ExternalVendorCode/onefuzz
1
0
Fork 0
mirror of https://github.com/microsoft/onefuzz.git synced 2025-06-16 11:58:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adding Admin Checks to Node Operations. (#1779)

Browse Source 
* Adding Admin Checks to Node Operations.

* Importing function.

* Changing naming convention.

* Fixing webhook events.

* Adding changes to scaleset init.
This commit is contained in:
Noah McGregor Harper
2022-04-27 11:31:43 -07:00
committed by GitHub
parent 0b1c7aea9c
commit 44059f20ca
7 changed files with 51 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/api-service/__app__/onefuzzlib/endpoint_authorization.py
View File

@ -110,10 +110,10 @@ def can_modify_config(req: func.HttpRequest, config: InstanceConfig) -> bool:
return can_modify_config_impl(config, user_info)
def check_can_manage_pools_impl(
def check_require_admins_impl(
config: InstanceConfig, user_info: UserInfo
) -> Optional[Error]:
if config.allow_pool_management:
if config.require_admin_privileges:
return None
if config.admins is None:
@ -125,25 +125,25 @@ def check_can_manage_pools_impl(
return Error(code=ErrorCode.UNAUTHORIZED, errors=["not authorized to manage pools"])
def check_can_manage_pools(req: func.HttpRequest) -> Optional[Error]:
def check_require_admins(req: func.HttpRequest) -> Optional[Error]:
user_info = parse_jwt_token(req)
if isinstance(user_info, Error):
return user_info
# When there are no admins in the `admins` list, all users are considered
# admins. However, `allow_pool_management` is still useful to protect from
# admins. However, `require_admin_privileges` is still useful to protect from
# mistakes.
#
# To make changes while still protecting against accidental changes to
# pools, do the following:
#
# 1. set `allow_pool_management` to `True`
# 1. set `require_admin_privileges` to `True`
# 2. make the change
# 3. set `allow_pool_management` to `False`
# 3. set `require_admin_privileges` to `False`
config = InstanceConfig.fetch()
return check_can_manage_pools_impl(config, user_info)
return check_require_admins_impl(config, user_info)
def is_user(token_data: UserInfo) -> bool: