96 lines
2.5 KiB
Go
96 lines
2.5 KiB
Go
package main
|
|
|
|
import "strings"
|
|
|
|
const (
|
|
permKeycloakThemesRead = "keycloak_themes.read"
|
|
permKeycloakThemesCreate = "keycloak_themes.create"
|
|
permKeycloakThemesEdit = "keycloak_themes.edit"
|
|
permKeycloakThemesPublish = "keycloak_themes.publish"
|
|
permKeycloakThemesArchive = "keycloak_themes.archive"
|
|
permKeycloakThemesDeploy = "keycloak_themes.deploy"
|
|
permKeycloakThemesPreview = "keycloak_themes.preview"
|
|
permKeycloakThemesPolicyManage = "keycloak_themes.policy.manage"
|
|
permKeycloakThemesManagePlatformDefaults = "keycloak_themes.manage_platform_defaults"
|
|
permKeycloakThemesManageOrgOverrides = "keycloak_themes.manage_org_overrides"
|
|
)
|
|
|
|
var keycloakThemePermissionRegistry = []string{
|
|
permKeycloakThemesRead,
|
|
permKeycloakThemesCreate,
|
|
permKeycloakThemesEdit,
|
|
permKeycloakThemesPublish,
|
|
permKeycloakThemesArchive,
|
|
permKeycloakThemesDeploy,
|
|
permKeycloakThemesPreview,
|
|
permKeycloakThemesPolicyManage,
|
|
permKeycloakThemesManagePlatformDefaults,
|
|
permKeycloakThemesManageOrgOverrides,
|
|
}
|
|
|
|
var rolePermissionRegistry = map[string][]string{
|
|
"admin": {"*"},
|
|
"platform_owner": {"keycloak_themes.*"},
|
|
"platform_admin": keycloakThemePermissionRegistry,
|
|
"platform_content_reviewer": {permKeycloakThemesRead, permKeycloakThemesPreview},
|
|
"organisation_owner": {
|
|
permKeycloakThemesRead,
|
|
permKeycloakThemesEdit,
|
|
permKeycloakThemesPreview,
|
|
permKeycloakThemesManageOrgOverrides,
|
|
},
|
|
"organisation_admin": {
|
|
permKeycloakThemesRead,
|
|
permKeycloakThemesEdit,
|
|
permKeycloakThemesPreview,
|
|
},
|
|
}
|
|
|
|
func hasAnyRole(claims *accessClaims, roles ...string) bool {
|
|
for _, role := range roles {
|
|
if hasRole(claims, role) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func hasPermission(claims *accessClaims, permission string) bool {
|
|
if claims == nil {
|
|
return false
|
|
}
|
|
|
|
for _, candidate := range claims.Permissions {
|
|
if permissionMatch(candidate, permission) {
|
|
return true
|
|
}
|
|
}
|
|
|
|
for _, role := range claims.RealmAccess.Roles {
|
|
grants, ok := rolePermissionRegistry[role]
|
|
if !ok {
|
|
continue
|
|
}
|
|
for _, grant := range grants {
|
|
if permissionMatch(grant, permission) {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
func permissionMatch(grant, permission string) bool {
|
|
if grant == "*" || grant == permission {
|
|
return true
|
|
}
|
|
|
|
if strings.HasSuffix(grant, ".*") {
|
|
prefix := strings.TrimSuffix(grant, "*")
|
|
return strings.HasPrefix(permission, prefix)
|
|
}
|
|
|
|
return false
|
|
}
|