1// Copyright 2016 The etcd Authors
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7//     http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15package clientv3
16
17import (
18	"context"
19	"fmt"
20	"strings"
21
22	"go.etcd.io/etcd/auth/authpb"
23	pb "go.etcd.io/etcd/etcdserver/etcdserverpb"
24	"google.golang.org/grpc"
25)
26
27type (
28	AuthEnableResponse               pb.AuthEnableResponse
29	AuthDisableResponse              pb.AuthDisableResponse
30	AuthenticateResponse             pb.AuthenticateResponse
31	AuthUserAddResponse              pb.AuthUserAddResponse
32	AuthUserDeleteResponse           pb.AuthUserDeleteResponse
33	AuthUserChangePasswordResponse   pb.AuthUserChangePasswordResponse
34	AuthUserGrantRoleResponse        pb.AuthUserGrantRoleResponse
35	AuthUserGetResponse              pb.AuthUserGetResponse
36	AuthUserRevokeRoleResponse       pb.AuthUserRevokeRoleResponse
37	AuthRoleAddResponse              pb.AuthRoleAddResponse
38	AuthRoleGrantPermissionResponse  pb.AuthRoleGrantPermissionResponse
39	AuthRoleGetResponse              pb.AuthRoleGetResponse
40	AuthRoleRevokePermissionResponse pb.AuthRoleRevokePermissionResponse
41	AuthRoleDeleteResponse           pb.AuthRoleDeleteResponse
42	AuthUserListResponse             pb.AuthUserListResponse
43	AuthRoleListResponse             pb.AuthRoleListResponse
44
45	PermissionType authpb.Permission_Type
46	Permission     authpb.Permission
47)
48
49const (
50	PermRead      = authpb.READ
51	PermWrite     = authpb.WRITE
52	PermReadWrite = authpb.READWRITE
53)
54
55type Auth interface {
56	// AuthEnable enables auth of an etcd cluster.
57	AuthEnable(ctx context.Context) (*AuthEnableResponse, error)
58
59	// AuthDisable disables auth of an etcd cluster.
60	AuthDisable(ctx context.Context) (*AuthDisableResponse, error)
61
62	// UserAdd adds a new user to an etcd cluster.
63	UserAdd(ctx context.Context, name string, password string) (*AuthUserAddResponse, error)
64
65	// UserDelete deletes a user from an etcd cluster.
66	UserDelete(ctx context.Context, name string) (*AuthUserDeleteResponse, error)
67
68	// UserChangePassword changes a password of a user.
69	UserChangePassword(ctx context.Context, name string, password string) (*AuthUserChangePasswordResponse, error)
70
71	// UserGrantRole grants a role to a user.
72	UserGrantRole(ctx context.Context, user string, role string) (*AuthUserGrantRoleResponse, error)
73
74	// UserGet gets a detailed information of a user.
75	UserGet(ctx context.Context, name string) (*AuthUserGetResponse, error)
76
77	// UserList gets a list of all users.
78	UserList(ctx context.Context) (*AuthUserListResponse, error)
79
80	// UserRevokeRole revokes a role of a user.
81	UserRevokeRole(ctx context.Context, name string, role string) (*AuthUserRevokeRoleResponse, error)
82
83	// RoleAdd adds a new role to an etcd cluster.
84	RoleAdd(ctx context.Context, name string) (*AuthRoleAddResponse, error)
85
86	// RoleGrantPermission grants a permission to a role.
87	RoleGrantPermission(ctx context.Context, name string, key, rangeEnd string, permType PermissionType) (*AuthRoleGrantPermissionResponse, error)
88
89	// RoleGet gets a detailed information of a role.
90	RoleGet(ctx context.Context, role string) (*AuthRoleGetResponse, error)
91
92	// RoleList gets a list of all roles.
93	RoleList(ctx context.Context) (*AuthRoleListResponse, error)
94
95	// RoleRevokePermission revokes a permission from a role.
