Class: Conjur::Rack::User

Inherits:
Object
  • Object
show all
Defined in:
lib/conjur/rack/user.rb

Overview

Token data can be a string (which is the user login), or a Hash. If it's a hash, it should contain the user login keyed by the string 'login'. The rest of the payload is available as attributes.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(token, account, options = {}) ⇒ User

Returns a new instance of User.



11
12
13
14
15
16
17
18
19
20
21
22
23
24
 
# File 'lib/conjur/rack/user.rb', line 11

def initialize(token, , options = {})
  @token = token
  @account = 
  # Third argument used to be the name of privilege, be
  # backwards compatible:
  if options.respond_to?(:to_str)
    @privilege = options
  else
    @privilege = options[:privilege]
    @remote_ip = options[:remote_ip]
    @audit_roles = options[:audit_roles]
    @audit_resources = options[:audit_resources]
  end
end

Instance Attribute Details

#account ⇒ Object (readonly) Also known as: conjur_account

Returns the value of attribute account.



9
10
11
 
# File 'lib/conjur/rack/user.rb', line 9

def 
  @account
end

#audit_resources ⇒ Object (readonly)

Returns the value of attribute audit_resources.



9
10
11
 
# File 'lib/conjur/rack/user.rb', line 9

def audit_resources
  @audit_resources
end

#audit_roles ⇒ Object (readonly)

Returns the value of attribute audit_roles.



9
10
11
 
# File 'lib/conjur/rack/user.rb', line 9

def audit_roles
  @audit_roles
end

#privilege ⇒ Object (readonly)

Returns the value of attribute privilege.



9
10
11
 
# File 'lib/conjur/rack/user.rb', line 9

def privilege
  @privilege
end

#remote_ip ⇒ Object (readonly)

Returns the value of attribute remote_ip.



9
10
11
 
# File 'lib/conjur/rack/user.rb', line 9

def remote_ip
  @remote_ip
end

#token ⇒ Object (readonly)

Returns the value of attribute token.



9
10
11
 
# File 'lib/conjur/rack/user.rb', line 9

def token
  @token
end

Instance Method Details

#api(cls = Conjur::API) ⇒ Object 



92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
 
# File 'lib/conjur/rack/user.rb', line 92

def api(cls = Conjur::API)
  args = [ token ]
  args.push remote_ip if remote_ip
  api = cls.new_from_token(*args)

  # These are features not present in some API versions.
  # Test for them and only apply if it makes sense. Ignore otherwise.
  %i(privilege audit_resources audit_roles).each do |feature|
    meth = "with_#{feature}".intern
    if api.respond_to?(meth) && (value = send(feature))
      api = api.send meth, value
    end
  end

  api
end

#attributes ⇒ Object 



64
65
66
67
68
 
# File 'lib/conjur/rack/user.rb', line 64

def attributes
  parse_token

  @attributes || {}
end

#global_elevate? ⇒ Boolean

True if and only if the user has valid global 'elevate' privilege.

Returns:

  • (Boolean) 


54
55
56
 
# File 'lib/conjur/rack/user.rb', line 54

def global_elevate?
  validated_global_privilege == "elevate"
end

#global_reveal? ⇒ Boolean

True if and only if the user has valid global 'reveal' privilege.

Returns:

  • (Boolean) 


49
50
51
 
# File 'lib/conjur/rack/user.rb', line 49

def global_reveal?
  validated_global_privilege == "reveal"
end

#login ⇒ Object 



58
59
60
61
62
 
# File 'lib/conjur/rack/user.rb', line 58

def 
  parse_token

  @login
end

#role ⇒ Object 



80
81
82
 
# File 'lib/conjur/rack/user.rb', line 80

def role
  api.role(roleid)
end

#roleid ⇒ Object 



70
71
72
73
74
75
76
77
78
 
# File 'lib/conjur/rack/user.rb', line 70

def roleid
  tokens = .split('/')
  role_kind, roleid = if tokens.length == 1
    [ 'user',  ]
  else
    [ tokens[0], tokens[1..-1].join('/') ]
  end
  [ , role_kind, roleid ].join(':')
end

#validated_global_privilege ⇒ Object

Returns the global privilege which was present on the request, if and only if the user actually has that privilege.

Returns nil if no global privilege was present in the request headers, or if a global privilege was present in the request headers, but the user doesn't actually have that privilege according to the Conjur server.



38
39
40
41
42
43
44
45
46
 
# File 'lib/conjur/rack/user.rb', line 38

def validated_global_privilege
  unless @validated_global_privilege
    @privilege = nil unless @privilege &&
            api.respond_to?(:global_privilege_permitted?) &&
            api.global_privilege_permitted?(@privilege)
    @validated_global_privilege = true
  end
  @privilege
end