mirror of
https://github.com/versity/versitygw.git
synced 2026-08-18 21:26:27 +00:00
niksis02
ec8048fa3c
Adds `CreateRole`, `GetRole`, `ListRoles`, `DeleteRole`, and `UpdateAssumeRolePolicy` to the standalone IAM service, following the same controller/storage patterns established for users. Both the internal filesystem/S3-backed store and the Vault-backed store implement the new `Storer` methods, with role-specific indexing and lookup helpers mirroring the existing user ones. Role creation requires a trust policy, passed as `AssumeRolePolicyDocument`. A trust policy is a distinct kind of IAM policy document that governs who (or what) is allowed to assume a role, rather than what actions the role itself is permitted to perform. Its grammar is effectively the inverse of an identity policy: `Principal` is required, `Action`/`NotAction` values must carry the `sts:` prefix, and `Resource`/`NotResource` are forbidden. This is implemented in `iamapi/policy/trust.go` as a new validation path alongside the existing identity-policy validation, and is reused by `UpdateAssumeRolePolicy` when replacing a role's trust policy. Also fixes user name uniqueness enforcement to be case-insensitive, matching AWS IAM behavior, and applies the same case-insensitive handling to role names. The internal store now maintains lowercase name indexes for both users and roles, and the Vault store resolves the canonical stored key via a case-insensitive list-and-compare fallback since Vault's KV paths are case-sensitive.
110 lines
3.4 KiB
Go
110 lines
3.4 KiB
Go
// Copyright 2026 Versity Software
|
|
// This file is licensed under the Apache License, Version 2.0
|
|
// (the "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package iamapi
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/gofiber/fiber/v3"
|
|
"github.com/versity/versitygw/iamapi/iamerr"
|
|
"github.com/versity/versitygw/iamapi/internal/iammiddleware"
|
|
"github.com/versity/versitygw/iamapi/internal/iamutil"
|
|
"github.com/versity/versitygw/iamapi/storage"
|
|
)
|
|
|
|
const (
|
|
iamAPIVersion = "2010-05-08"
|
|
noVersionSpecified = "NO_VERSION_SPECIFIED"
|
|
productURL = "https://www.versity.com/products/versitygw/"
|
|
)
|
|
|
|
var unknownOperationBody = []byte("<UnknownOperationException/>\n")
|
|
|
|
type IAMApiRouter struct {
|
|
app *fiber.App
|
|
store storage.Storer
|
|
Ctrl IAMApiController
|
|
actions map[string]ActionHandler
|
|
rootCreds *RootCredentials
|
|
}
|
|
|
|
func (r *IAMApiRouter) Init() {
|
|
ctrl := NewController(r.store)
|
|
r.Ctrl = ctrl
|
|
|
|
r.actions = map[string]ActionHandler{
|
|
// User CRUD
|
|
"CreateUser": ctrl.CreateUser,
|
|
"DeleteUser": ctrl.DeleteUser,
|
|
"GetUser": ctrl.GetUser,
|
|
"ListUsers": ctrl.ListUsers,
|
|
"UpdateUser": ctrl.UpdateUser,
|
|
// User Access Key CRUD
|
|
"CreateAccessKey": ctrl.CreateAccessKey,
|
|
"UpdateAccessKey": ctrl.UpdateAccessKey,
|
|
"DeleteAccessKey": ctrl.DeleteAccessKey,
|
|
"GetAccessKeyLastUsed": ctrl.GetAccessKeyLastUsed,
|
|
"ListAccessKeys": ctrl.ListAccessKeys,
|
|
// User Inline Policy CRUD
|
|
"PutUserPolicy": ctrl.PutUserPolicy,
|
|
"GetUserPolicy": ctrl.GetUserPolicy,
|
|
"DeleteUserPolicy": ctrl.DeleteUserPolicy,
|
|
"ListUserPolicies": ctrl.ListUserPolicies,
|
|
// Role CRUD
|
|
"CreateRole": ctrl.CreateRole,
|
|
"GetRole": ctrl.GetRole,
|
|
"ListRoles": ctrl.ListRoles,
|
|
"DeleteRole": ctrl.DeleteRole,
|
|
"UpdateAssumeRolePolicy": ctrl.UpdateAssumeRolePolicy,
|
|
}
|
|
|
|
actionRoute := ProcessHandlers(r.routeAction, iammiddleware.VerifyIAMAuth(r.rootCreds))
|
|
r.app.Get("/*", iamutil.MatchQueryOrFormArgs("Action"), actionRoute)
|
|
r.app.Post("/*", iamutil.MatchQueryOrFormArgs("Action"), actionRoute)
|
|
|
|
r.app.All("/", r.redirectRoot)
|
|
r.app.All("*", r.unknownOperation)
|
|
}
|
|
|
|
func (r *IAMApiRouter) routeAction(ctx fiber.Ctx) (*Response, error) {
|
|
action, _ := iamutil.RequestParam(ctx, "Action")
|
|
version, versionSpecified := iamutil.RequestParam(ctx, "Version")
|
|
if !versionSpecified {
|
|
version = noVersionSpecified
|
|
}
|
|
if version != iamAPIVersion {
|
|
return &Response{}, iamerr.InvalidAction(action, version)
|
|
}
|
|
|
|
handler, ok := r.actions[action]
|
|
if !ok {
|
|
return &Response{}, iamerr.InvalidAction(action, version)
|
|
}
|
|
|
|
return handler(ctx)
|
|
}
|
|
|
|
func (r *IAMApiRouter) redirectRoot(ctx fiber.Ctx) error {
|
|
iammiddleware.EnsureRequestID(ctx)
|
|
ctx.Set(fiber.HeaderLocation, productURL)
|
|
ctx.Status(http.StatusFound)
|
|
return nil
|
|
}
|
|
|
|
func (r *IAMApiRouter) unknownOperation(ctx fiber.Ctx) error {
|
|
iammiddleware.EnsureRequestID(ctx)
|
|
return ctx.Status(http.StatusNotFound).Send(unknownOperationBody)
|
|
}
|