `keyspace` nor `table` is present, this is the root resource.
class data_resource_view final {
    const resource& _resource;

public:
    // Throws `resource_kind_mismatch` if the argument is not a `data` resource.
    explicit data_resource_view(const resource& r);

    stdx::optional<stdx::string_view> keyspace() const;

    stdx::optional<stdx::string_view> table() const;
};

std::ostream& operator<<(std::ostream&, const data_resource_view&);

bool resource_exists(const data_resource_view&);

}

namespace std {

template <>
struct hash<auth::resource> {
    static size_t hash_data(const auth::data_resource_view& dv) {
        return utils::tuple_hash()(std::make_tuple(auth::resource_kind::data, dv.keyspace(), dv.table()));
    }

    size_t operator()(const auth::resource& r) const {
        std::size_t value;

        switch (r._kind) {
        case auth::resource_kind::data: value = hash_data(auth::data_resource_view(r)); break;
        }

        return value;
    }
};

}

namespace auth {

using resource_set = std::unordered_set<resource>;

}