Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fixes on RBAC #916

Merged
merged 4 commits into from
Sep 8, 2024
Merged

fixes on RBAC #916

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fce9ce7
fixes on RBAC
nikhilsinhaparseable Sep 5, 2024
9904889
roles correctedwq
nikhilsinhaparseable Sep 5, 2024
d6f3b55
added authorization to logout api
nikhilsinhaparseable Sep 8, 2024
42ed2a2
Merge branch 'main' into rbac-fixes
nikhilsinhaparseable Sep 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions server/src/handlers/http/cluster/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,7 @@ pub async fn fetch_daily_stats_from_ingestors(

let res = reqwest::Client::new()
.get(uri)
.header(header::AUTHORIZATION, &ingestor.token)
.header(header::CONTENT_TYPE, "application/json")
.send()
.await;
Expand Down Expand Up @@ -526,6 +527,7 @@ async fn fetch_cluster_metrics() -> Result<Vec<Metrics>, PostError> {

let res = reqwest::Client::new()
.get(uri)
.header(header::AUTHORIZATION, &ingestor.token)
.header(header::CONTENT_TYPE, "application/json")
.send()
.await;
Expand Down
3 changes: 2 additions & 1 deletion server/src/handlers/http/modal/ingest_server.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,7 @@ impl IngestServer {
.service(Server::get_about_factory())
.service(Self::analytics_factory())
.service(Server::get_liveness_factory())
.service(Server::get_metrics_webscope())
.service(Server::get_readiness_factory()),
)
.service(Server::get_ingest_otel_factory());
Expand Down Expand Up @@ -226,7 +227,7 @@ impl IngestServer {
web::resource("/info").route(
web::get()
.to(logstream::get_stream_info)
.authorize_for_stream(Action::GetStream),
.authorize_for_stream(Action::GetStreamInfo),
),
)
.service(
Expand Down
1 change: 1 addition & 0 deletions server/src/handlers/http/modal/query_server.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,6 +165,7 @@ impl QueryServer {
.service(Server::get_llm_webscope())
.service(Server::get_oauth_webscope(oidc_client))
.service(Server::get_user_role_webscope())
.service(Server::get_metrics_webscope())
.service(Self::get_cluster_web_scope()),
)
.service(Server::get_generated());
Expand Down
17 changes: 13 additions & 4 deletions server/src/handlers/http/modal/server.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,12 +180,19 @@ impl Server {
.service(Self::get_filters_webscope())
.service(Self::get_llm_webscope())
.service(Self::get_oauth_webscope(oidc_client))
.service(Self::get_user_role_webscope()),
.service(Self::get_user_role_webscope())
.service(Self::get_metrics_webscope()),
)
.service(Self::get_ingest_otel_factory())
.service(Self::get_generated());
}

pub fn get_metrics_webscope() -> Scope {
web::scope("/metrics").service(
web::resource("").route(web::get().to(metrics::get).authorize(Action::Metrics)),
)
}

// get the dashboards web scope
pub fn get_dashboards_webscope() -> Scope {
web::scope("/dashboards")
Expand Down Expand Up @@ -312,7 +319,7 @@ impl Server {
web::resource("/info").route(
web::get()
.to(logstream::get_stream_info)
.authorize_for_stream(Action::GetStream),
.authorize_for_stream(Action::GetStreamInfo),
),
)
.service(
Expand Down Expand Up @@ -423,8 +430,10 @@ impl Server {
// get the oauth webscope
pub fn get_oauth_webscope(oidc_client: Option<OpenIdClient>) -> Scope {
let oauth = web::scope("/o")
.service(resource("/login").route(web::get().to(oidc::login)))
.service(resource("/logout").route(web::get().to(oidc::logout)))
.service(resource("/login").route(web::get().to(oidc::login).authorize(Action::Login)))
.service(
resource("/logout").route(web::get().to(oidc::logout).authorize(Action::Login)),
)
.service(resource("/code").route(web::get().to(oidc::reply_login)));

if let Some(client) = oidc_client {
Expand Down
41 changes: 41 additions & 0 deletions server/src/metrics/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,9 @@ pub mod prom_utils;
pub mod storage;

use crate::{handlers::http::metrics_path, stats::FullStats};
use actix_web::Responder;
use actix_web_prometheus::{PrometheusMetrics, PrometheusMetricsBuilder};
use error::MetricsError;
use once_cell::sync::Lazy;
use prometheus::{HistogramOpts, HistogramVec, IntCounterVec, IntGaugeVec, Opts, Registry};

Expand Down Expand Up @@ -287,3 +289,42 @@ pub async fn fetch_stats_from_storage(stream_name: &str, stats: FullStats) {
.with_label_values(&["data", stream_name, "parquet"])
.set(stats.lifetime_stats.storage as i64);
}

use actix_web::HttpResponse;

pub async fn get() -> Result<impl Responder, MetricsError> {
Ok(HttpResponse::Ok().body(format!("{:?}", build_metrics_handler())))
}

pub mod error {

use actix_web::http::header::ContentType;
use http::StatusCode;

#[derive(Debug, thiserror::Error)]
pub enum MetricsError {
#[error("{0}")]
Custom(String, StatusCode),
}

impl actix_web::ResponseError for MetricsError {
fn status_code(&self) -> http::StatusCode {
match self {
Self::Custom(_, _) => StatusCode::INTERNAL_SERVER_ERROR,
}
}

fn error_response(&self) -> actix_web::HttpResponse<actix_web::body::BoxBody> {
actix_web::HttpResponse::build(self.status_code())
.insert_header(ContentType::plaintext())
.body(self.to_string())
}
}

#[allow(dead_code)]
fn construct_custom_error() {
let error =
MetricsError::Custom("Some error".to_string(), StatusCode::INTERNAL_SERVER_ERROR);
println!("{:?}", error);
}
}
62 changes: 47 additions & 15 deletions server/src/rbac/role.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ pub enum Action {
Query,
CreateStream,
ListStream,
GetStream,
GetStreamInfo,
GetSchema,
GetStats,
DeleteStream,
Expand Down Expand Up @@ -63,6 +63,8 @@ pub enum Action {
DeleteFilter,
ListCache,
RemoveCache,
Login,
Metrics,
}

#[derive(Debug, Clone, PartialEq, Eq, Hash)]
Expand Down Expand Up @@ -102,7 +104,9 @@ impl RoleBuilder {
self.stream.clone().unwrap(),
self.tag.clone(),
),
Action::PutUser
Action::Login
| Action::Metrics
| Action::PutUser
| Action::ListUser
| Action::PutUserRoles
| Action::GetUserRoles
Expand All @@ -115,7 +119,7 @@ impl RoleBuilder {
| Action::ListRole
| Action::CreateStream
| Action::DeleteStream
| Action::GetStream
| Action::GetStreamInfo
| Action::ListStream
| Action::ListCluster
| Action::ListClusterMetrics
Expand Down Expand Up @@ -201,11 +205,14 @@ pub mod model {
fn editor_perm_builder() -> RoleBuilder {
RoleBuilder {
actions: vec![
Action::Login,
Action::Metrics,
Action::Ingest,
Action::Query,
Action::CreateStream,
Action::DeleteStream,
Action::ListStream,
Action::GetStream,
Action::GetStreamInfo,
Action::GetSchema,
Action::GetStats,
Action::GetRetention,
Expand All @@ -217,8 +224,15 @@ pub mod model {
Action::DeleteHotTierEnabled,
Action::PutAlert,
Action::GetAlert,
Action::GetAbout,
Action::QueryLLM,
Action::CreateFilter,
Action::ListFilter,
Action::GetFilter,
Action::DeleteFilter,
Action::ListDashboard,
Action::GetDashboard,
Action::CreateDashboard,
Action::DeleteDashboard,
],
stream: Some("*".to_string()),
tag: None,
Expand All @@ -228,17 +242,31 @@ pub mod model {
fn writer_perm_builder() -> RoleBuilder {
RoleBuilder {
actions: vec![
Action::Ingest,
Action::Login,
Action::Query,
Action::ListStream,
Action::GetStream,
Action::GetSchema,
Action::GetStats,
Action::GetRetention,
Action::PutRetention,
Action::PutAlert,
Action::GetAlert,
Action::GetAbout,
Action::GetRetention,
Action::PutHotTierEnabled,
Action::GetHotTierEnabled,
Action::DeleteHotTierEnabled,
Action::ListDashboard,
Action::GetDashboard,
Action::CreateDashboard,
Action::DeleteDashboard,
Action::Ingest,
Action::QueryLLM,
Action::GetStreamInfo,
Action::GetCacheEnabled,
Action::PutCacheEnabled,
Action::GetFilter,
Action::ListFilter,
Action::CreateFilter,
Action::DeleteFilter,
],
stream: None,
tag: None,
Expand All @@ -248,17 +276,21 @@ pub mod model {
fn reader_perm_builder() -> RoleBuilder {
RoleBuilder {
actions: vec![
Action::Login,
Action::Query,
Action::ListStream,
Action::GetStream,
Action::GetSchema,
Action::GetStats,
Action::GetRetention,
Action::GetAlert,
Action::GetAbout,
Action::QueryLLM,
Action::ListCluster,
Action::GetHotTierEnabled,
Action::ListFilter,
Action::GetFilter,
Action::CreateFilter,
Action::DeleteFilter,
Action::ListDashboard,
Action::GetDashboard,
Action::CreateDashboard,
Action::DeleteDashboard,
Action::GetStreamInfo,
],
stream: None,
tag: None,
Expand Down
Loading