96	RoleRevokePermission(ctx context.Context, role string, key, rangeEnd string) (*AuthRoleRevokePermissionResponse, error)
97
98	// RoleDelete deletes a role.
99	RoleDelete(ctx context.Context, role string) (*AuthRoleDeleteResponse, error)
100}
101
102type authClient struct {
103	remote   pb.AuthClient
104	callOpts []grpc.CallOption
105}
106
107func NewAuth(c *Client) Auth {
108	api := &authClient{remote: RetryAuthClient(c)}
109	if c != nil {
110		api.callOpts = c.callOpts
111	}
112	return api
113}
114
115func (auth *authClient) AuthEnable(ctx context.Context) (*AuthEnableResponse, error) {
116	resp, err := auth.remote.AuthEnable(ctx, &pb.AuthEnableRequest{}, auth.callOpts...)
117	return (*AuthEnableResponse)(resp), toErr(ctx, err)
118}
119
120func (auth *authClient) AuthDisable(ctx context.Context) (*AuthDisableResponse, error) {
121	resp, err := auth.remote.AuthDisable(ctx, &pb.AuthDisableRequest{}, auth.callOpts...)
122	return (*AuthDisableResponse)(resp), toErr(ctx, err)
123}
124
125func (auth *authClient) UserAdd(ctx context.Context, name string, password string) (*AuthUserAddResponse, error) {
126	resp, err := auth.remote.UserAdd(ctx, &pb.AuthUserAddRequest{Name: name, Password: password}, auth.callOpts...)
127	return (*AuthUserAddResponse)(resp), toErr(ctx, err)
128}
129
130func (auth *authClient) UserDelete(ctx context.Context, name string) (*AuthUserDeleteResponse, error) {
131	resp, err := auth.remote.UserDelete(ctx, &pb.AuthUserDeleteRequest{Name: name}, auth.callOpts...)
132	return (*AuthUserDeleteResponse)(resp), toErr(ctx, err)
133}
134
135func (auth *authClient) UserChangePassword(ctx context.Context, name string, password string) (*AuthUserChangePasswordResponse, error) {
136	resp, err := auth.remote.UserChangePassword(ctx, &pb.AuthUserChangePasswordRequest{Name: name, Password: password}, auth.callOpts...)
137	return (*AuthUserChangePasswordResponse)(resp), toErr(ctx, err)
138}
139
140func (auth *authClient) UserGrantRole(ctx context.Context, user string, role string) (*AuthUserGrantRoleResponse, error) {
141	resp, err := auth.remote.UserGrantRole(ctx, &pb.AuthUserGrantRoleRequest{User: user, Role: role}, auth.callOpts...)
142	return (*AuthUserGrantRoleResponse)(resp), toErr(ctx, err)
143}
144
145func (auth *authClient) UserGet(ctx context.Context, name string) (*AuthUserGetResponse, error) {
146	resp, err := auth.remote.UserGet(ctx, &pb.AuthUserGetRequest{Name: name}, auth.callOpts...)
147	return (*AuthUserGetResponse)(resp), toErr(ctx, err)
148}
149
150func (auth *authClient) UserList(ctx context.Context) (*AuthUserListResponse, error) {
151	resp, err := auth.remote.UserList(ctx, &pb.AuthUserListRequest{}, auth.callOpts...)
152	return (*AuthUserListResponse)(resp), toErr(ctx, err)
153}
154
155func (auth *authClient) UserRevokeRole(ctx context.Context, name string, role string) (*AuthUserRevokeRoleResponse, error) {
156	resp, err := auth.remote.UserRevokeRole(ctx, &pb.AuthUserRevokeRoleRequest{Name: name, Role: role}, auth.callOpts...)
