medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'next' into fix-require-guests-login

This commit is contained in:
James Read 2025-10-30 13:15:37 +00:00 committed by GitHub
parent 44b518a5b2 d32db6483e
commit 7abffedb14
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
8 changed files with 557 additions and 550 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

101
service/internal/acl/acl.go
View File

@ -199,61 +199,64 @@ func getHeaderKeyOrEmpty(headers http.Header, key string) string {
// UserFromContext tries to find a user from a Connect RPC context
func UserFromContext[T any](ctx context.Context, req *connect.Request[T], cfg *config.Config) *AuthenticatedUser {
var ret *AuthenticatedUser
if req != nil {
ret = &AuthenticatedUser{}
// Only trust headers if explicitly configured
if cfg.AuthHttpHeaderUsername != "" {
ret.Username = getHeaderKeyOrEmpty(req.Header(), cfg.AuthHttpHeaderUsername)
user := userFromHeaders(req, cfg)
if user.Username == "" {
user = userFromLocalSession(req, cfg, user)
}
if cfg.AuthHttpHeaderUserGroup != "" {
ret.UsergroupLine = getHeaderKeyOrEmpty(req.Header(), cfg.AuthHttpHeaderUserGroup)
}
// Optional provider header; otherwise infer below
prov := getHeaderKeyOrEmpty(req.Header(), "provider")
if prov != "" {
ret.Provider = prov
}
// If no username from headers, fall back to local session cookie
if ret.Username == "" {
// Build a minimal http.Request to parse cookies from headers
dummy := &http.Request{Header: req.Header()}
if c, err := dummy.Cookie("olivetin-sid-local"); err == nil && c != nil && c.Value != "" {
if sess := auth.GetUserSession("local", c.Value); sess != nil {
if u := cfg.FindUserByUsername(sess.Username); u != nil {
ret.Username = u.Username
ret.UsergroupLine = u.Usergroup
ret.Provider = "local"
ret.SID = c.Value
if user.Username == "" {
user = *UserGuest(cfg)
} else {
log.WithFields(log.Fields{"username": sess.Username}).Warn("UserFromContext: local session user not in config")
buildUserAcls(cfg, &user)
}
} else {
log.WithFields(log.Fields{"sid": c.Value, "provider": "local"}).Warn("UserFromContext: stale local session")
}
}
}
if ret.Username != "" {
buildUserAcls(cfg, ret)
}
}
if ret == nil || ret.Username == "" {
ret = UserGuest(cfg)
}
log.WithFields(log.Fields{
"username": ret.Username,
"usergroupLine": ret.UsergroupLine,
"provider": ret.Provider,
"acls": ret.Acls,
"username": user.Username,
"usergroupLine": user.UsergroupLine,
"provider": user.Provider,
"acls": user.Acls,
}).Debugf("UserFromContext")
return &user
}
return ret
func userFromHeaders[T any](req *connect.Request[T], cfg *config.Config) AuthenticatedUser {
var u AuthenticatedUser
if req == nil {
return u
}
if cfg.AuthHttpHeaderUsername != "" {
u.Username = getHeaderKeyOrEmpty(req.Header(), cfg.AuthHttpHeaderUsername)
}
if cfg.AuthHttpHeaderUserGroup != "" {
u.UsergroupLine = getHeaderKeyOrEmpty(req.Header(), cfg.AuthHttpHeaderUserGroup)
}
if prov := getHeaderKeyOrEmpty(req.Header(), "provider"); prov != "" {
u.Provider = prov
}
return u
}
func userFromLocalSession[T any](req *connect.Request[T], cfg *config.Config, u AuthenticatedUser) AuthenticatedUser {
if req == nil || u.Username != "" {
return u
}
dummy := &http.Request{Header: req.Header()}
c, err := dummy.Cookie("olivetin-sid-local")
if err != nil || c == nil || c.Value == "" {
return u
}
sess := auth.GetUserSession("local", c.Value)
if sess == nil {
log.WithFields(log.Fields{"sid": c.Value, "provider": "local"}).Warn("UserFromContext: stale local session")
return u
}
if cfgUser := cfg.FindUserByUsername(sess.Username); cfgUser != nil {
u.Username = cfgUser.Username
u.UsergroupLine = cfgUser.Usergroup
u.Provider = "local"
u.SID = c.Value
return u
}
log.WithFields(log.Fields{"username": sess.Username}).Warn("UserFromContext: local session user not in config")
return u
}
func UserGuest(cfg *config.Config) *AuthenticatedUser {

127
service/internal/api/api.go
View File

@ -453,29 +453,12 @@ func (api *oliveTinAPI) GetLogs(ctx ctx.Context, req *connect.Request[apiv1.GetL
}
ret := &apiv1.GetLogsResponse{}
logEntries, pagingResult := api.executor.GetLogTrackingIds(req.Msg.StartOffset, api.cfg.LogHistoryPageSize)
for _, logEntry := range logEntries {
// Skip if binding is nil or action is nil
if logEntry.Binding == nil || logEntry.Binding.Action == nil {
continue
}
action := logEntry.Binding.Action
if acl.IsAllowedLogs(api.cfg, user, action) {
pbLogEntry := api.internalLogEntryToPb(logEntry, user)
ret.Logs = append(ret.Logs, pbLogEntry)
}
}
ret.CountRemaining = pagingResult.CountRemaining
ret.PageSize = pagingResult.PageSize
ret.TotalCount = pagingResult.TotalCount
ret.StartOffset = pagingResult.StartOffset
logEntries, paging := api.executor.GetLogTrackingIds(req.Msg.StartOffset, api.cfg.LogHistoryPageSize)
ret.Logs = api.pbLogsFiltered(logEntries, user)
ret.CountRemaining = paging.CountRemaining
ret.PageSize = paging.PageSize
ret.TotalCount = paging.TotalCount
ret.StartOffset = paging.StartOffset
return connect.NewResponse(ret), nil
}
@ -487,65 +470,71 @@ func (api *oliveTinAPI) GetActionLogs(ctx ctx.Context, req *connect.Request[apiv
}
ret := &apiv1.GetActionLogsResponse{}
filtered := api.filterLogsByACL(api.executor.GetLogsByActionId(req.Msg.ActionId), user)
page := paginate(int64(len(filtered)), api.cfg.LogHistoryPageSize, req.Msg.StartOffset)
if page.empty {
ret.CountRemaining = 0
ret.PageSize = page.size
ret.TotalCount = page.total
ret.StartOffset = page.start
return connect.NewResponse(ret), nil
}
for _, le := range filtered[page.start:page.end] {
ret.Logs = append(ret.Logs, api.internalLogEntryToPb(le, user))
}
ret.CountRemaining = page.total - page.end
ret.PageSize = page.size
ret.TotalCount = page.total
ret.StartOffset = page.start
return connect.NewResponse(ret), nil
}
logs := api.executor.GetLogsByActionId(req.Msg.ActionId)
// Apply ACL filtering
filteredLogs := make([]*executor.InternalLogEntry, 0)
for _, logEntry := range logs {
// Skip if binding is nil or action is nil
if logEntry.Binding == nil || logEntry.Binding.Action == nil {
func (api *oliveTinAPI) pbLogsFiltered(entries []*executor.InternalLogEntry, user *acl.AuthenticatedUser) []*apiv1.LogEntry {
out := make([]*apiv1.LogEntry, 0, len(entries))
for _, e := range entries {
if e == nil || e.Binding == nil || e.Binding.Action == nil {
continue
}
action := logEntry.Binding.Action
if acl.IsAllowedLogs(api.cfg, user, action) {
filteredLogs = append(filteredLogs, logEntry)
if acl.IsAllowedLogs(api.cfg, user, e.Binding.Action) {
out = append(out, api.internalLogEntryToPb(e, user))
}
}
// Pagination
totalCount := int64(len(filteredLogs))
pageSize := api.cfg.LogHistoryPageSize
startOffset := req.Msg.StartOffset
// Validate and clamp offset to prevent out-of-bounds access
if startOffset < 0 {
startOffset = 0
return out
}
// If offset is beyond available data, return empty result with correct metadata
if startOffset >= totalCount {
ret.CountRemaining = 0
ret.PageSize = pageSize
ret.TotalCount = totalCount
ret.StartOffset = startOffset
return connect.NewResponse(ret), nil
func (api *oliveTinAPI) filterLogsByACL(entries []*executor.InternalLogEntry, user *acl.AuthenticatedUser) []*executor.InternalLogEntry {
filtered := make([]*executor.InternalLogEntry, 0, len(entries))
for _, e := range entries {
if e == nil || e.Binding == nil || e.Binding.Action == nil {
continue
}
if acl.IsAllowedLogs(api.cfg, user, e.Binding.Action) {
filtered = append(filtered, e)
}
}
return filtered
}
startIdx := startOffset
endIdx := startOffset + pageSize
if endIdx > totalCount {
endIdx = totalCount
type pageInfo struct {
total int64
size int64
start int64
end int64
empty bool
}
logEntries := filteredLogs[startIdx:endIdx]
countRemaining := totalCount - endIdx
if countRemaining < 0 {
countRemaining = 0
func paginate(total int64, size int64, start int64) pageInfo {
if start < 0 {
start = 0
}
for _, logEntry := range logEntries {
pbLogEntry := api.internalLogEntryToPb(logEntry, user)
ret.Logs = append(ret.Logs, pbLogEntry)
if start >= total {
return pageInfo{total: total, size: size, start: start, end: start, empty: true}
}
ret.CountRemaining = countRemaining
ret.PageSize = pageSize
ret.TotalCount = totalCount
ret.StartOffset = startOffset
return connect.NewResponse(ret), nil
end := start + size
if end > total {
end = total
}
return pageInfo{total: total, size: size, start: start, end: end, empty: false}
}
/*

24
service/internal/auth/sessions.go
View File

@ -88,26 +88,32 @@ func LoadUserSessions(cfg *config.Config) {
data, err := os.ReadFile(cfg.GetDir() + "/sessions.yaml")
if err != nil {
logrus.WithError(err).Warn("Failed to read sessions.yaml file")
// Always reset in-memory sessions on load error
sessionStorage = &SessionStorage{Providers: make(map[string]*SessionProvider)}
ensureEmptySessionStorage()
return
}
err = yaml.Unmarshal(data, &sessionStorage)
if err != nil {
if err := yaml.Unmarshal(data, &sessionStorage); err != nil {
logrus.WithError(err).Error("Failed to unmarshal sessions.yaml")
// Always reset in-memory sessions on parse error
sessionStorage = &SessionStorage{Providers: make(map[string]*SessionProvider)}
ensureEmptySessionStorage()
return
}
// Ensure sessionStorage and Providers are properly initialized
ensureSessionStorageInitialized()
}
func ensureEmptySessionStorage() {
if sessionStorage == nil {
sessionStorage = &SessionStorage{
Providers: make(map[string]*SessionProvider),
sessionStorage = &SessionStorage{Providers: make(map[string]*SessionProvider)}
}
if sessionStorage.Providers == nil {
sessionStorage.Providers = make(map[string]*SessionProvider)
}
}
func ensureSessionStorageInitialized() {
if sessionStorage == nil {
sessionStorage = &SessionStorage{Providers: make(map[string]*SessionProvider)}
}
if sessionStorage.Providers == nil {
sessionStorage.Providers = make(map[string]*SessionProvider)
}

165
service/internal/config/config_reloader.go
View File

@ -48,16 +48,36 @@ func AppendSourceWithIncludes(cfg *Config, k *koanf.Koanf, configPath string) {
func AppendSource(cfg *Config, k *koanf.Koanf, configPath string) {
log.Infof("Appending cfg source: %s", configPath)
// Unmarshal config - koanf will handle mapstructure tags automatically
err := k.Unmarshal(".", cfg)
if err != nil {
log.Errorf("Error unmarshalling config: %v", err)
if !unmarshalRoot(k, cfg) {
return
}
// Fallback for complex nested structures that might not unmarshal correctly
// Only attempt manual unmarshaling if the automatic approach didn't populate the fields
if len(cfg.Actions) == 0 && k.Exists("actions") {
loadCollectionsFallbacks(k, cfg)
applyConfigOverrides(k, cfg)
afterLoadFinalize(cfg, configPath)
}
func unmarshalRoot(k *koanf.Koanf, cfg *Config) bool {
if err := k.Unmarshal(".", cfg); err != nil {
log.Errorf("Error unmarshalling config: %v", err)
return false
}
return true
}
func loadCollectionsFallbacks(k *koanf.Koanf, cfg *Config) {
maybeUnmarshalActions(k, cfg)
maybeUnmarshalDashboards(k, cfg)
maybeUnmarshalEntities(k, cfg)
maybeUnmarshalAuthLocalUsers(k, cfg)
}
func maybeUnmarshalActions(k *koanf.Koanf, cfg *Config) {
if len(cfg.Actions) != 0 || !k.Exists("actions") {
return
}
var actions []*Action
if err := k.Unmarshal("actions", &actions); err == nil {
cfg.Actions = actions
@ -65,7 +85,10 @@ func AppendSource(cfg *Config, k *koanf.Koanf, configPath string) {
}
}
if len(cfg.Dashboards) == 0 && k.Exists("dashboards") {
func maybeUnmarshalDashboards(k *koanf.Koanf, cfg *Config) {
if len(cfg.Dashboards) != 0 || !k.Exists("dashboards") {
return
}
var dashboards []*DashboardComponent
if err := k.Unmarshal("dashboards", &dashboards); err == nil {
cfg.Dashboards = dashboards
@ -73,7 +96,10 @@ func AppendSource(cfg *Config, k *koanf.Koanf, configPath string) {
}
}
if len(cfg.Entities) == 0 && k.Exists("entities") {
func maybeUnmarshalEntities(k *koanf.Koanf, cfg *Config) {
if len(cfg.Entities) != 0 || !k.Exists("entities") {
return
}
var entities []*EntityFile
if err := k.Unmarshal("entities", &entities); err == nil {
cfg.Entities = entities
@ -81,7 +107,10 @@ func AppendSource(cfg *Config, k *koanf.Koanf, configPath string) {
}
}
if len(cfg.AuthLocalUsers.Users) == 0 && k.Exists("authLocalUsers") {
func maybeUnmarshalAuthLocalUsers(k *koanf.Koanf, cfg *Config) {
if len(cfg.AuthLocalUsers.Users) != 0 || !k.Exists("authLocalUsers") {
return
}
var authLocalUsers AuthLocalUsersConfig
if err := k.Unmarshal("authLocalUsers", &authLocalUsers); err == nil {
cfg.AuthLocalUsers = authLocalUsers
@ -89,18 +118,7 @@ func AppendSource(cfg *Config, k *koanf.Koanf, configPath string) {
}
}
if len(cfg.AccessControlLists) == 0 && k.Exists("accessControlLists") {
var acls []*AccessControlList
if err := k.Unmarshal("accessControlLists", &acls); err == nil {
cfg.AccessControlLists = acls
log.Debugf("Manually loaded %d access control lists", len(acls))
}
}
// Map structure tags should handle these automatically, but we keep fallbacks
// for fields that might not unmarshal correctly
applyConfigOverrides(k, cfg)
func afterLoadFinalize(cfg *Config, configPath string) {
metricConfigReloadedCount.Inc()
metricConfigActionCount.Set(float64(len(cfg.Actions)))
@ -143,67 +161,70 @@ func LoadIncludedConfigs(cfg *Config, k *koanf.Koanf, baseConfigPath string) {
return
}
configDir := filepath.Dir(baseConfigPath)
includePath := filepath.Join(configDir, cfg.Include)
includePath := filepath.Join(filepath.Dir(baseConfigPath), cfg.Include)
log.Infof("Loading included configs from: %s", includePath)
// Check if the include directory exists
yamlFiles, ok := listYamlFiles(includePath)
if !ok || len(yamlFiles) == 0 {
return
}
sort.Strings(yamlFiles)
for _, filename := range yamlFiles {
loadAndMergeIncludedFile(cfg, includePath, filename)
}
log.Infof("Finished loading %d included config file(s)", len(yamlFiles))
cfg.Sanitize()
}
func listYamlFiles(includePath string) ([]string, bool) {
dirInfo, err := os.Stat(includePath)
if err != nil {
log.Warnf("Include directory not found: %s", includePath)
return
return nil, false
}
if !dirInfo.IsDir() {
log.Warnf("Include path is not a directory: %s", includePath)
return
return nil, false
}
// Read all .yml files from the directory
entries, err := os.ReadDir(includePath)
if err != nil {
log.Errorf("Error reading include directory: %v", err)
return
return nil, false
}
// Filter and sort .yml files
var yamlFiles []string
for _, entry := range entries {
if !entry.IsDir() && (strings.HasSuffix(entry.Name(), ".yml") || strings.HasSuffix(entry.Name(), ".yaml")) {
yamlFiles = append(yamlFiles, entry.Name())
if entry.IsDir() {
continue
}
name := entry.Name()
if strings.HasSuffix(name, ".yml") || strings.HasSuffix(name, ".yaml") {
yamlFiles = append(yamlFiles, name)
}
}
if len(yamlFiles) == 0 {
log.Infof("No YAML files found in include directory: %s", includePath)
return
}
return yamlFiles, true
}
// Sort files to ensure deterministic load order
sort.Strings(yamlFiles)
// Load each file and merge into config
for _, filename := range yamlFiles {
func loadAndMergeIncludedFile(cfg *Config, includePath, filename string) {
filePath := filepath.Join(includePath, filename)
log.Infof("Loading included config file: %s", filePath)
includeK := koanf.New(".")
f := file.Provider(filePath)
if err := includeK.Load(f, yaml.Parser()); err != nil {
if err := includeK.Load(file.Provider(filePath), yaml.Parser()); err != nil {
log.Errorf("Error loading included config file %s: %v", filePath, err)
continue
return
}
// Unmarshal into a temporary config to process properly
tempCfg := &Config{}
if err := includeK.Unmarshal(".", tempCfg); err != nil {
log.Errorf("Error unmarshalling included config file %s: %v", filePath, err)
continue
return
}
// Apply the same manual loading workarounds as in AppendSource
// Fallbacks similar to AppendSource
if len(tempCfg.Actions) == 0 && includeK.Exists("actions") {
var actions []*Action
if err := includeK.Unmarshal("actions", &actions); err == nil {
@ -212,59 +233,46 @@ func LoadIncludedConfigs(cfg *Config, k *koanf.Koanf, baseConfigPath string) {
}
}
// Merge the temp config into the main config
// Later files override earlier ones
mergeConfig(cfg, tempCfg)
log.Infof("Successfully loaded and merged %s", filename)
}
log.Infof("Finished loading %d included config file(s)", len(yamlFiles))
// Sanitize the merged config
cfg.Sanitize()
func mergeConfig(base *Config, overlay *Config) {
mergeSlices(base, overlay)
overrideSimple(base, overlay)
overrideNested(base, overlay)
overrideStrings(base, overlay)
}
func mergeConfig(base *Config, overlay *Config) {
// Merge Actions - overlay appends to base
func mergeSlices(base *Config, overlay *Config) {
if len(overlay.Actions) > 0 {
base.Actions = append(base.Actions, overlay.Actions...)
}
// Merge Dashboards - overlay appends to base
if len(overlay.Dashboards) > 0 {
base.Dashboards = append(base.Dashboards, overlay.Dashboards...)
log.Debugf("Merged %d dashboards from include", len(overlay.Dashboards))
}
// Merge Entities - overlay appends to base
if len(overlay.Entities) > 0 {
base.Entities = append(base.Entities, overlay.Entities...)
log.Debugf("Merged %d entities from include", len(overlay.Entities))
}
// Merge AccessControlLists - overlay appends to base
if len(overlay.AccessControlLists) > 0 {
base.AccessControlLists = append(base.AccessControlLists, overlay.AccessControlLists...)
log.Debugf("Merged %d access control lists from include", len(overlay.AccessControlLists))
}
// Merge AuthLocalUsers.Users - overlay appends to base
if len(overlay.AuthLocalUsers.Users) > 0 {
base.AuthLocalUsers.Users = append(base.AuthLocalUsers.Users, overlay.AuthLocalUsers.Users...)
log.Debugf("Merged %d local users from include", len(overlay.AuthLocalUsers.Users))
}
// Merge slices by appending
if len(overlay.StyleMods) > 0 {
base.StyleMods = append(base.StyleMods, overlay.StyleMods...)
}
if len(overlay.AdditionalNavigationLinks) > 0 {
base.AdditionalNavigationLinks = append(base.AdditionalNavigationLinks, overlay.AdditionalNavigationLinks...)
}
}
// Override simple fields (later files win)
func overrideSimple(base *Config, overlay *Config) {
if overlay.LogLevel != "" {
base.LogLevel = overlay.LogLevel
}
@ -286,28 +294,27 @@ func mergeConfig(base *Config, overlay *Config) {
if overlay.AuthRequireGuestsToLogin != base.AuthRequireGuestsToLogin {
base.AuthRequireGuestsToLogin = overlay.AuthRequireGuestsToLogin
}
if overlay.AuthLocalUsers.Enabled {
base.AuthLocalUsers.Enabled = overlay.AuthLocalUsers.Enabled
}
}
// Override nested structs
func overrideNested(base *Config, overlay *Config) {
if overlay.DefaultPolicy.ShowDiagnostics != base.DefaultPolicy.ShowDiagnostics {
base.DefaultPolicy.ShowDiagnostics = overlay.DefaultPolicy.ShowDiagnostics
}
if overlay.DefaultPolicy.ShowLogList != base.DefaultPolicy.ShowLogList {
base.DefaultPolicy.ShowLogList = overlay.DefaultPolicy.ShowLogList
}
if overlay.Prometheus.Enabled != base.Prometheus.Enabled {
base.Prometheus.Enabled = overlay.Prometheus.Enabled
}
if overlay.Prometheus.DefaultGoMetrics != base.Prometheus.DefaultGoMetrics {
base.Prometheus.DefaultGoMetrics = overlay.Prometheus.DefaultGoMetrics
}
// Override AuthLocalUsers.Enabled if set
if overlay.AuthLocalUsers.Enabled {
base.AuthLocalUsers.Enabled = overlay.AuthLocalUsers.Enabled
}
// Override string fields if non-empty
func overrideStrings(base *Config, overlay *Config) {
overrideString(&base.BannerMessage, overlay.BannerMessage)
overrideString(&base.BannerCSS, overlay.BannerCSS)
overrideString(&base.LogLevel, overlay.LogLevel)

54
service/internal/config/config_reloader_test.go
View File

@ -92,34 +92,48 @@ var envConfigTests = []struct {
func TestEnvInConfig(t *testing.T) {
for _, tt := range envConfigTests {
cfg := DefaultConfig()
if tt.input != "" {
os.Setenv("INPUT", tt.input)
setIfNotEmpty("INPUT", tt.input)
processed := processYamlWithEnv(tt.yaml)
k, err := loadKoanf(processed)
if err != nil {
t.Errorf("Error loading YAML: %v", err)
continue
}
if err := k.Unmarshal(".", cfg); err != nil {
t.Errorf("Error unmarshalling config: %v", err)
continue
}
manualAssigns(k, cfg)
field := tt.selector(cfg)
assert.Equal(t, tt.output, field, "Unmarshaled config field doesn't match expected value: env=\"%s\"", tt.input)
os.Unsetenv("INPUT")
}
}
// Process the YAML content to replace environment variables
processedYaml := envRegex.ReplaceAllStringFunc(tt.yaml, func(match string) string {
func setIfNotEmpty(key, val string) {
if val != "" {
os.Setenv(key, val)
}
}
func processYamlWithEnv(content string) string {
return envRegex.ReplaceAllStringFunc(content, func(match string) string {
submatches := envRegex.FindStringSubmatch(match)
key := submatches[1]
val, _ := os.LookupEnv(key)
return val
})
}
func loadKoanf(processed string) (*koanf.Koanf, error) {
k := koanf.New(".")
err := k.Load(rawbytes.Provider([]byte(processedYaml)), yaml.Parser())
if err != nil {
t.Errorf("Error loading YAML: %v", err)
continue
if err := k.Load(rawbytes.Provider([]byte(processed)), yaml.Parser()); err != nil {
return nil, err
}
return k, nil
}
// Try default unmarshaling
err = k.Unmarshal(".", cfg)
if err != nil {
t.Errorf("Error unmarshalling config: %v", err)
continue
}
// Manual field assignment for testing (since default unmarshaling has issues with field mapping)
func manualAssigns(k *koanf.Koanf, cfg *Config) {
if k.Exists("PageTitle") {
cfg.PageTitle = k.String("PageTitle")
}
@ -135,10 +149,4 @@ func TestEnvInConfig(t *testing.T) {
cfg.Actions = actions
}
}
field := tt.selector(cfg)
assert.Equal(t, tt.output, field, "Unmarshaled config field doesn't match expected value: env=\"%s\"", tt.input)
os.Unsetenv("INPUT")
}
}

39
service/internal/entities/entities.go
View File

@ -30,36 +30,33 @@ func AddListener(l func()) {
}
func SetupEntityFileWatchers(cfg *config.Config) {
configDir := cfg.GetDir()
baseDir := resolveEntitiesBaseDir(cfg.GetDir())
for i := range cfg.Entities { // #337 - iterate by key, not by value
ef := cfg.Entities[i]
watchAndLoadEntity(baseDir, ef)
}
}
// Only use var directory if not in integration test mode
func resolveEntitiesBaseDir(configDir string) string {
absConfigDir, _ := filepath.Abs(configDir)
if !strings.Contains(absConfigDir, "integration-tests") {
configDirVar := filepath.Join(configDir, "var") // for development purposes
if _, err := os.Stat(configDirVar); err == nil {
configDir = configDirVar
if strings.Contains(absConfigDir, "integration-tests") {
return configDir
}
devVar := filepath.Join(configDir, "var")
if _, err := os.Stat(devVar); err == nil {
return devVar
}
return configDir
}
for entityIndex := range cfg.Entities { // #337 - iterate by key, not by value
ef := cfg.Entities[entityIndex]
func watchAndLoadEntity(baseDir string, ef *config.EntityFile) {
p := ef.File
if !filepath.IsAbs(p) {
p = filepath.Join(configDir, p)
log.WithFields(log.Fields{
"entityFile": p,
}).Debugf("Adding config dir to entity file path")
p = filepath.Join(baseDir, p)
log.WithFields(log.Fields{"entityFile": p}).Debugf("Adding config dir to entity file path")
}
go filehelper.WatchFileWrite(p, func(filename string) {
go filehelper.WatchFileWrite(p, func(filename string) { loadEntityFile(p, ef.Name) })
loadEntityFile(p, ef.Name)
})
loadEntityFile(p, ef.Name)
}
}
func loadEntityFile(filename string, entityname string) {

65
service/internal/executor/arguments.go
View File

@ -46,42 +46,34 @@ func parseActionExec(values map[string]string, action *config.Action, entity *en
if action == nil {
return nil, fmt.Errorf("action is nil")
}
if err := validateArguments(values, action); err != nil {
return nil, err
}
parsed := make([]string, len(action.Exec))
for i, a := range action.Exec {
arg, err := parseCommandForReplacements(a, values, entity)
if err != nil {
return nil, err
}
parsed[i] = entities.ParseTemplateWithArgs(arg, entity, values)
}
logParsedExec(action, parsed, values)
return parsed, nil
}
func validateArguments(values map[string]string, action *config.Action) error {
for _, arg := range action.Arguments {
argName := arg.Name
argValue := values[argName]
err := typecheckActionArgument(&arg, argValue, action)
if err != nil {
return nil, err
if err := typecheckActionArgument(&arg, values[arg.Name], action); err != nil {
return err
}
log.WithFields(log.Fields{"name": arg.Name, "value": values[arg.Name]}).Debugf("Arg assigned")
}
return nil
}
log.WithFields(log.Fields{
"name": argName,
"value": argValue,
}).Debugf("Arg assigned")
}
parsedArgs := make([]string, len(action.Exec))
for i, arg := range action.Exec {
parsedArg, err := parseCommandForReplacements(arg, values, entity)
if err != nil {
return nil, err
}
parsedArg = entities.ParseTemplateWithArgs(parsedArg, entity, values)
parsedArgs[i] = parsedArg
}
redactedArgs := redactExecArgs(parsedArgs, action.Arguments, values)
log.WithFields(log.Fields{
"actionTitle": action.Title,
"cmd": redactedArgs,
}).Infof("Action parse args - After (Exec)")
return parsedArgs, nil
func logParsedExec(action *config.Action, parsed []string, values map[string]string) {
redacted := redactExecArgs(parsed, action.Arguments, values)
log.WithFields(log.Fields{"actionTitle": action.Title, "cmd": redacted}).Infof("Action parse args - After (Exec)")
}
func parseActionArguments(values map[string]string, action *config.Action, entity *entities.Entity) (string, error) {
@ -298,17 +290,12 @@ func checkShellArgumentSafety(action *config.Action) error {
if action.Shell == "" {
return nil
}
unsafeTypes := []string{"url", "email", "raw_string_multiline", "very_dangerous_raw_string"}
unsafe := map[string]struct{}{"url": {}, "email": {}, "raw_string_multiline": {}, "very_dangerous_raw_string": {}}
for _, arg := range action.Arguments {
for _, unsafeType := range unsafeTypes {
if arg.Type == unsafeType {
if _, bad := unsafe[arg.Type]; bad {
return fmt.Errorf("unsafe argument type '%s' cannot be used with Shell execution. Use 'exec' instead. See https://docs.olivetin.app/action_execution/shellvsexec.html", arg.Type)
}
}
}
return nil
}

108
service/internal/executor/executor.go
View File

@ -427,52 +427,65 @@ func stepACLCheck(req *ExecutionRequest) bool {
}
func stepParseArgs(req *ExecutionRequest) bool {
var err error
ensureArgumentMap(req)
injectSystemArgs(req)
if !hasBindingAndAction(req) {
return fail(req, fmt.Errorf("cannot parse arguments: Binding or Action is nil"))
}
mangleInvalidArgumentValues(req)
if hasExec(req) {
return parseExec(req)
}
if err := checkShellArgumentSafety(req.Binding.Action); err != nil {
return fail(req, err)
}
cmd, err := parseActionArguments(req.Arguments, req.Binding.Action, req.Binding.Entity)
if err != nil {
return fail(req, err)
}
req.useDirectExec = false
req.finalParsedCommand = cmd
return true
}
func ensureArgumentMap(req *ExecutionRequest) {
if req.Arguments == nil {
req.Arguments = make(map[string]string)
}
}
func injectSystemArgs(req *ExecutionRequest) {
req.Arguments["ot_executionTrackingId"] = req.TrackingID
req.Arguments["ot_username"] = req.AuthenticatedUser.Username
if req.Binding == nil || req.Binding.Action == nil {
err = fmt.Errorf("cannot parse arguments: Binding or Action is nil")
req.logEntry.Output = err.Error()
log.Warn(err.Error())
return false
}
// Only mangle arguments when we have a valid binding/action
mangleInvalidArgumentValues(req)
func hasBindingAndAction(req *ExecutionRequest) bool {
return !(req.Binding == nil || req.Binding.Action == nil)
}
if len(req.Binding.Action.Exec) > 0 {
func hasExec(req *ExecutionRequest) bool {
return len(req.Binding.Action.Exec) > 0
}
func parseExec(req *ExecutionRequest) bool {
req.useDirectExec = true
req.execArgs, err = parseActionExec(req.Arguments, req.Binding.Action, req.Binding.Entity)
} else {
req.useDirectExec = false
err = checkShellArgumentSafety(req.Binding.Action)
args, err := parseActionExec(req.Arguments, req.Binding.Action, req.Binding.Entity)
if err != nil {
req.logEntry.Output = err.Error()
log.Warn(err.Error())
return false
return fail(req, err)
}
req.finalParsedCommand, err = parseActionArguments(req.Arguments, req.Binding.Action, req.Binding.Entity)
}
if err != nil {
req.logEntry.Output = err.Error()
log.Warn(err.Error())
return false
}
req.execArgs = args
return true
}
func fail(req *ExecutionRequest, err error) bool {
req.logEntry.Output = err.Error()
log.Warn(err.Error())
return false
}
func stepRequestAction(req *ExecutionRequest) bool {
metricActionsRequested.Inc()
@ -587,34 +600,17 @@ func buildEnv(args map[string]string) []string {
func stepExec(req *ExecutionRequest) bool {
ctx, cancel := context.WithTimeout(context.Background(), time.Duration(req.Binding.Action.Timeout)*time.Second)
defer cancel()
streamer := &OutputStreamer{Req: req}
var cmd *exec.Cmd
if req.useDirectExec {
cmd = wrapCommandDirect(ctx, req.execArgs)
} else {
cmd = wrapCommandInShell(ctx, req.finalParsedCommand)
}
cmd := buildCommand(ctx, req)
if cmd == nil {
req.logEntry.Output = "Cannot execute: no command arguments provided"
log.Warn("Cannot execute: no command arguments provided")
return false
}
cmd.Stdout = streamer
cmd.Stderr = streamer
cmd.Env = buildEnv(req.Arguments)
req.logEntry.ExecutionStarted = true
prepareCommand(cmd, streamer, req)
runerr := cmd.Start()
req.logEntry.Process = cmd.Process
waiterr := cmd.Wait()
req.logEntry.ExitCode = int32(cmd.ProcessState.ExitCode())
req.logEntry.Output = streamer.String()
@ -644,6 +640,20 @@ func stepExec(req *ExecutionRequest) bool {
return true
}
func buildCommand(ctx context.Context, req *ExecutionRequest) *exec.Cmd {
if req.useDirectExec {
return wrapCommandDirect(ctx, req.execArgs)
}
return wrapCommandInShell(ctx, req.finalParsedCommand)
}
func prepareCommand(cmd *exec.Cmd, streamer *OutputStreamer, req *ExecutionRequest) {
cmd.Stdout = streamer
cmd.Stderr = streamer
cmd.Env = buildEnv(req.Arguments)
req.logEntry.ExecutionStarted = true
}
func stepExecAfter(req *ExecutionRequest) bool {
if req.Binding.Action.ShellAfterCompleted == "" {
return true