Class: Legion::Rbac::Principal

Inherits:
Object
  • Object
show all
Extended by:
Logging::Helper
Includes:
Logging::Helper
Defined in:
lib/legion/rbac/principal.rb

Constant Summary collapse

PROFILE_KEYS = 
%i[
  first_name last_name email display_name cn title
  department company country country_code city state ad_created_at
].freeze

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(id:, type: :human, roles: [], team: nil, auth_method: nil, samaccountname: nil, ad_fqdn: nil, **extra) ⇒ Principal

rubocop:disable Metrics/ParameterLists



22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'lib/legion/rbac/principal.rb', line 22

def initialize(id:, type: :human, roles: [], team: nil, auth_method: nil, # rubocop:disable Metrics/ParameterLists
               samaccountname: nil, ad_fqdn: nil, **extra)
  @id = id
  @type = type.to_sym
  @roles = roles.map(&:to_s)
  @team = team
  @auth_method = auth_method
  @samaccountname = samaccountname
  @ad_fqdn = ad_fqdn
  @profile = extra.slice(*PROFILE_KEYS).compact
  log.debug("RBAC principal initialized id=#{@id} type=#{@type} roles=#{@roles.size} team=#{@team}")
end

Instance Attribute Details

#ad_fqdn ⇒ Object (readonly)

Returns the value of attribute ad_fqdn.



15
16
17
 
# File 'lib/legion/rbac/principal.rb', line 15

def ad_fqdn
  @ad_fqdn
end

#auth_method ⇒ Object (readonly)

Returns the value of attribute auth_method.



15
16
17
 
# File 'lib/legion/rbac/principal.rb', line 15

def auth_method
  @auth_method
end

#id ⇒ Object (readonly)

Returns the value of attribute id.



15
16
17
 
# File 'lib/legion/rbac/principal.rb', line 15

def id
  @id
end

#profile ⇒ Object (readonly)

Returns the value of attribute profile.



15
16
17
 
# File 'lib/legion/rbac/principal.rb', line 15

def profile
  @profile
end

#roles ⇒ Object (readonly)

Returns the value of attribute roles.



15
16
17
 
# File 'lib/legion/rbac/principal.rb', line 15

def roles
  @roles
end

#samaccountname ⇒ Object (readonly)

Returns the value of attribute samaccountname.



15
16
17
 
# File 'lib/legion/rbac/principal.rb', line 15

def samaccountname
  @samaccountname
end

#team ⇒ Object (readonly)

Returns the value of attribute team.



15
16
17
 
# File 'lib/legion/rbac/principal.rb', line 15

def team
  @team
end

#type ⇒ Object (readonly)

Returns the value of attribute type.



15
16
17
 
# File 'lib/legion/rbac/principal.rb', line 15

def type
  @type
end

Class Method Details

.anonymous ⇒ Object 



75
76
77
78
79
80
81
82
 
# File 'lib/legion/rbac/principal.rb', line 75

def self.anonymous
  principal = new(id: 'anonymous', type: :human, roles: [])
  log.info('RBAC anonymous principal created')
  principal
rescue StandardError => e
  handle_exception(e, level: :error, operation: 'rbac.principal.anonymous')
  raise
end

.from_claims(claims) ⇒ Object 



39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
 
# File 'lib/legion/rbac/principal.rb', line 39

def self.from_claims(claims)
  scope = claims[:scope] || claims['scope']
  common = {
    roles:          claims[:roles] || claims['roles'] || [],
    team:           claims[:team] || claims['team'],
    auth_method:    claims[:auth_method] || claims['auth_method'],
    samaccountname: claims[:samaccountname] || claims['samaccountname'],
    ad_fqdn:        claims[:ad_fqdn] || claims['ad_fqdn']
  }
  PROFILE_KEYS.each { |key| common[key] = claims[key] || claims[key.to_s] }

  principal = if scope == 'worker'
                new(id: claims[:worker_id] || claims['worker_id'], type: :worker, **common)
              else
                new(id: claims[:sub] || claims['sub'], type: :human, **common)
              end
  log.info(
    "RBAC principal mapped from claims id=#{principal.id} type=#{principal.type} " \
    "roles=#{principal.roles.size} team=#{principal.team}"
  )
  principal
rescue StandardError => e
  handle_exception(e, level: :error, operation: 'rbac.principal.from_claims', scope: scope)
  raise
end

.local_admin ⇒ Object 



65
66
67
68
69
70
71
72
73
 
# File 'lib/legion/rbac/principal.rb', line 65

def self.local_admin
  role = Legion::Settings[:rbac][:default_local_role] || 'admin'
  principal = new(id: 'local', type: :human, roles: [role])
  log.info("RBAC local_admin principal created role=#{role}")
  principal
rescue StandardError => e
  handle_exception(e, level: :error, operation: 'rbac.principal.local_admin')
  raise
end