wip: add auth

ZEISS · Jul 25, 2024 · 64b11e8 · 64b11e8
1 parent 588acc9
commit 64b11e8
Show file tree

Hide file tree

Showing 18 changed files with 1,370 additions and 1,695 deletions.
diff --git a/.env.example b/.env.example
@@ -1,5 +1,6 @@
+export KNOX_DATABASE_URI=
 export KNOX_FGA_API_URL=
 export KNOX_FGA_STORE_ID=
 export KNOX_FGA_AUTHORIZATION_MODEL_ID=
 export KNOX_OIDC_ISSUER=
-export KNOX_OIDC_AUDIENCE=
+export KNOX_OIDC_AUDIENCE=
diff --git a/api/api.yml b/api/api.yml
@@ -171,7 +171,6 @@ paths:
         - $ref: "#/components/parameters/teamId"
         - $ref: "#/components/parameters/projectId"
         - $ref: "#/components/parameters/environmentId"
-        - $ref: "#/components/parameters/lockId"
       security:
         - BasicAuth: [] # Use basic auth to update the environment state
       requestBody:
@@ -390,6 +389,7 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/ErrorResponse"
+      $ref: "#/components/policies/createTeam"
 
     get:
       tags:
@@ -399,16 +399,8 @@ paths:
       security:
         - OpenID: []
       parameters:
-        - in: query
-          name: limit
-          schema:
-            type: integer
-            default: 10
-        - in: query
-          name: offset
-          schema:
-            type: integer
-            default: 0
+        - $ref: "#/components/parameters/limit"
+        - $ref: "#/components/parameters/offset"
       responses:
         "200":
           description: Successful response
@@ -436,6 +428,7 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/ErrorResponse"
+      $ref: "#/components/policies/listTeams"
 
   /teams/{teamId}:
     get:
@@ -475,7 +468,7 @@ paths:
       security:
         - OpenID: []
       parameters:
-         - $ref: "#/components/parameters/teamId"
+        - $ref: "#/components/parameters/teamId"
       requestBody:
         content:
           application/json:
@@ -509,7 +502,7 @@ paths:
       security:
         - OpenID: []
       parameters:
-         - $ref: "#/components/parameters/teamId"
+        - $ref: "#/components/parameters/teamId"
       responses:
         "204":
           description: Successful response
@@ -611,8 +604,8 @@ paths:
       security:
         - OpenID: []
       parameters:
-         - $ref: "#/components/parameters/teamId"
-         - $ref: "#/components/parameters/projectId"
+        - $ref: "#/components/parameters/teamId"
+        - $ref: "#/components/parameters/projectId"
       responses:
         "200":
           description: Successful response
@@ -639,8 +632,8 @@ paths:
       summary: Update a project
       operationId: updateProject
       parameters:
-         - $ref: "#/components/parameters/teamId"
-         - $ref: "#/components/parameters/projectId"
+        - $ref: "#/components/parameters/teamId"
+        - $ref: "#/components/parameters/projectId"
       security:
         - OpenID: []
       requestBody:
@@ -674,8 +667,8 @@ paths:
       summary: Delete a project
       operationId: deleteProject
       parameters:
-         - $ref: "#/components/parameters/teamId"
-         - $ref: "#/components/parameters/projectId"
+        - $ref: "#/components/parameters/teamId"
+        - $ref: "#/components/parameters/projectId"
       security:
         - OpenID: []
       responses:
@@ -734,16 +727,8 @@ paths:
       parameters:
         - $ref: "#/components/parameters/teamId"
         - $ref: "#/components/parameters/projectId"
-        - in: query
-          name: limit
-          schema:
-            type: integer
-            default: 10
-        - in: query
-          name: offset
-          schema:
-            type: integer
-            default: 0
+        - $ref: "#/components/parameters/limit"
+        - $ref: "#/components/parameters/offset"
       responses:
         "200":
           description: Successful response
@@ -867,51 +852,18 @@ paths:
               schema:
                 $ref: "#/components/schemas/ErrorResponse"
 
-  /snapshot:
-    post:
-      tags:
-        - Snapshots
-      summary: Create a new snapshot
-      operationId: createSnapshot
-      security:
-        - OpenID: []
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/SnapshotCreate"
-      responses:
-        "201":
-          description: Snapshot created
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Snapshot"
-        "500":
-          description: Internal Server Error
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ErrorResponse"
-
+  /teams/{teamId}/projects/{projectId}/environments/{environmentId}/snapshots:
     get:
       tags:
         - Snapshots
       summary: Get a list of snapshots
       operationId: getSnapshots
-      security:
-        - OpenID: []
       parameters:
-        - in: query
-          name: limit
-          schema:
-            type: integer
-            default: 10
-        - in: query
-          name: offset
-          schema:
-            type: integer
-            default: 0
+        - $ref: "#/components/parameters/teamId"
+        - $ref: "#/components/parameters/projectId"
+        - $ref: "#/components/parameters/environmentId"
+        - $ref: "#/components/parameters/limit"
+        - $ref: "#/components/parameters/offset"
       responses:
         "200":
           description: Successful response
@@ -940,58 +892,49 @@ paths:
               schema:
                 $ref: "#/components/schemas/ErrorResponse"
 
-  /snapshot/{id}:
-    get:
+    post:
       tags:
         - Snapshots
-      summary: Get a snapshot
-      operationId: getSnapshot
+      summary: Create a new snapshot
+      operationId: createSnapshot
+      parameters:
+        - $ref: "#/components/parameters/teamId"
+        - $ref: "#/components/parameters/projectId"
+        - $ref: "#/components/parameters/environmentId"
       security:
         - OpenID: []
-      parameters:
-        - in: path
-          name: id
-          required: true
-          schema:
-            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/SnapshotCreate"
       responses:
-        "200":
-          description: Successful response
+        "201":
+          description: Snapshot created
           content:
             application/json:
               schema:
                 $ref: "#/components/schemas/Snapshot"
-        "404":
-          description: Resource not found
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ErrorResponse"
         "500":
           description: Internal Server Error
           content:
             application/json:
               schema:
                 $ref: "#/components/schemas/ErrorResponse"
 
-    put:
+  /teams/{teamId}/projects/{projectId}/environments/{environmentId}/snapshots/{snapshotId}:
+    get:
       tags:
         - Snapshots
-      summary: Update a snapshot
-      operationId: updateSnapshot
+      summary: Get a snapshot
+      operationId: getSnapshot
+      parameters:
+        - $ref: "#/components/parameters/teamId"
+        - $ref: "#/components/parameters/projectId"
+        - $ref: "#/components/parameters/environmentId"
+        - $ref: "#/components/parameters/snapshotId"
       security:
         - OpenID: []
-      parameters:
-        - in: path
-          name: id
-          required: true
-          schema:
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: "#/components/schemas/SnapshotUpdate"
       responses:
         "200":
           description: Successful response
@@ -1011,57 +954,21 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/ErrorResponse"
-
     delete:
       tags:
         - Snapshots
       summary: Delete a snapshot
       operationId: deleteSnapshot
-      security:
-        - OpenID: []
       parameters:
-        - in: path
-          name: id
-          required: true
-          schema:
-            type: string
-      responses:
-        "204":
-          description: Successful response
-        "404":
-          description: Resource not found
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ErrorResponse"
-        "500":
-          description: Internal Server Error
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ErrorResponse"
-
-  /task/{id}:
-    get:
-      tags:
-        - Tasks
-      summary: Get a task
-      operationId: getTask
+        - $ref: "#/components/parameters/teamId"
+        - $ref: "#/components/parameters/projectId"
+        - $ref: "#/components/parameters/environmentId"
+        - $ref: "#/components/parameters/snapshotId"
       security:
         - OpenID: []
-      parameters:
-        - in: path
-          name: id
-          required: true
-          schema:
-            type: string
       responses:
-        "200":
+        "204":
           description: Successful response
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/Task"
         "404":
           description: Resource not found
           content:
@@ -1076,6 +983,30 @@ paths:
                 $ref: "#/components/schemas/ErrorResponse"
 
 components:
+  policies:
+    createTeam:
+      x-fiber-authz-fga:
+        user:
+          namespace: user
+          auth_type: oidc
+        relation:
+          name: admin
+        object:
+          namespace: system
+          components:
+            - in: params
+              name: teamId
+    listTeams:
+      x-fiber-authz-fga:
+        user:
+          namespace: user
+          auth_type: oidc
+        relation:
+          name: admin
+        object:
+          namespace: system
+          name: global
+
   parameters:
     teamId:
       name: teamId
@@ -1095,13 +1026,12 @@ components:
       required: true
       schema:
         type: string
-    lockId:
-      name: ID
-      in: query
-      required: false
+    snapshotId:
+      name: snapshotId
+      in: path
+      required: true
       schema:
         type: string
-        format: uuid
     offset:
       name: offset
       in: query
@@ -1388,23 +1318,6 @@ components:
         team_id:
           type: integer
 
-    Task:
-      type: object
-      properties:
-        id:
-          type: string
-        status:
-          type: string
-        runAt:
-          type: string
-          format: date-time
-        createdAt:
-          type: string
-          format: date-time
-        updatedAt:
-          type: string
-          format: date-time
-
     ErrorResponse:
       type: object
       properties: