Skip to content

Commit 74e8819

Browse files
TakuyaMatsuTakuyaMatsu
committed
fix
Signed-off-by: Takuya Matsumoto <takumats@lycorp.co.jp>
1 parent 4f69158 commit 74e8819

File tree

9 files changed

+26
-11
lines changed

9 files changed

+26
-11
lines changed

‎clients/go/zms/zms_schema.go

+2-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎core/zms/src/main/java/com/yahoo/athenz/zms/ZMSSchema.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -2264,7 +2264,7 @@ private static Schema build() {
22642264
;
22652265

22662266
sb.resource("Assertion", "DELETE", "/domain/{domainName}/policy/{policyName}/assertion/{assertionId}")
2267-
.comment("Delete the specified policy assertion. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).")
2267+
.comment("Delete the specified policy assertion. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned). The required authorization includes three options: 1. (\"update\", \"{domainName}:policy.{policyName}\") 2. (\"delete\", \"{domainName}:policy.{policyName}.assertion.{assertionId}\")")
22682268
.pathParam("domainName", "DomainName", "name of the domain")
22692269
.pathParam("policyName", "EntityName", "name of the policy")
22702270
.pathParam("assertionId", "Int64", "assertion id")
@@ -2286,7 +2286,7 @@ private static Schema build() {
22862286
;
22872287

22882288
sb.resource("Assertion", "DELETE", "/domain/{domainName}/policy/{policyName}/version/{version}/assertion/{assertionId}")
2289-
.comment("Delete the specified policy version assertion. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).")
2289+
.comment("Delete the specified policy version assertion. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned). The required authorization includes three options: 1. (\"update\", \"{domainName}:policy.{policyName}\") 2. (\"delete\", \"{domainName}:policy.{policyName}.assertion.{assertionId}\")")
22902290
.name("deleteAssertionPolicyVersion")
22912291
.pathParam("domainName", "DomainName", "name of the domain")
22922292
.pathParam("policyName", "EntityName", "name of the policy")

‎core/zms/src/main/rdl/Policy.rdli

+6-2
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,9 @@ resource Assertion PUT "/domain/{domainName}/policy/{policyName}/version/{versio
152152

153153
//Delete the specified policy assertion. Upon successful completion of this delete
154154
//request, the server will return NO_CONTENT status code without any data (no
155-
//object will be returned).
155+
//object will be returned). The required authorization includes three options:
156+
// 1. ("update", "{domainName}:policy.{policyName}")
157+
// 2. ("delete", "{domainName}:policy.{policyName}.assertion.{assertionId}")
156158
resource Assertion DELETE "/domain/{domainName}/policy/{policyName}/assertion/{assertionId}" {
157159
DomainName domainName; //name of the domain
158160
EntityName policyName; //name of the policy
@@ -173,7 +175,9 @@ resource Assertion DELETE "/domain/{domainName}/policy/{policyName}/assertion/{a
173175

174176
//Delete the specified policy version assertion. Upon successful completion of this delete
175177
//request, the server will return NO_CONTENT status code without any data (no
176-
//object will be returned).
178+
//object will be returned). The required authorization includes three options:
179+
// 1. ("update", "{domainName}:policy.{policyName}")
180+
// 2. ("delete", "{domainName}:policy.{policyName}.assertion.{assertionId}")
177181
resource Assertion DELETE "/domain/{domainName}/policy/{policyName}/version/{version}/assertion/{assertionId}" (name=deleteAssertionPolicyVersion) {
178182
DomainName domainName; //name of the domain
179183
EntityName policyName; //name of the policy

‎libs/java/server_common/src/main/java/com/yahoo/athenz/common/ServerCommonConsts.java

+1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ public final class ServerCommonConsts {
2121
public static final String OBJECT_ROLE = "role";
2222
public static final String OBJECT_GROUP = "group";
2323
public static final String OBJECT_POLICY = "policy";
24+
public static final String OBJECT_ASSERTION = "assertion";
2425
public static final String OBJECT_ENTITY = "entity";
2526
public static final String USER_DOMAIN = "user";
2627

‎libs/java/server_common/src/main/java/com/yahoo/athenz/common/server/util/ResourceUtils.java

+4
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,10 @@ public static String policyResourceName(String domainName, String policyName) {
4343
return generateResourceName(domainName, policyName, ServerCommonConsts.OBJECT_POLICY);
4444
}
4545

46+
public static String assertionResourceName(String domainName, String policyName, Long assertionId) {
47+
return domainName + ":" + ServerCommonConsts.OBJECT_POLICY + "." + policyName + "." + ServerCommonConsts.OBJECT_ASSERTION + "." + assertionId;
48+
}
49+
4650
public static String entityResourceName(String domainName, String entityName) {
4751
return generateResourceName(domainName, entityName, ServerCommonConsts.OBJECT_ENTITY);
4852
}

