go.chromium.org/luci@v0.0.0-20240309015107-7cdc2e660f33/server/auth/authdb/unconfigured.go (about)

     1  // Copyright 2020 The LUCI Authors.
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //      http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  package authdb
    16  
    17  import (
    18  	"context"
    19  	"net"
    20  
    21  	"go.chromium.org/luci/auth/identity"
    22  	"go.chromium.org/luci/common/logging"
    23  
    24  	"go.chromium.org/luci/server/auth/realms"
    25  	"go.chromium.org/luci/server/auth/service/protocol"
    26  	"go.chromium.org/luci/server/auth/signing"
    27  )
    28  
    29  // UnconfiguredDB is an empty authdb.DB that logs and rejects most checks.
    30  //
    31  // What checks are logged are based on the following criteria: if a server has
    32  // UnconfiguredDB installed, and it totally ignores authentication and
    33  // authorization (for example, it is a localhost server), then no logging should
    34  // be emitted. In practice it means we don't log in GetAllowlistForIdentity
    35  // only (it is called for all incoming requests).
    36  type UnconfiguredDB struct {
    37  	Error error // an error to return, must be non-nil
    38  }
    39  
    40  func (db UnconfiguredDB) log(ctx context.Context, method string) {
    41  	logging.Errorf(ctx, "UnconfiguredDB.%s: %s", method, db.Error)
    42  	if db.Error == nil {
    43  		panic("UnconfiguredDB.Error must not be nil")
    44  	}
    45  }
    46  
    47  func (db UnconfiguredDB) IsAllowedOAuthClientID(ctx context.Context, email, clientID string) (bool, error) {
    48  	db.log(ctx, "IsAllowedOAuthClientID")
    49  	return false, db.Error
    50  }
    51  
    52  func (db UnconfiguredDB) IsInternalService(ctx context.Context, hostname string) (bool, error) {
    53  	db.log(ctx, "IsInternalService")
    54  	return false, db.Error
    55  }
    56  
    57  func (db UnconfiguredDB) IsMember(ctx context.Context, id identity.Identity, groups []string) (bool, error) {
    58  	db.log(ctx, "IsMember")
    59  	return false, db.Error
    60  }
    61  
    62  func (db UnconfiguredDB) CheckMembership(ctx context.Context, id identity.Identity, groups []string) ([]string, error) {
    63  	db.log(ctx, "CheckMembership")
    64  	return nil, db.Error
    65  }
    66  
    67  func (db UnconfiguredDB) HasPermission(ctx context.Context, id identity.Identity, perm realms.Permission, realm string, attrs realms.Attrs) (bool, error) {
    68  	db.log(ctx, "HasPermission")
    69  	return false, db.Error
    70  }
    71  
    72  func (db UnconfiguredDB) QueryRealms(ctx context.Context, id identity.Identity, perm realms.Permission, project string, attrs realms.Attrs) ([]string, error) {
    73  	db.log(ctx, "QueryRealms")
    74  	return nil, db.Error
    75  }
    76  
    77  func (db UnconfiguredDB) FilterKnownGroups(ctx context.Context, groups []string) ([]string, error) {
    78  	db.log(ctx, "FilterKnownGroups")
    79  	return nil, db.Error
    80  }
    81  
    82  func (db UnconfiguredDB) GetCertificates(ctx context.Context, id identity.Identity) (*signing.PublicCertificates, error) {
    83  	db.log(ctx, "GetCertificates")
    84  	return nil, db.Error
    85  }
    86  
    87  func (db UnconfiguredDB) GetAllowlistForIdentity(ctx context.Context, ident identity.Identity) (string, error) {
    88  	// GetAllowlistForIdentity is called for ALL incoming requests. Let them pass.
    89  	return "", nil
    90  }
    91  
    92  func (db UnconfiguredDB) IsAllowedIP(ctx context.Context, ip net.IP, allowlist string) (bool, error) {
    93  	db.log(ctx, "IsAllowedIP")
    94  	return false, db.Error
    95  }
    96  
    97  func (db UnconfiguredDB) GetAuthServiceURL(ctx context.Context) (string, error) {
    98  	db.log(ctx, "GetAuthServiceURL")
    99  	return "", db.Error
   100  }
   101  
   102  func (db UnconfiguredDB) GetTokenServiceURL(ctx context.Context) (string, error) {
   103  	db.log(ctx, "GetTokenServiceURL")
   104  	return "", db.Error
   105  }
   106  
   107  func (db UnconfiguredDB) GetRealmData(ctx context.Context, realm string) (*protocol.RealmData, error) {
   108  	db.log(ctx, "GetRealmData")
   109  	return nil, db.Error
   110  }