migrate legacy API

Signed-off-by: hongming <talonwan@yunify.com>

pkg/apiserver/authorization/authorizerfactory/opa.go

@@ -21,6 +21,7 @@ package authorizerfactory
 import (
 	"context"
 	"github.com/open-policy-agent/opa/rego"
+	rbacv1 "k8s.io/api/rbac/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/klog"
 	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
@@ -33,125 +34,140 @@ type opaAuthorizer struct {
 }
 
 const (
-	permissionUndefined = "permission undefined"
-	defaultRegoQuery    = "data.authz.allow"
+	defaultRegoQuery = "data.authz.allow"
 )
 
 // Make decision by request attributes
 func (o *opaAuthorizer) Authorize(attr authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
-
 	// Make decisions based on the authorization policy of different levels of roles
 	// Error returned when an internal error occurs
 	// Reason must be returned when access is denied
-	globalRole, err := o.am.GetRoleOfUserInTargetScope(iamv1alpha2.GlobalScope, "", attr.GetUser().GetName())
+	globalRole, err := o.am.GetGlobalRoleOfUser(attr.GetUser().GetName())
+
 	if err != nil {
 		if errors.IsNotFound(err) {
-			return authorizer.DecisionDeny, err.Error(), nil
+			return authorizer.DecisionNoOpinion, "", nil
 		}
-		return authorizer.DecisionDeny, "", err
+		return authorizer.DecisionNoOpinion, "", err
 	}
 
-	// check global role policy rules
+	// check global policy rules
 	if authorized, reason, err = o.makeDecision(globalRole, attr); authorized == authorizer.DecisionAllow {
 		return authorized, reason, nil
 	}
 
-	// it's not in cluster resource, permission denied
-	if attr.GetCluster() == "" {
-		return authorizer.DecisionDeny, permissionUndefined, nil
+	// it's global resource, permission denied
+	if attr.GetResourceScope() == iamv1alpha2.GlobalScope {
+		return authorizer.DecisionNoOpinion, "", nil
 	}
 
-	clusterRole, err := o.am.GetRoleOfUserInTargetScope(iamv1alpha2.ClusterScope, attr.GetCluster(), attr.GetUser().GetName())
-	if err != nil {
-		if errors.IsNotFound(err) {
-			return authorizer.DecisionDeny, err.Error(), nil
+	if attr.GetResourceScope() == iamv1alpha2.WorkspaceScope {
+		workspaceRole, err := o.am.GetWorkspaceRoleOfUser(attr.GetUser().GetName(), attr.GetWorkspace())
+		if err != nil {
+			if errors.IsNotFound(err) {
+				return authorizer.DecisionNoOpinion, "", nil
+			}
+			return authorizer.DecisionNoOpinion, "", err
 		}
-		return authorizer.DecisionDeny, "", err
+
+		// check workspace role policy rules
+		if authorized, reason, err := o.makeDecision(workspaceRole, attr); authorized == authorizer.DecisionAllow {
+			return authorized, reason, err
+		} else if err != nil {
+			return authorizer.DecisionNoOpinion, "", err
+		}
+
+		return authorizer.DecisionNoOpinion, "", nil
+	}
+
+	if attr.GetResourceScope() == iamv1alpha2.NamespaceScope {
+		role, err := o.am.GetNamespaceRoleOfUser(attr.GetUser().GetName(), attr.GetNamespace())
+		if err != nil {
+			if errors.IsNotFound(err) {
+				return authorizer.DecisionNoOpinion, "", nil
+			}
+			return authorizer.DecisionNoOpinion, "", err
+		}
+		// check namespace role policy rules
+		if authorized, reason, err := o.makeDecision(role, attr); authorized == authorizer.DecisionAllow {
+			return authorized, reason, err
+		} else if err != nil {
+			return authorizer.DecisionNoOpinion, "", err
+		}
+
+		return authorizer.DecisionNoOpinion, "", nil
+	}
+
+	clusterRole, err := o.am.GetClusterRoleOfUser(attr.GetUser().GetName(), attr.GetCluster())
+
+	if errors.IsNotFound(err) {
+		return authorizer.DecisionNoOpinion, "", nil
+	}
+
+	if err != nil {
+		return authorizer.DecisionNoOpinion, "", err
 	}
 
 	// check cluster role policy rules
 	if authorized, reason, err := o.makeDecision(clusterRole, attr); authorized == authorizer.DecisionAllow {
 		return authorized, reason, nil
 	} else if err != nil {
-		return authorizer.DecisionDeny, "", err
+		return authorizer.DecisionNoOpinion, "", err
 	}
 
