netmaker/pro/logic/security.go

package logic

import (
	"errors"
	"fmt"
	"net/http"
	"strings"

	"context"

	"github.com/gorilla/mux"

	"github.com/gravitl/netmaker/db"
	"github.com/gravitl/netmaker/logic"
	"github.com/gravitl/netmaker/schema"
	"github.com/gravitl/netmaker/servercfg"
)

// constants for accounts api hosts
const (
	// accountsHostDevelopment is the accounts api host for development environment
	accountsHostDevelopment = "https://api.dev.accounts.netmaker.io"
	// accountsHostStaging is the accounts api host for staging environment
	accountsHostStaging = "https://api.staging.accounts.netmaker.io"
	// accountsHostProduction is the accounts api host for production environment
	accountsHostProduction = "https://api.accounts.netmaker.io"
)

// constants for accounts UI hosts
const (
	// accountsUIHostDevelopment is the accounts UI host for development environment
	accountsUIHostDevelopment = "https://account.dev.netmaker.io"
	// accountsUIHostStaging is the accounts UI host for staging environment
	accountsUIHostStaging = "https://account.staging.netmaker.io"
	// accountsUIHostProduction is the accounts UI host for production environment
	accountsUIHostProduction = "https://account.netmaker.io"

	// saasNMUIHostDevelopment is the SaaS NMUI host for development environment
	saasNMUIHostDevelopment = "https://app.dev.netmaker.io"
	// saasNMUIHostStaging is the SaaS NMUI host for staging environment
	saasNMUIHostStaging = "https://app.staging.netmaker.io"
	// saasNMUIHostProduction is the SaaS NMUI host for production environment
	saasNMUIHostProduction = "https://app.netmaker.io"
)

func NetworkPermissionsCheck(username string, r *http.Request) error {
	// at this point global checks should be completed
	user := &schema.User{Username: username}
	err := user.Get(r.Context())
	if err != nil {
		return err
	}
	userRole := &schema.UserRole{ID: user.PlatformRoleID}
	err = userRole.Get(r.Context())
	if err != nil {
		return errors.New("access denied")
	}
	if userRole.FullAccess {
		return nil
	}

	if userRole.ID == schema.Auditor {
		if r.Method == http.MethodGet {
			return nil
		} else {
			return errors.New("access denied")
		}
	}

	// get info from header to determine the target rsrc
	targetRsrc := r.Header.Get("TARGET_RSRC")
	targetRsrcID := r.Header.Get("TARGET_RSRC_ID")
	netID := r.Header.Get("NET_ID")
	if targetRsrc == "" {
		return errors.New("target rsrc is missing")
	}
	if r.Header.Get("RAC") == "true" && r.Method == http.MethodGet {
		return nil
	}
	if netID == "" {
		return errors.New("network id is missing")
	}
	if r.Method == "" {
		r.Method = http.MethodGet
	}
	if targetRsrc == schema.MetricRsrc.String() {
		return nil
	}

	for groupID := range user.UserGroups.Data() {

		userG, err := GetUserGroup(groupID)
		if err == nil {
			if netRoles, ok := userG.NetworkRoles.Data()[schema.AllNetworks]; ok {
				for netRoleID := range netRoles {
					err = checkNetworkAccessPermissions(netRoleID, username, r.Method, targetRsrc, targetRsrcID, netID)
					if err == nil {
						return nil
					}
				}
			}
			netRoles := userG.NetworkRoles.Data()[schema.NetworkID(netID)]
			for netRoleID := range netRoles {
				err = checkNetworkAccessPermissions(netRoleID, username, r.Method, targetRsrc, targetRsrcID, netID)
				if err == nil {
					return nil
				}
			}
		}
	}

	return errors.New("access denied")
}

func checkNetworkAccessPermissions(netRoleID schema.UserRoleID, username, reqScope, targetRsrc, targetRsrcID, netID string) error {
	networkPermissionScope := &schema.UserRole{ID: netRoleID}
	err := networkPermissionScope.Get(db.WithContext(context.TODO()))
	if err != nil {
		return err
	}
	if networkPermissionScope.FullAccess {
		return nil
	}
	rsrcPermissionScope, ok := networkPermissionScope.NetworkLevelAccess.Data()[schema.RsrcType(targetRsrc)]
	if !ok {
		return errors.New("access denied")
	}
	if allRsrcsTypePermissionScope, ok := rsrcPermissionScope[logic.GetAllRsrcIDForRsrc(schema.RsrcType(targetRsrc))]; ok {
		// handle extclient apis here
		if schema.RsrcType(targetRsrc) == schema.ExtClientsRsrc && allRsrcsTypePermissionScope.SelfOnly && targetRsrcID != "" {
			extclient, err := logic.GetExtClient(targetRsrcID, netID)
			if err != nil {
				return err
			}
			if !logic.IsUserAllowedAccessToExtClient(username, extclient) {
				return errors.New("access denied")
			}
		}
		err = checkPermissionScopeWithReqMethod(allRsrcsTypePermissionScope, reqScope)
		if err == nil {
			return nil
		}

