mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-07-27 10:33:13 +00:00
Jon E NesvoldandGitHub
dc462a80d7
* feat(credential/postgres): mTLS + pgbouncer support, InlinePolicyStore implementation, upsert SaveConfiguration * fix(credential/postgres): add rows.Err() checks, inline policy tests, memory store LoadInlinePolicies * fix(credential/postgres): cast JSONB params to string for pgbouncer simple protocol * fix(credential/postgres): wrap tx.Commit errors with context * fix(credential/postgres): use any type for JSONB params to preserve SQL NULL for nil fields
619 lines
20 KiB
Go
619 lines
20 KiB
Go
package postgres
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"encoding/json"
|
|
"fmt"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/credential"
|
|
"github.com/seaweedfs/seaweedfs/weed/glog"
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
|
|
)
|
|
|
|
func (store *PostgresStore) LoadConfiguration(ctx context.Context) (*iam_pb.S3ApiConfiguration, error) {
|
|
if !store.configured {
|
|
return nil, fmt.Errorf("store not configured")
|
|
}
|
|
|
|
config := &iam_pb.S3ApiConfiguration{}
|
|
|
|
rows, err := store.db.QueryContext(ctx, "SELECT username, email, account_data, actions, policy_names FROM users")
|
|
if err != nil {
|
|
glog.Errorf("credential postgres: LoadConfiguration query failed: %v", err)
|
|
return nil, fmt.Errorf("failed to query users: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
for rows.Next() {
|
|
var username, email string
|
|
var accountDataJSON, actionsJSON, policyNamesJSON []byte
|
|
|
|
if err := rows.Scan(&username, &email, &accountDataJSON, &actionsJSON, &policyNamesJSON); err != nil {
|
|
glog.Errorf("credential postgres: LoadConfiguration scan failed: %v", err)
|
|
return nil, fmt.Errorf("failed to scan user row: %w", err)
|
|
}
|
|
|
|
identity := &iam_pb.Identity{
|
|
Name: username,
|
|
}
|
|
|
|
if len(accountDataJSON) > 0 {
|
|
if err := json.Unmarshal(accountDataJSON, &identity.Account); err != nil {
|
|
return nil, fmt.Errorf("failed to unmarshal account data for user %s: %v", username, err)
|
|
}
|
|
}
|
|
|
|
if len(actionsJSON) > 0 {
|
|
if err := json.Unmarshal(actionsJSON, &identity.Actions); err != nil {
|
|
return nil, fmt.Errorf("failed to unmarshal actions for user %s: %v", username, err)
|
|
}
|
|
}
|
|
|
|
if len(policyNamesJSON) > 0 {
|
|
if err := json.Unmarshal(policyNamesJSON, &identity.PolicyNames); err != nil {
|
|
return nil, fmt.Errorf("failed to unmarshal policy names for user %s: %v", username, err)
|
|
}
|
|
}
|
|
|
|
credRows, err := store.db.QueryContext(ctx, "SELECT access_key, secret_key FROM credentials WHERE username = $1", username)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to query credentials for user %s: %v", username, err)
|
|
}
|
|
|
|
for credRows.Next() {
|
|
var accessKey, secretKey string
|
|
if err := credRows.Scan(&accessKey, &secretKey); err != nil {
|
|
credRows.Close()
|
|
return nil, fmt.Errorf("failed to scan credential row for user %s: %v", username, err)
|
|
}
|
|
|
|
identity.Credentials = append(identity.Credentials, &iam_pb.Credential{
|
|
AccessKey: accessKey,
|
|
SecretKey: secretKey,
|
|
})
|
|
}
|
|
credRows.Close()
|
|
if err := credRows.Err(); err != nil {
|
|
return nil, fmt.Errorf("failed iterating credential rows for user %s: %w", username, err)
|
|
}
|
|
config.Identities = append(config.Identities, identity)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, fmt.Errorf("failed iterating user rows: %w", err)
|
|
}
|
|
|
|
glog.V(0).Infof("credential postgres: LoadConfiguration loaded %d identities", len(config.Identities))
|
|
return config, nil
|
|
}
|
|
|
|
func (store *PostgresStore) SaveConfiguration(ctx context.Context, config *iam_pb.S3ApiConfiguration) error {
|
|
if !store.configured {
|
|
return fmt.Errorf("store not configured")
|
|
}
|
|
|
|
tx, err := store.db.BeginTx(ctx, nil)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to begin transaction: %w", err)
|
|
}
|
|
defer tx.Rollback()
|
|
|
|
// Track which usernames are in the incoming config for pruning
|
|
configUsernames := make(map[string]bool, len(config.Identities))
|
|
|
|
for _, identity := range config.Identities {
|
|
configUsernames[identity.Name] = true
|
|
|
|
var accountDataParam any
|
|
if identity.Account != nil {
|
|
b, err := json.Marshal(identity.Account)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to marshal account data for user %s: %v", identity.Name, err)
|
|
}
|
|
accountDataParam = string(b)
|
|
}
|
|
var actionsParam any
|
|
if identity.Actions != nil {
|
|
b, err := json.Marshal(identity.Actions)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to marshal actions for user %s: %v", identity.Name, err)
|
|
}
|
|
actionsParam = string(b)
|
|
}
|
|
var policyNamesParam any
|
|
if identity.PolicyNames != nil {
|
|
b, err := json.Marshal(identity.PolicyNames)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to marshal policy names for user %s: %v", identity.Name, err)
|
|
}
|
|
policyNamesParam = string(b)
|
|
}
|
|
// Upsert user — preserves the row (and its CASCADE dependents) if it already exists
|
|
_, err = tx.ExecContext(ctx,
|
|
`INSERT INTO users (username, email, account_data, actions, policy_names)
|
|
VALUES ($1, $2, $3, $4, $5)
|
|
ON CONFLICT (username) DO UPDATE SET
|
|
email = EXCLUDED.email,
|
|
account_data = EXCLUDED.account_data,
|
|
actions = EXCLUDED.actions,
|
|
policy_names = EXCLUDED.policy_names,
|
|
updated_at = CURRENT_TIMESTAMP`,
|
|
identity.Name, "", accountDataParam, actionsParam, policyNamesParam)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to upsert user %s: %v", identity.Name, err)
|
|
}
|
|
|
|
// Replace credentials for this user — credentials carry no independent
|
|
// state worth preserving (unlike inline policies)
|
|
if _, err := tx.ExecContext(ctx, "DELETE FROM credentials WHERE username = $1", identity.Name); err != nil {
|
|
return fmt.Errorf("failed to clear credentials for user %s: %v", identity.Name, err)
|
|
}
|
|
for _, cred := range identity.Credentials {
|
|
_, err := tx.ExecContext(ctx,
|
|
"INSERT INTO credentials (username, access_key, secret_key) VALUES ($1, $2, $3)",
|
|
identity.Name, cred.AccessKey, cred.SecretKey)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to insert credential for user %s: %v", identity.Name, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Prune users no longer in config — CASCADE correctly removes their
|
|
// credentials and inline policies since they were intentionally deleted
|
|
rows, err := tx.QueryContext(ctx, "SELECT username FROM users")
|
|
if err != nil {
|
|
return fmt.Errorf("failed to list existing users for pruning: %w", err)
|
|
}
|
|
var toDelete []string
|
|
for rows.Next() {
|
|
var username string
|
|
if err := rows.Scan(&username); err != nil {
|
|
rows.Close()
|
|
return fmt.Errorf("failed to scan username for pruning: %w", err)
|
|
}
|
|
if !configUsernames[username] {
|
|
toDelete = append(toDelete, username)
|
|
}
|
|
}
|
|
rows.Close()
|
|
if err := rows.Err(); err != nil {
|
|
return fmt.Errorf("failed iterating user rows for pruning: %w", err)
|
|
}
|
|
|
|
for _, username := range toDelete {
|
|
if _, err := tx.ExecContext(ctx, "DELETE FROM users WHERE username = $1", username); err != nil {
|
|
return fmt.Errorf("failed to prune user %s: %v", username, err)
|
|
}
|
|
}
|
|
|
|
glog.V(0).Infof("credential postgres: SaveConfiguration saved %d identities, pruned %d", len(config.Identities), len(toDelete))
|
|
return tx.Commit()
|
|
}
|
|
|
|
func (store *PostgresStore) CreateUser(ctx context.Context, identity *iam_pb.Identity) error {
|
|
if !store.configured {
|
|
return fmt.Errorf("store not configured")
|
|
}
|
|
|
|
var count int
|
|
err := store.db.QueryRowContext(ctx, "SELECT COUNT(*) FROM users WHERE username = $1", identity.Name).Scan(&count)
|
|
if err != nil {
|
|
glog.Errorf("credential postgres: CreateUser check failed user=%s: %v", identity.Name, err)
|
|
return fmt.Errorf("failed to check user existence: %w", err)
|
|
}
|
|
if count > 0 {
|
|
glog.V(1).Infof("credential postgres: CreateUser user=%s already exists", identity.Name)
|
|
return credential.ErrUserAlreadyExists
|
|
}
|
|
|
|
tx, err := store.db.BeginTx(ctx, nil)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to begin transaction: %w", err)
|
|
}
|
|
defer tx.Rollback()
|
|
|
|
var accountDataParam any
|
|
if identity.Account != nil {
|
|
b, err := json.Marshal(identity.Account)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to marshal account data: %w", err)
|
|
}
|
|
accountDataParam = string(b)
|
|
}
|
|
var actionsParam any
|
|
if identity.Actions != nil {
|
|
b, err := json.Marshal(identity.Actions)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to marshal actions: %w", err)
|
|
}
|
|
actionsParam = string(b)
|
|
}
|
|
var policyNamesParam any
|
|
if identity.PolicyNames != nil {
|
|
b, err := json.Marshal(identity.PolicyNames)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to marshal policy names: %w", err)
|
|
}
|
|
policyNamesParam = string(b)
|
|
}
|
|
_, err = tx.ExecContext(ctx,
|
|
"INSERT INTO users (username, email, account_data, actions, policy_names) VALUES ($1, $2, $3, $4, $5)",
|
|
identity.Name, "", accountDataParam, actionsParam, policyNamesParam)
|
|
if err != nil {
|
|
glog.Errorf("credential postgres: CreateUser insert failed user=%s: %v", identity.Name, err)
|
|
return fmt.Errorf("failed to insert user: %w", err)
|
|
}
|
|
|
|
for _, cred := range identity.Credentials {
|
|
_, err = tx.ExecContext(ctx,
|
|
"INSERT INTO credentials (username, access_key, secret_key) VALUES ($1, $2, $3)",
|
|
identity.Name, cred.AccessKey, cred.SecretKey)
|
|
if err != nil {
|
|
glog.Errorf("credential postgres: CreateUser insert credential failed user=%s accessKey=%s: %v", identity.Name, cred.AccessKey, err)
|
|
return fmt.Errorf("failed to insert credential: %w", err)
|
|
}
|
|
}
|
|
|
|
if err := tx.Commit(); err != nil {
|
|
glog.Errorf("credential postgres: CreateUser commit failed user=%s: %v", identity.Name, err)
|
|
return fmt.Errorf("failed to commit: %w", err)
|
|
}
|
|
|
|
glog.V(0).Infof("credential postgres: CreateUser user=%s credentials=%d actions=%d", identity.Name, len(identity.Credentials), len(identity.Actions))
|
|
return nil
|
|
}
|
|
|
|
func (store *PostgresStore) GetUser(ctx context.Context, username string) (*iam_pb.Identity, error) {
|
|
if !store.configured {
|
|
return nil, fmt.Errorf("store not configured")
|
|
}
|
|
|
|
var email string
|
|
var accountDataJSON, actionsJSON, policyNamesJSON []byte
|
|
|
|
err := store.db.QueryRowContext(ctx,
|
|
"SELECT email, account_data, actions, policy_names FROM users WHERE username = $1",
|
|
username).Scan(&email, &accountDataJSON, &actionsJSON, &policyNamesJSON)
|
|
if err != nil {
|
|
if err == sql.ErrNoRows {
|
|
glog.V(2).Infof("credential postgres: GetUser user=%s not found", username)
|
|
return nil, credential.ErrUserNotFound
|
|
}
|
|
glog.Errorf("credential postgres: GetUser query failed user=%s: %v", username, err)
|
|
return nil, fmt.Errorf("failed to query user: %w", err)
|
|
}
|
|
|
|
identity := &iam_pb.Identity{
|
|
Name: username,
|
|
}
|
|
|
|
if len(accountDataJSON) > 0 {
|
|
if err := json.Unmarshal(accountDataJSON, &identity.Account); err != nil {
|
|
return nil, fmt.Errorf("failed to unmarshal account data: %w", err)
|
|
}
|
|
}
|
|
|
|
if len(actionsJSON) > 0 {
|
|
if err := json.Unmarshal(actionsJSON, &identity.Actions); err != nil {
|
|
return nil, fmt.Errorf("failed to unmarshal actions: %w", err)
|
|
}
|
|
}
|
|
|
|
if len(policyNamesJSON) > 0 {
|
|
if err := json.Unmarshal(policyNamesJSON, &identity.PolicyNames); err != nil {
|
|
return nil, fmt.Errorf("failed to unmarshal policy names: %w", err)
|
|
}
|
|
}
|
|
|
|
rows, err := store.db.QueryContext(ctx, "SELECT access_key, secret_key FROM credentials WHERE username = $1", username)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to query credentials: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
for rows.Next() {
|
|
var accessKey, secretKey string
|
|
if err := rows.Scan(&accessKey, &secretKey); err != nil {
|
|
return nil, fmt.Errorf("failed to scan credential: %w", err)
|
|
}
|
|
identity.Credentials = append(identity.Credentials, &iam_pb.Credential{
|
|
AccessKey: accessKey,
|
|
SecretKey: secretKey,
|
|
})
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, fmt.Errorf("failed iterating credential rows: %w", err)
|
|
}
|
|
|
|
glog.V(2).Infof("credential postgres: GetUser user=%s credentials=%d actions=%d", username, len(identity.Credentials), len(identity.Actions))
|
|
return identity, nil
|
|
}
|
|
|
|
|
|
func (store *PostgresStore) UpdateUser(ctx context.Context, username string, identity *iam_pb.Identity) error {
|
|
if !store.configured {
|
|
return fmt.Errorf("store not configured")
|
|
}
|
|
|
|
tx, err := store.db.BeginTx(ctx, nil)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to begin transaction: %w", err)
|
|
}
|
|
defer tx.Rollback()
|
|
|
|
var count int
|
|
err = tx.QueryRowContext(ctx, "SELECT COUNT(*) FROM users WHERE username = $1", username).Scan(&count)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to check user existence: %w", err)
|
|
}
|
|
if count == 0 {
|
|
return credential.ErrUserNotFound
|
|
}
|
|
|
|
var accountDataParam any
|
|
if identity.Account != nil {
|
|
b, err := json.Marshal(identity.Account)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to marshal account data: %w", err)
|
|
}
|
|
accountDataParam = string(b)
|
|
}
|
|
var actionsParam any
|
|
if identity.Actions != nil {
|
|
b, err := json.Marshal(identity.Actions)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to marshal actions: %w", err)
|
|
}
|
|
actionsParam = string(b)
|
|
}
|
|
var policyNamesParam any
|
|
if identity.PolicyNames != nil {
|
|
b, err := json.Marshal(identity.PolicyNames)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to marshal policy names: %w", err)
|
|
}
|
|
policyNamesParam = string(b)
|
|
}
|
|
_, err = tx.ExecContext(ctx,
|
|
"UPDATE users SET email = $2, account_data = $3, actions = $4, policy_names = $5, updated_at = CURRENT_TIMESTAMP WHERE username = $1",
|
|
username, "", accountDataParam, actionsParam, policyNamesParam)
|
|
if err != nil {
|
|
glog.Errorf("credential postgres: UpdateUser failed user=%s: %v", username, err)
|
|
return fmt.Errorf("failed to update user: %w", err)
|
|
}
|
|
|
|
_, err = tx.ExecContext(ctx, "DELETE FROM credentials WHERE username = $1", username)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to delete existing credentials: %w", err)
|
|
}
|
|
|
|
for _, cred := range identity.Credentials {
|
|
_, err = tx.ExecContext(ctx,
|
|
"INSERT INTO credentials (username, access_key, secret_key) VALUES ($1, $2, $3)",
|
|
username, cred.AccessKey, cred.SecretKey)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to insert credential: %w", err)
|
|
}
|
|
}
|
|
|
|
if err := tx.Commit(); err != nil {
|
|
glog.Errorf("credential postgres: UpdateUser commit failed user=%s: %v", username, err)
|
|
return fmt.Errorf("failed to commit: %w", err)
|
|
}
|
|
|
|
glog.V(0).Infof("credential postgres: UpdateUser user=%s credentials=%d", username, len(identity.Credentials))
|
|
return nil
|
|
}
|
|
|
|
func (store *PostgresStore) DeleteUser(ctx context.Context, username string) error {
|
|
if !store.configured {
|
|
return fmt.Errorf("store not configured")
|
|
}
|
|
|
|
result, err := store.db.ExecContext(ctx, "DELETE FROM users WHERE username = $1", username)
|
|
if err != nil {
|
|
glog.Errorf("credential postgres: DeleteUser failed user=%s: %v", username, err)
|
|
return fmt.Errorf("failed to delete user: %w", err)
|
|
}
|
|
|
|
rowsAffected, err := result.RowsAffected()
|
|
if err != nil {
|
|
return fmt.Errorf("failed to get rows affected: %w", err)
|
|
}
|
|
|
|
if rowsAffected == 0 {
|
|
glog.V(1).Infof("credential postgres: DeleteUser user=%s not found", username)
|
|
return credential.ErrUserNotFound
|
|
}
|
|
|
|
glog.V(0).Infof("credential postgres: DeleteUser user=%s", username)
|
|
return nil
|
|
}
|
|
|
|
func (store *PostgresStore) ListUsers(ctx context.Context) ([]string, error) {
|
|
if !store.configured {
|
|
return nil, fmt.Errorf("store not configured")
|
|
}
|
|
|
|
rows, err := store.db.QueryContext(ctx, "SELECT username FROM users ORDER BY username")
|
|
if err != nil {
|
|
glog.Errorf("credential postgres: ListUsers query failed: %v", err)
|
|
return nil, fmt.Errorf("failed to query users: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
var usernames []string
|
|
for rows.Next() {
|
|
var username string
|
|
if err := rows.Scan(&username); err != nil {
|
|
return nil, fmt.Errorf("failed to scan username: %w", err)
|
|
}
|
|
usernames = append(usernames, username)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, fmt.Errorf("failed iterating user rows: %w", err)
|
|
}
|
|
|
|
glog.V(1).Infof("credential postgres: ListUsers count=%d", len(usernames))
|
|
return usernames, nil
|
|
}
|
|
|
|
func (store *PostgresStore) GetUserByAccessKey(ctx context.Context, accessKey string) (*iam_pb.Identity, error) {
|
|
if !store.configured {
|
|
return nil, fmt.Errorf("store not configured")
|
|
}
|
|
|
|
var username string
|
|
err := store.db.QueryRowContext(ctx, "SELECT username FROM credentials WHERE access_key = $1", accessKey).Scan(&username)
|
|
if err != nil {
|
|
if err == sql.ErrNoRows {
|
|
glog.V(2).Infof("credential postgres: GetUserByAccessKey accessKey=%s not found", accessKey)
|
|
return nil, credential.ErrAccessKeyNotFound
|
|
}
|
|
glog.Errorf("credential postgres: GetUserByAccessKey query failed accessKey=%s: %v", accessKey, err)
|
|
return nil, fmt.Errorf("failed to query access key: %w", err)
|
|
}
|
|
|
|
glog.V(2).Infof("credential postgres: GetUserByAccessKey accessKey=%s resolved to user=%s", accessKey, username)
|
|
return store.GetUser(ctx, username)
|
|
}
|
|
|
|
func (store *PostgresStore) CreateAccessKey(ctx context.Context, username string, cred *iam_pb.Credential) error {
|
|
if !store.configured {
|
|
return fmt.Errorf("store not configured")
|
|
}
|
|
|
|
var count int
|
|
err := store.db.QueryRowContext(ctx, "SELECT COUNT(*) FROM users WHERE username = $1", username).Scan(&count)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to check user existence: %w", err)
|
|
}
|
|
if count == 0 {
|
|
return credential.ErrUserNotFound
|
|
}
|
|
|
|
_, err = store.db.ExecContext(ctx,
|
|
"INSERT INTO credentials (username, access_key, secret_key) VALUES ($1, $2, $3)",
|
|
username, cred.AccessKey, cred.SecretKey)
|
|
if err != nil {
|
|
glog.Errorf("credential postgres: CreateAccessKey failed user=%s accessKey=%s: %v", username, cred.AccessKey, err)
|
|
return fmt.Errorf("failed to insert credential: %w", err)
|
|
}
|
|
|
|
glog.V(0).Infof("credential postgres: CreateAccessKey user=%s accessKey=%s", username, cred.AccessKey)
|
|
return nil
|
|
}
|
|
|
|
func (store *PostgresStore) DeleteAccessKey(ctx context.Context, username string, accessKey string) error {
|
|
if !store.configured {
|
|
return fmt.Errorf("store not configured")
|
|
}
|
|
|
|
result, err := store.db.ExecContext(ctx,
|
|
"DELETE FROM credentials WHERE username = $1 AND access_key = $2",
|
|
username, accessKey)
|
|
if err != nil {
|
|
glog.Errorf("credential postgres: DeleteAccessKey failed user=%s accessKey=%s: %v", username, accessKey, err)
|
|
return fmt.Errorf("failed to delete access key: %w", err)
|
|
}
|
|
|
|
rowsAffected, err := result.RowsAffected()
|
|
if err != nil {
|
|
return fmt.Errorf("failed to get rows affected: %w", err)
|
|
}
|
|
|
|
if rowsAffected == 0 {
|
|
var count int
|
|
err = store.db.QueryRowContext(ctx, "SELECT COUNT(*) FROM users WHERE username = $1", username).Scan(&count)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to check user existence: %w", err)
|
|
}
|
|
if count == 0 {
|
|
return credential.ErrUserNotFound
|
|
}
|
|
return credential.ErrAccessKeyNotFound
|
|
}
|
|
|
|
glog.V(0).Infof("credential postgres: DeleteAccessKey user=%s accessKey=%s", username, accessKey)
|
|
return nil
|
|
}
|
|
|
|
func (store *PostgresStore) AttachUserPolicy(ctx context.Context, username string, policyName string) error {
|
|
if !store.configured {
|
|
return fmt.Errorf("store not configured")
|
|
}
|
|
|
|
identity, err := store.GetUser(ctx, username)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
policy, err := store.GetPolicy(ctx, policyName)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if policy == nil {
|
|
return credential.ErrPolicyNotFound
|
|
}
|
|
|
|
for _, p := range identity.PolicyNames {
|
|
if p == policyName {
|
|
return credential.ErrPolicyAlreadyAttached
|
|
}
|
|
}
|
|
|
|
identity.PolicyNames = append(identity.PolicyNames, policyName)
|
|
if err := store.UpdateUser(ctx, username, identity); err != nil {
|
|
return err
|
|
}
|
|
|
|
glog.V(0).Infof("credential postgres: AttachUserPolicy user=%s policy=%s", username, policyName)
|
|
return nil
|
|
}
|
|
|
|
func (store *PostgresStore) DetachUserPolicy(ctx context.Context, username string, policyName string) error {
|
|
if !store.configured {
|
|
return fmt.Errorf("store not configured")
|
|
}
|
|
|
|
identity, err := store.GetUser(ctx, username)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
found := false
|
|
var newPolicyNames []string
|
|
for _, p := range identity.PolicyNames {
|
|
if p == policyName {
|
|
found = true
|
|
} else {
|
|
newPolicyNames = append(newPolicyNames, p)
|
|
}
|
|
}
|
|
|
|
if !found {
|
|
return credential.ErrPolicyNotAttached
|
|
}
|
|
|
|
identity.PolicyNames = newPolicyNames
|
|
if err := store.UpdateUser(ctx, username, identity); err != nil {
|
|
return err
|
|
}
|
|
|
|
glog.V(0).Infof("credential postgres: DetachUserPolicy user=%s policy=%s", username, policyName)
|
|
return nil
|
|
}
|
|
|
|
func (store *PostgresStore) ListAttachedUserPolicies(ctx context.Context, username string) ([]string, error) {
|
|
if !store.configured {
|
|
return nil, fmt.Errorf("store not configured")
|
|
}
|
|
|
|
identity, err := store.GetUser(ctx, username)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return identity.PolicyNames, nil
|
|
}
|