-	// it's not in cluster resource, permission denied
-	if attr.GetWorkspace() == "" && attr.GetNamespace() == "" {
-		return authorizer.DecisionDeny, permissionUndefined, nil
-	}
-
-	workspaceRole, err := o.am.GetRoleOfUserInTargetScope(iamv1alpha2.WorkspaceScope, attr.GetWorkspace(), attr.GetUser().GetName())
-	if err != nil {
-		if errors.IsNotFound(err) {
-			return authorizer.DecisionDeny, err.Error(), nil
-		}
-		return authorizer.DecisionDeny, "", err
-	}
-
-	// check workspace role policy rules
-	if authorized, reason, err := o.makeDecision(workspaceRole, attr); authorized == authorizer.DecisionAllow {
-		return authorized, reason, err
-	} else if err != nil {
-		return authorizer.DecisionDeny, "", err
-	}
-
-	// it's not in workspace resource, permission denied
-	if attr.GetNamespace() == "" {
-		return authorizer.DecisionDeny, permissionUndefined, nil
-	}
-
-	namespaceRole, err := o.am.GetRoleOfUserInTargetScope(iamv1alpha2.NamespaceScope, attr.GetNamespace(), attr.GetUser().GetName())
-	if err != nil {
-		if errors.IsNotFound(err) {
-			return authorizer.DecisionDeny, err.Error(), nil
-		}
-		return authorizer.DecisionDeny, "", err
-	}
-	// check namespace role policy rules
-	if authorized, reason, err := o.makeDecision(namespaceRole, attr); authorized == authorizer.DecisionAllow {
-		return authorized, reason, err
-	} else if err != nil {
-		return authorizer.DecisionDeny, "", err
-	}
-
-	return authorizer.DecisionDeny, permissionUndefined, nil
+	return authorizer.DecisionNoOpinion, "", nil
 }
 
 // Make decision base on role
-func (o *opaAuthorizer) makeDecision(role *iamv1alpha2.Role, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
+func (o *opaAuthorizer) makeDecision(role interface{}, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error) {
 
-	for _, ruleRef := range role.Rules {
-		rule, err := o.am.GetPolicyRule(ruleRef.Name)
-		if err != nil {
-			if errors.IsNotFound(err) {
-				continue
-			}
-			return authorizer.DecisionDeny, "", err
+	regoPolicy := ""
+
+	// override
+	if globalRole, ok := role.(*iamv1alpha2.GlobalRole); ok {
+		if overrideRego, ok := globalRole.Annotations[iamv1alpha2.RegoOverrideAnnotation]; ok {
+			regoPolicy = overrideRego
 		}
-		// Call the rego.New function to create an object that can be prepared or evaluated
-		//  After constructing a new rego.Rego object you can call PrepareForEval() to obtain an executable query
-		query, err := rego.New(rego.Query(defaultRegoQuery), rego.Module("authz.rego", rule.Rego)).PrepareForEval(context.Background())
-
-		if err != nil {
-			klog.Errorf("rule syntax error:%s", err)
-			continue
+	} else if workspaceRole, ok := role.(*iamv1alpha2.WorkspaceRole); ok {
+		if overrideRego, ok := workspaceRole.Annotations[iamv1alpha2.RegoOverrideAnnotation]; ok {
+			regoPolicy = overrideRego
 		}
-
-		// The policy decision is contained in the results returned by the Eval() call. You can inspect the decision and handle it accordingly.
-		results, err := query.Eval(context.Background(), rego.EvalInput(a))
-
-		if err != nil {
-			klog.Errorf("rule syntax error:%s", err)
-			continue
+	} else if clusterRole, ok := role.(*rbacv1.ClusterRole); ok {
+		if overrideRego, ok := clusterRole.Annotations[iamv1alpha2.RegoOverrideAnnotation]; ok {
+			regoPolicy = overrideRego
 		}
-
-		if len(results) > 0 && results[0].Expressions[0].Value == true {
-			return authorizer.DecisionAllow, "", nil
+	} else if role, ok := role.(*rbacv1.Role); ok {
+		if overrideRego, ok := role.Annotations[iamv1alpha2.RegoOverrideAnnotation]; ok {
+			regoPolicy = overrideRego
 		}
 	}
 
-	return authorizer.DecisionDeny, permissionUndefined, nil
+	if regoPolicy == "" {
+		return authorizer.DecisionNoOpinion, "", nil
+	}
+
+	// Call the rego.New function to create an object that can be prepared or evaluated
+	//  After constructing a new rego.Rego object you can call PrepareForEval() to obtain an executable query
+	query, err := rego.New(rego.Query(defaultRegoQuery), rego.Module("authz.rego", regoPolicy)).PrepareForEval(context.Background())
+
+	if err != nil {
+		klog.Errorf("syntax error:%s,refer: %s+v", err, role)
+		return authorizer.DecisionNoOpinion, "", err
+	}
+
+	// The policy decision is contained in the results returned by the Eval() call. You can inspect the decision and handle it accordingly.
+	results, err := query.Eval(context.Background(), rego.EvalInput(a))
+
+	if err != nil {
+		klog.Errorf("syntax error:%s,refer: %s+v", err, role)
+		return authorizer.DecisionNoOpinion, "", err
+	}
+
+	if len(results) > 0 && results[0].Expressions[0].Value == true {
+		return authorizer.DecisionAllow, "", nil
+	}
+
+	return authorizer.DecisionNoOpinion, "", nil
 }
 
 func NewOPAAuthorizer(am am.AccessManagementInterface) *opaAuthorizer {