157	return (*AuthUserRevokeRoleResponse)(resp), toErr(ctx, err)
158}
159
160func (auth *authClient) RoleAdd(ctx context.Context, name string) (*AuthRoleAddResponse, error) {
161	resp, err := auth.remote.RoleAdd(ctx, &pb.AuthRoleAddRequest{Name: name}, auth.callOpts...)
162	return (*AuthRoleAddResponse)(resp), toErr(ctx, err)
163}
164
165func (auth *authClient) RoleGrantPermission(ctx context.Context, name string, key, rangeEnd string, permType PermissionType) (*AuthRoleGrantPermissionResponse, error) {
166	perm := &authpb.Permission{
167		Key:      []byte(key),
168		RangeEnd: []byte(rangeEnd),
169		PermType: authpb.Permission_Type(permType),
170	}
171	resp, err := auth.remote.RoleGrantPermission(ctx, &pb.AuthRoleGrantPermissionRequest{Name: name, Perm: perm}, auth.callOpts...)
172	return (*AuthRoleGrantPermissionResponse)(resp), toErr(ctx, err)
173}
174
175func (auth *authClient) RoleGet(ctx context.Context, role string) (*AuthRoleGetResponse, error) {
176	resp, err := auth.remote.RoleGet(ctx, &pb.AuthRoleGetRequest{Role: role}, auth.callOpts...)
177	return (*AuthRoleGetResponse)(resp), toErr(ctx, err)
178}
179
180func (auth *authClient) RoleList(ctx context.Context) (*AuthRoleListResponse, error) {
181	resp, err := auth.remote.RoleList(ctx, &pb.AuthRoleListRequest{}, auth.callOpts...)
182	return (*AuthRoleListResponse)(resp), toErr(ctx, err)
183}
184
185func (auth *authClient) RoleRevokePermission(ctx context.Context, role string, key, rangeEnd string) (*AuthRoleRevokePermissionResponse, error) {
186	resp, err := auth.remote.RoleRevokePermission(ctx, &pb.AuthRoleRevokePermissionRequest{Role: role, Key: []byte(key), RangeEnd: []byte(rangeEnd)}, auth.callOpts...)
187	return (*AuthRoleRevokePermissionResponse)(resp), toErr(ctx, err)
188}
189
190func (auth *authClient) RoleDelete(ctx context.Context, role string) (*AuthRoleDeleteResponse, error) {
191	resp, err := auth.remote.RoleDelete(ctx, &pb.AuthRoleDeleteRequest{Role: role}, auth.callOpts...)
192	return (*AuthRoleDeleteResponse)(resp), toErr(ctx, err)
193}
194
195func StrToPermissionType(s string) (PermissionType, error) {
196	val, ok := authpb.Permission_Type_value[strings.ToUpper(s)]
197	if ok {
198		return PermissionType(val), nil
199	}
200	return PermissionType(-1), fmt.Errorf("invalid permission type: %s", s)
201}
202
203type authenticator struct {
204	conn     *grpc.ClientConn // conn in-use
205	remote   pb.AuthClient
206	callOpts []grpc.CallOption
207}
208
209func (auth *authenticator) authenticate(ctx context.Context, name string, password string) (*AuthenticateResponse, error) {
210	resp, err := auth.remote.Authenticate(ctx, &pb.AuthenticateRequest{Name: name, Password: password}, auth.callOpts...)
211	return (*AuthenticateResponse)(resp), toErr(ctx, err)
212}
213
214func (auth *authenticator) close() {
215	auth.conn.Close()
216}
217
218func newAuthenticator(ctx context.Context, target string, opts []grpc.DialOption, c *Client) (*authenticator, error) {
219	conn, err := grpc.DialContext(ctx, target, opts...)
220	if err != nil {
221		return nil, err
222	}
223
224	api := &authenticator{
225		conn:   conn,
226		remote: pb.NewAuthClient(conn),
227	}
228	if c != nil {
229		api.callOpts = c.callOpts
230	}
231	return api, nil
232}
233