	}
	if targetRsrcID == "" {
		return errors.New("target rsrc id is empty")
	}
	if scope, ok := rsrcPermissionScope[schema.RsrcID(targetRsrcID)]; ok {
		err = checkPermissionScopeWithReqMethod(scope, reqScope)
		if err == nil {
			return nil
		}
	}
	return errors.New("access denied")
}

func GlobalPermissionsCheck(username string, r *http.Request) error {
	route, err := mux.CurrentRoute(r).GetPathTemplate()
	if err != nil {
		return err
	}
	user := &schema.User{Username: username}
	err = user.Get(r.Context())
	if err != nil {
		return err
	}
	userRole := &schema.UserRole{ID: user.PlatformRoleID}
	err = userRole.Get(r.Context())
	if err != nil {
		return errors.New("access denied")
	}
	if userRole.FullAccess {
		return nil
	}

	if userRole.ID == schema.Auditor {
		if r.Method == http.MethodGet {
			return nil
		} else {
			if (r.Method == http.MethodPut || r.Method == http.MethodPost) &&
				strings.Contains(r.URL.Path, "/api/users/"+username) {
				return nil
			}

			return errors.New("access denied")
		}
	}

	targetRsrc := r.Header.Get("TARGET_RSRC")
	targetRsrcID := r.Header.Get("TARGET_RSRC_ID")
	if targetRsrc == "" {
		return errors.New("target rsrc is missing")
	}
	if r.Method == "" {
		r.Method = http.MethodGet
	}
	if targetRsrc == schema.MetricRsrc.String() {
		return nil
	}
	if (targetRsrc == schema.HostRsrc.String() || targetRsrc == schema.NetworkRsrc.String()) && r.Method == http.MethodGet && targetRsrcID == "" {
		return nil
	}
	if targetRsrc == schema.UserRsrc.String() && user.PlatformRoleID == schema.PlatformUser && r.Method == http.MethodPut &&
		route == "/api/v1/users/add_network_user" || route == "/api/v1/users/remove_network_user" {
		return nil
	}
	if targetRsrc == schema.UserRsrc.String() && user.PlatformRoleID == schema.PlatformUser && r.Method == http.MethodGet &&
		route == "/api/v1/users/unassigned_network_users" {
		return nil
	}
	if targetRsrc == schema.JitUserRsrc.String() && r.Method == http.MethodGet &&
		strings.Contains(r.URL.Path, "/api/v1/jit_user/networks") {
		return nil
	}
	if targetRsrc == schema.UserRsrc.String() && username == targetRsrcID && (r.Method != http.MethodDelete) {
		return nil
	}
	if r.Method == http.MethodGet && targetRsrc == schema.UserActivityRsrc.String() && route == "/api/v1/user/activity" {
		return nil
	}
	if r.Method == http.MethodGet && user.PlatformRoleID == schema.PlatformUser && (route == "/api/v1/network/activity" || route == "/api/v1/flows") {
		return nil
	}
	rsrcPermissionScope, ok := userRole.GlobalLevelAccess.Data()[schema.RsrcType(targetRsrc)]
	if !ok {
		return fmt.Errorf("access denied to %s", targetRsrc)
	}
	if allRsrcsTypePermissionScope, ok := rsrcPermissionScope[schema.RsrcID(fmt.Sprintf("all_%s", targetRsrc))]; ok {
		return checkPermissionScopeWithReqMethod(allRsrcsTypePermissionScope, r.Method)

	}
	if targetRsrcID == "" {
		return errors.New("target rsrc id is missing")
	}
	if scope, ok := rsrcPermissionScope[schema.RsrcID(targetRsrcID)]; ok {
		return checkPermissionScopeWithReqMethod(scope, r.Method)
	}
	return errors.New("access denied")
}

func checkPermissionScopeWithReqMethod(scope schema.RsrcPermissionScope, reqmethod string) error {
	if reqmethod == http.MethodGet && scope.Read {
		return nil
	}
	if (reqmethod == http.MethodPatch || reqmethod == http.MethodPut) && scope.Update {
		return nil
	}
	if reqmethod == http.MethodDelete && scope.Delete {
		return nil
	}
	if reqmethod == http.MethodPost && scope.Create {
		return nil
	}
	return errors.New("operation not permitted")
}

func GetAccountsHost() string {
	switch servercfg.GetEnvironment() {
	case "dev":
		return accountsHostDevelopment
	case "staging":
		return accountsHostStaging
	default:
		return accountsHostProduction
	}
}

func GetAccountsUIHost() string {
	switch servercfg.GetEnvironment() {
	case "dev":
		return accountsUIHostDevelopment
	case "staging":
		return accountsUIHostStaging
	default:
		return accountsUIHostProduction
	}
}

func GetSaaSNMUIHost() string {
	switch servercfg.GetEnvironment() {
	case "dev":
		return saasNMUIHostDevelopment
	case "staging":
		return saasNMUIHostStaging
	default:
		return saasNMUIHostProduction
	}
}

func GetSaaSNMUIHostWithVersion() string {
	return fmt.Sprintf("%s/%s", GetSaaSNMUIHost(), servercfg.GetVersion())
}