‎libs/java/server_common/src/test/java/com/yahoo/athenz/common/server/util/ResourceUtilsTest.java

+6
Original file line numberDiff line numberDiff line change
@@ -50,4 +50,10 @@ public void testPolicyResourceName() {
5050
assertEquals(ResourceUtils.policyResourceName("athenz", "policy1"), "athenz:policy.policy1");
5151
assertEquals(ResourceUtils.policyResourceName("athenz.api", "policy1"), "athenz.api:policy.policy1");
5252
}
53+
54+
@Test
55+
public void testAssertionResourceName() {
56+
assertEquals(ResourceUtils.assertionResourceName("athenz", "policy1", 123l), "athenz:policy.policy1.assertion.123");
57+
assertEquals(ResourceUtils.assertionResourceName("athenz.api", "policy1", 123l), "athenz.api:policy.policy1.assertion.123");
58+
}
5359
}

‎servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSImpl.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -10608,10 +10608,10 @@ boolean isAllowedDeletePendingMembership(Principal principal, final String domai
1060810608
}
1060910609

1061010610
boolean isAllowedDeleteAssertion(Principal principal, final AthenzDomain domain, final String policyName, final Long assertionId) {
10611-
if (hasAccess(domain, "update", String.format("%s:%s%s", domain.getName(), POLICY_PREFIX, policyName), principal, null) == AccessStatus.ALLOWED) {
10611+
if (hasAccess(domain, "update", ResourceUtils.policyResourceName(domain.getName(), policyName), principal, null) == AccessStatus.ALLOWED) {
1061210612
return true;
1061310613
}
10614-
if (hasAccess(domain, "delete", String.format("%s:%s%d", domain.getName(), ASSERTION_PREFIX, assertionId), principal, null) == AccessStatus.ALLOWED) {
10614+
if (hasAccess(domain, "delete", ResourceUtils.assertionResourceName(domain.getName(), policyName, assertionId), principal, null) == AccessStatus.ALLOWED) {
1061510615
return true;
1061610616
}
1061710617
return false;

‎servers/zms/src/main/java/com/yahoo/athenz/zms/ZMSResources.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -2514,7 +2514,7 @@ public Assertion putAssertionPolicyVersion(
25142514
@DELETE
25152515
@Path("/domain/{domainName}/policy/{policyName}/assertion/{assertionId}")
25162516
@Produces(MediaType.APPLICATION_JSON)
2517-
@Operation(description = "Delete the specified policy assertion. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).")
2517+
@Operation(description = "Delete the specified policy assertion. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned). The required authorization includes three options: 1. (\"update\", \"{domainName}:policy.{policyName}\") 2. (\"delete\", \"{domainName}:policy.{policyName}.assertion.{assertionId}\")")
25182518
public void deleteAssertion(
25192519
@Parameter(description = "name of the domain", required = true) @PathParam("domainName") String domainName,
25202520
@Parameter(description = "name of the policy", required = true) @PathParam("policyName") String policyName,
@@ -2555,7 +2555,7 @@ public void deleteAssertion(
25552555
@DELETE
25562556
@Path("/domain/{domainName}/policy/{policyName}/version/{version}/assertion/{assertionId}")
25572557
@Produces(MediaType.APPLICATION_JSON)
2558-
@Operation(description = "Delete the specified policy version assertion. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned).")
2558+
@Operation(description = "Delete the specified policy version assertion. Upon successful completion of this delete request, the server will return NO_CONTENT status code without any data (no object will be returned). The required authorization includes three options: 1. (\"update\", \"{domainName}:policy.{policyName}\") 2. (\"delete\", \"{domainName}:policy.{policyName}.assertion.{assertionId}\")")
25592559
public void deleteAssertionPolicyVersion(
25602560
@Parameter(description = "name of the domain", required = true) @PathParam("domainName") String domainName,
25612561
@Parameter(description = "name of the policy", required = true) @PathParam("policyName") String policyName,

‎servers/zms/src/test/java/com/yahoo/athenz/zms/ZMSImplTest.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -18255,7 +18255,7 @@ public void testDeleteAssertionAuthority() {
1825518255
Assertion assertion = new Assertion();
1825618256
assertion.setAction("delete");
1825718257
assertion.setEffect(AssertionEffect.ALLOW);
18258-
assertion.setResource(domainName + ":assertion." + assertionId);
18258+
assertion.setResource(domainName + ":policy.policy1.assertion." + assertionId);
1825918259
assertion.setRole(ResourceUtils.roleResourceName(domainName, "delete-assertion-role"));
1826018260
zmsImpl.putAssertion(ctx, domainName, "policy1", auditRef, null, assertion);
1826118261

0 commit comments

Comments
 (0)