Skip to content
This repository was archived by the owner on Jan 28, 2021. It is now read-only.

auth: add authentication and authorization interface #496

Merged
merged 12 commits into from
Oct 25, 2018
Merged

auth: add authentication and authorization interface #496

Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
3b3b8b0
server: create session when needed
jfontan Oct 23, 2018
9361fcd
auth: add authentication and authorization interface
jfontan Oct 23, 2018
e678357
auth: use go-errors to better identify causes
jfontan Oct 24, 2018
de8c11a
server: do not use extra function to call builder
jfontan Oct 24, 2018
20d732a
integration: fix test server
jfontan Oct 24, 2018
f4aabc3
auth: fix both clean and native password
jfontan Oct 24, 2018
277877e
auth: test auth modules
jfontan Oct 24, 2018
e04a75b
auth: use go-errors.v1
jfontan Oct 25, 2018
9271159
auth: add documentation to auth.Auth interface
jfontan Oct 25, 2018
01ffab1
auth: specify permissions in NewNativeSingle
jfontan Oct 25, 2018
c874286
analyzer: delete readonly rule
jfontan Oct 25, 2018
8cb84a7
integration: fix integration server
jfontan Oct 25, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
auth: add documentation to auth.Auth interface 
Signed-off-by: Javi Fontan <jfontan@gmail.com>
  • Loading branch information
@jfontan
jfontan committed Oct 25, 2018
commit 927115964f9f7a15ffd9095976ad93096cba8866
4 changes: 4 additions & 0 deletions auth/auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,10 @@ func (p Permission) String() string {
// Auth interface provides mysql authentication methods and permission checking
// for users.
type Auth interface {
// Mysql returns a configured authentication method used by server.Server.
Mysql() mysql.AuthServer
// Allowed checks user's permissions with needed permission. If the user
// does not have enough permissions it returns ErrNotAuthorized.
// Otherwise is an error using the authentication method.
Allowed(user string, permission Permission) error
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe return (bool, error)?

This would allow to differentiate from not having permissions and failing to check permissions. The former would probably produce a warning audit log (when we have audit logs), the second would probably also produce a regular error log.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(bool, error) sounds to me like a fuzzy logic:
(true, nil)
(false, nil)
(false, err)

and hopefully it's not possible to have:
(true, err)

It's like returning *bool it can give you (nil, *true, *false)

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kuba-- It's a common pattern in Go, also in our own codebase. (true, err) is usually not relevant since the value would not be even checked if err != nil.

But alternatively, you can keep just err as return value and use a special error kind ErrNotAuthorized to differentiate from other errors.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@smola - totally understand, just as I mentioned, personally I don't like this pattern, because have a feeling that it's a boolean logic with extra dimension.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm moving to use go-errors and returning ErrNotAuthorized so is easier to tell apart.

Copy link
Collaborator

@smola smola Oct 25, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please, add godoc to the interface. Specially a mention to errors returned fo Allowed. My guess is that the one that is not expected to be implementation-depdendent is ErrNoAuthorized.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

}
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy