Add block clients capability

api/api.go

@@ -98,15 +98,17 @@ func (s *Settings) Validate() error {
 }
 
 type Options struct {
- RedisClient *redis.Client
- Repository storage.TransactionalRepository
- APISettings *Settings
- OperationSettings *operations.Settings
- WSSettings *ws.Settings
- Notificator storage.Notificator
- WaitGroup *sync.WaitGroup
- TenantLabelKey string
- Agents *agents.Settings
+ RedisClient *redis.Client
+ Repository storage.TransactionalRepository
+ APISettings *Settings
+ StorageSettings *storage.Settings
+ OperationSettings *operations.Settings
+ WSSettings *ws.Settings
+ Notificator storage.Notificator
+ WaitGroup *sync.WaitGroup
+ TenantLabelKey string
+ Agents *agents.Settings
+ BlockedClientsCache *storage.Cache
 }
 
 // New returns the minimum set of REST APIs needed for the Service Manager
@@ -132,7 +134,7 @@ func New(ctx context.Context, e env.Environment, options *Options) (*web.API, er
  NewServiceInstanceController(ctx, options),
  NewServiceBindingController(ctx, options),
  apiNotifications.NewController(ctx, options.Repository, options.WSSettings, options.Notificator),
-
+ NewBlockedClientsController(ctx, options),
  NewServiceOfferingController(ctx, options),
  NewServicePlanController(ctx, options),
  NewOperationsController(ctx, options),
@@ -189,10 +191,12 @@ func New(ctx context.Context, e env.Environment, options *Options) (*web.API, er
  }
 
  api.RegisterFiltersBefore(filters.ProtectedLabelsFilterName, &filters.DisabledQueryParametersFilter{DisabledQueryParameters: options.APISettings.DisabledQueryParameters})
+ api.RegisterFiltersAfter(filters.LoggingFilterName,
+ filters.NewBlockedClientsFilter(options.BlockedClientsCache, options.TenantLabelKey))
 
  if rateLimiters != nil {
  api.RegisterFiltersAfter(
- filters.LoggingFilterName,
+ filters.BlockedClientsFilterName,
  filters.NewRateLimiterFilter(
  rateLimiters,
  options.APISettings.RateLimitExcludeClients,

api/blocked_clients_controller.go

@@ -0,0 +1,108 @@
+package api
+
+import (
+ "context"
+ "encoding/json"
+ "fmt"
+ "github.com/Peripli/service-manager/pkg/types"
+ "github.com/Peripli/service-manager/pkg/util"
+ "github.com/Peripli/service-manager/pkg/web"
+ "github.com/Peripli/service-manager/storage"
+ "net/http"
+)
+
+// BlockedClientsController configuration controller
+type BlockedClientsController struct {
+ *BaseController
+ cache *storage.Cache
+}
+
+func NewBlockedClientsController(ctx context.Context, options *Options) *BlockedClientsController {
+ return &BlockedClientsController{
+ BaseController: NewController(ctx, options, web.BlockedClientsConfigURL, types.BlockedClientsType, func() types.Object {
+ return &types.BlockedClient{}
+ }, false),
+ cache: options.BlockedClientsCache,
+ }
+
+}
+
+var AVAILABLE_METHODS map[string]byte = map[string]byte{
+ http.MethodDelete: 1,
+ http.MethodGet: 1,
+ http.MethodPut: 1,
+ http.MethodPost: 1,
+ http.MethodOptions: 1,
+ http.MethodPatch: 1,
+}
+
+func (c *BlockedClientsController) AddBlockedClient(r *web.Request) (*web.Response, error) {
+
+ var blockedClient types.BlockedClient
+ err := json.Unmarshal(r.Body, &blockedClient)
+ if err != nil {
+ return nil, &util.HTTPError{
+ ErrorType: "BlockedClientError",
+ StatusCode: http.StatusBadRequest,
+ }
+ }
+
+ if len(blockedClient.BlockedMethods) > 0 {
+ for _, method := range blockedClient.BlockedMethods {
+ if _, ok := AVAILABLE_METHODS[method]; !ok {
+ return nil, &util.HTTPError{
+ ErrorType: "BlockedClientError",
+ Description: fmt.Sprintf("Invalid value for a blocked method. Allowed methods to block are: GET, PUT, POST, PATCH, DELETE, OPTIONS."),
+ StatusCode: http.StatusBadRequest,
+ }
+ }
+ }
+ }
+ return c.CreateObject(r)
+}
+
+func (c *BlockedClientsController) ResyncBlockedClientsCache(r *web.Request) (*web.Response, error) {
+ err := c.cache.FlushL()
+ if err != nil {
+ return nil, &util.HTTPError{
+ ErrorType: "BlockedClientError",
+ Description: fmt.Sprintf("failed to resync blocked_cleints cache"),
+ StatusCode: http.StatusInternalServerError,
+ }
+ }
+ return util.NewJSONResponse(http.StatusOK, struct{}{})
+}
+
+// Routes provides endpoints for modifying and obtaining the logging configuration
+func (c *BlockedClientsController) Routes() []web.Route {
+ return []web.Route{
+ {
+ Endpoint: web.Endpoint{
+ Method: http.MethodGet,
+ Path: web.BlockedClientsConfigURL,
+ },
+ Handler: c.ListObjects,
+ },
+ {
+ Endpoint: web.Endpoint{
+ Method: http.MethodPost,
+ Path: web.BlockedClientsConfigURL,
+ },
+ Handler: c.AddBlockedClient,
+ },
+ {
+ Endpoint: web.Endpoint{
+ Method: http.MethodGet,
+ Path: web.ResyncBlockedClients,
+ },
+ Handler: c.ResyncBlockedClientsCache,
+ },
+ {
+ Endpoint: web.Endpoint{
+ Method: http.MethodDelete,
+ Path: fmt.Sprintf("%s/{%s}", web.BlockedClientsConfigURL, web.PathParamResourceID),
+ },
+ Handler: c.DeleteSingleObject,
+ },
+ }
+}

api/extensions/security/authn.go

@@ -67,6 +67,7 @@ func Register(ctx context.Context, cfg *config.Settings, smb *sm.ServiceManagerB
  web.ConfigURL+"/**",
  web.ProfileURL+"/**",
  web.OperationsURL+"/**",
+ web.BlockedClientsConfigURL+"/**",
  ).
  Method(http.MethodGet, http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete).
  WithAuthentication(bearerAuthenticator).Required()

api/filters/check_blocked_clients_filter.go

@@ -0,0 +1,96 @@
+package filters
+
+import (
+ "fmt"
+ "github.com/Peripli/service-manager/pkg/types"
+ "github.com/Peripli/service-manager/pkg/util"
+ "github.com/Peripli/service-manager/pkg/web"
+ "github.com/Peripli/service-manager/storage"
+ "net/http"
+)
+
+const BlockedClientsFilterName = "BlockedClientsFilter"
+
+type BlockedClientsFilter struct {
+ blockedClientsCache *storage.Cache
+ tenantLabelKey string
+}
+
+func NewBlockedClientsFilter(cache *storage.Cache, tenantLabelKey string) *BlockedClientsFilter {
+ b := &BlockedClientsFilter{blockedClientsCache: cache, tenantLabelKey: tenantLabelKey}
+ return b
+}
+func (b *BlockedClientsFilter) Name() string {
+ return BlockedClientsFilterName
+}
+
+func (b *BlockedClientsFilter) Run(request *web.Request, next web.Handler) (*web.Response, error) {
+ reqCtx := request.Context()
+ method := request.Method
+ userContext, ok := web.UserFromContext(reqCtx)
+ if !ok {
+ //there is no context on the endpoint
+ return next.Handle(request)
+ }
+ blockedClient, isBlockedClient := b.isClientBlocked(userContext, method)
+ if isBlockedClient {
+ errorResponse := &util.HTTPError{
+ ErrorType: "RequestNotAllowed",
+ StatusCode: http.StatusMethodNotAllowed,
+ }
+
+ errorResponse.Description = fmt.Sprintf("You're blocked to execute this request. Client: %s", blockedClient.ClientID)
+
+ return nil, errorResponse
+
+ }
+
+ return next.Handle(request)
+}
+
+func (bc *BlockedClientsFilter) isClientBlocked(userContext *web.UserContext, method string) (*types.BlockedClient, bool) {
+ //don't restrict global users
+ if userContext.AccessLevel == web.GlobalAccess || userContext.AccessLevel == web.AllTenantAccess {
+ return nil, false
+ }
+
+ if userContext.AuthenticationType == web.Basic {
+ platform := types.Platform{}
+ err := userContext.Data(&platform)
+ if err != nil {
+ return nil, false
+ }
+
+ if _, isTenantScopedPlatform := platform.Labels[bc.tenantLabelKey]; !isTenantScopedPlatform {
+ return nil, false
+ }
+
+ }
+
+ blockedClientCache, ok := bc.blockedClientsCache.GetL(userContext.Name)
+ if !ok {
+ return nil, false
+ }
+ blockedClient := blockedClientCache.(types.BlockedClient)
+ return &blockedClient, contains(blockedClient.BlockedMethods, method)
+
+}
+func contains(s []string, e string) bool {
+ for _, a := range s {
+ if a == e {
+ return true
+ }
+ }
+ return false
+}
+
+func (bc *BlockedClientsFilter) FilterMatchers() []web.FilterMatcher {
+ return []web.FilterMatcher{
+ {
+ Matchers: []web.Matcher{
+ web.Path("/**"),
+ web.Methods(http.MethodPost, http.MethodPatch, http.MethodGet, http.MethodDelete, http.MethodOptions),
+ },
+ },
+ }
+}