github.com/juju/juju@v0.0.0-20240430160146-1752b71fcf00/apiserver/restrict_controller.go (about)

     1  // Copyright 2016 Canonical Ltd.
     2  // Licensed under the AGPLv3, see LICENCE file for details.
     3  
     4  package apiserver
     5  
     6  import (
     7  	"fmt"
     8  
     9  	"github.com/juju/collections/set"
    10  	"github.com/juju/errors"
    11  )
    12  
    13  // The controllerFacadeNames are the root names that can be accessed
    14  // using a controller-only login. Any facade added here needs to work
    15  // independently of individual models.
    16  var controllerFacadeNames = set.NewStrings(
    17  	"AllModelWatcher",
    18  	"ApplicationOffers",
    19  	"Cloud",
    20  	"Controller",
    21  	"CrossController",
    22  	"MigrationTarget",
    23  	"ModelManager",
    24  	"ModelUpgrader",
    25  	"ModelSummaryWatcher",
    26  	"SecretBackends",
    27  	"UserManager",
    28  )
    29  
    30  // commonFacadeNames holds root names that can be accessed using both
    31  // controller and model connections.
    32  var commonFacadeNames = set.NewStrings(
    33  	"Pinger",
    34  	"Bundle",
    35  
    36  	// TODO(mjs) - bug 1632172 - Exposed for model logins for
    37  	// backwards compatibility. Remove once we're sure no non-Juju
    38  	// clients care about it.
    39  	"HighAvailability",
    40  
    41  	// NotifyWatcher may be used for watching controller API info,
    42  	// in conjunction with the CrossController facade.
    43  	"NotifyWatcher",
    44  
    45  	// ModelConfig may be used for letting controller commands access provider, for example, juju add-k8s.
    46  	"ModelConfig",
    47  )
    48  
    49  func controllerFacadesOnly(facadeName, _ string) error {
    50  	if !IsControllerFacade(facadeName) {
    51  		return errors.NewNotSupported(nil, fmt.Sprintf("facade %q not supported for controller API connection", facadeName))
    52  	}
    53  	return nil
    54  }
    55  
    56  // IsControllerFacade reports whether the given facade name can be accessed
    57  // using a controller connection.
    58  func IsControllerFacade(facadeName string) bool {
    59  	return controllerFacadeNames.Contains(facadeName) || commonFacadeNames.Contains(facadeName)
    60  }