f5b05cf981
in C++20, compiler generate operator!=() if the corresponding operator==() is already defined, the language now understands that the comparison is symmetric in the new standard. fortunately, our operator!=() is always equivalent to `! operator==()`, this matches the behavior of the default generated operator!=(). so, in this change, all `operator!=` are removed. in addition to the defaulted operator!=, C++20 also brings to us the defaulted operator==() -- it is able to generated the operator==() if the member-wise lexicographical comparison. under some circumstances, this is exactly what we need. so, in this change, if the operator==() is also implemented as a lexicographical comparison of all memeber variables of the class/struct in question, it is implemented using the default generated one by removing its body and mark the function as `default`. moreover, if the class happen to have other comparison operators which are implemented using lexicographical comparison, the default generated `operator<=>` is used in place of the defaulted `operator==`. sometimes, we fail to mark the operator== with the `const` specifier, in this change, to fulfil the need of C++ standard, and to be more correct, the `const` specifier is added. also, to generate the defaulted operator==, the operand should be `const class_name&`, but it is not always the case, in the class of `version`, we use `version` as the parameter type, to fulfill the need of the C++ standard, the parameter type is changed to `const version&` instead. this does not change the semantic of the comparison operator. and is a more idiomatic way to pass non-trivial struct as function parameters. please note, because in C++20, both operator= and operator<=> are symmetric, some of the operators in `multiprecision` are removed. they are the symmetric form of the another variant. if they were not removed, compiler would, for instance, find ambiguous overloaded operator '=='. this change is a cleanup to modernize the code base with C++20 features. Signed-off-by: Kefu Chai <kefu.chai@scylladb.com> Closes #13687
123 lines
3.7 KiB
C++
123 lines
3.7 KiB
C++
/*
|
|
* Copyright (C) 2016-present ScyllaDB
|
|
*
|
|
* Modified by ScyllaDB
|
|
*/
|
|
|
|
/*
|
|
* SPDX-License-Identifier: (AGPL-3.0-or-later and Apache-2.0)
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include <string_view>
|
|
#include <functional>
|
|
#include <optional>
|
|
#include <stdexcept>
|
|
#include <tuple>
|
|
#include <vector>
|
|
|
|
#include <seastar/core/future.hh>
|
|
#include <seastar/core/shared_ptr.hh>
|
|
|
|
#include "auth/permission.hh"
|
|
#include "auth/resource.hh"
|
|
#include "seastarx.hh"
|
|
|
|
namespace auth {
|
|
|
|
class role_or_anonymous;
|
|
|
|
struct permission_details {
|
|
sstring role_name;
|
|
::auth::resource resource;
|
|
permission_set permissions;
|
|
};
|
|
|
|
inline bool operator==(const permission_details& pd1, const permission_details& pd2) {
|
|
return std::forward_as_tuple(pd1.role_name, pd1.resource, pd1.permissions.mask())
|
|
== std::forward_as_tuple(pd2.role_name, pd2.resource, pd2.permissions.mask());
|
|
}
|
|
|
|
inline bool operator<(const permission_details& pd1, const permission_details& pd2) {
|
|
return std::forward_as_tuple(pd1.role_name, pd1.resource, pd1.permissions)
|
|
< std::forward_as_tuple(pd2.role_name, pd2.resource, pd2.permissions);
|
|
}
|
|
|
|
class unsupported_authorization_operation : public std::invalid_argument {
|
|
public:
|
|
using std::invalid_argument::invalid_argument;
|
|
};
|
|
|
|
///
|
|
/// Abstract client for authorizing roles to access resources.
|
|
///
|
|
/// All state necessary to authorize a role is stored externally to the client instance.
|
|
///
|
|
class authorizer {
|
|
public:
|
|
using ptr_type = std::unique_ptr<authorizer>;
|
|
|
|
virtual ~authorizer() = default;
|
|
|
|
virtual future<> start() = 0;
|
|
|
|
virtual future<> stop() = 0;
|
|
|
|
///
|
|
/// A fully-qualified (class with package) Java-like name for this implementation.
|
|
///
|
|
virtual std::string_view qualified_java_name() const = 0;
|
|
|
|
///
|
|
/// Query for the permissions granted directly to a role for a particular \ref resource (and not any of its
|
|
/// parents).
|
|
///
|
|
/// The optional role name is empty when an anonymous user is authorized. Some implementations may still wish to
|
|
/// grant default permissions in this case.
|
|
///
|
|
virtual future<permission_set> authorize(const role_or_anonymous&, const resource&) const = 0;
|
|
|
|
///
|
|
/// Grant a set of permissions to a role for a particular \ref resource.
|
|
///
|
|
/// \throws \ref unsupported_authorization_operation if granting permissions is not supported.
|
|
///
|
|
virtual future<> grant(std::string_view role_name, permission_set, const resource&) const = 0;
|
|
|
|
///
|
|
/// Revoke a set of permissions from a role for a particular \ref resource.
|
|
///
|
|
/// \throws \ref unsupported_authorization_operation if revoking permissions is not supported.
|
|
///
|
|
virtual future<> revoke(std::string_view role_name, permission_set, const resource&) const = 0;
|
|
|
|
///
|
|
/// Query for all directly granted permissions.
|
|
///
|
|
/// \throws \ref unsupported_authorization_operation if listing permissions is not supported.
|
|
///
|
|
virtual future<std::vector<permission_details>> list_all() const = 0;
|
|
|
|
///
|
|
/// Revoke all permissions granted directly to a particular role.
|
|
///
|
|
/// \throws \ref unsupported_authorization_operation if revoking permissions is not supported.
|
|
///
|
|
virtual future<> revoke_all(std::string_view role_name) const = 0;
|
|
|
|
///
|
|
/// Revoke all permissions granted to any role for a particular resource.
|
|
///
|
|
/// \throws \ref unsupported_authorization_operation if revoking permissions is not supported.
|
|
///
|
|
virtual future<> revoke_all(const resource&) const = 0;
|
|
|
|
///
|
|
/// System resources used internally as part of the implementation. These are made inaccessible to users.
|
|
///
|
|
virtual const resource_set& protected_resources() const = 0;
|
|
};
|
|
|
|
}
|