wip auth

diff --git a/src/cmdlistener.rs b/src/cmdlistener.rs
index 404ff021c09c1c0cd102ea1d30d1fe68bbef5705..86e269f045445dd459dafce2e35f41bd776ea9e4 100644 (file)
--- a/src/cmdlistener.rs
+++ b/src/cmdlistener.rs
@@ -27,6 +27,7 @@ struct CommandStream {
   euid : Result<u32, anyhow::Error>,
   read : io::Lines<BufReader<UnixStream>>,
   write : CSWrite,
+  scope : Option<ManagementScope>,
 }
 
 type CSE = anyhow::Error;
@@ -68,12 +69,70 @@ fn decode_process_inner(s: &str)-> MgmtResponse {
   execute(cmd)?
 }
 
+const USERLIST : &str = "/etc/userlist";
+
+fn authorize_scope(cs: &CommandStream, wanted: &ManagementScope) {
+  type AS = AuthorizedScope;
+  
+  match &wanted {
+    ManagementScope::XXX => {
+      let y : AS<(
+        Authorized<(Passwd,uid_t)>,
+      )> = {
+        let our_euid = unsafe { libc::getuid() };
+        let ok = cs.authorized_uid(our_euid)?;
+        AS((ok,),
+           ManagementScope:::XXX)
+      };
+      y.into()
+    },
+    Unix(user) => {
+      let y : AS<(
+        Authorized<(Passwd,uid_t)>, // caller_has
+        Authorized<File>,           // in_userlist:
+      )> = {
+        let pwent = Passwd::from_name(user)?:
+        let caller_has = cs.authorized_uid(pwent.uid)?;
+        let found = (||{
+          let allowed = File::open(USERLIST)?;
+          let found = allowed.lines()?.map(|l| l.trim() == user).any();
+          Ok(found)
+        })?;
+        let in_userlist = Authorized::from_bool(USERLIST)?;
+        AS((caller_has, in_userlist),
+           ManagementScope::Unix(pwent.username))
+      };
+      y.into()
+    }
+  };
+}
+
 #[throws(ME)]
-fn execute(cmd: MgmtCommand) -> MgmtResponse {
+fn execute(cs: &mut CommandStream, cmd: MgmtCommand) -> MgmtResponse {
+  use MgmgError::*;
+
   match cmd {
     Noop { } => Fine { },
-    AddPiece(_) => Fine {
-    }, // xxx
+
+    Scope(wanted_scope) => {
+      let (_: AuthorizedConclusion, authorized: ManagementScope) = 
+        authorize_scope(cs, &wanted_scope)?;
+      cs.scope = authorized;
+      Fine { }
+    }
+/*
+    CreateGame(game) => {
+      
+    },
+    AddPiece(game, { pos,count,name,info }) => {
+      let game = cs.lookup_game(&game)?;
+      let count = spec.count.unwrap_or(1);
+      let pos = spec.ok_or(XXU("missing piece pos"))?;
+      let _xxx_name = spec.name;
+      let pc = info.load()?;
+      
+    }
+    }, // xxx*/
   }
 }
 

diff --git a/src/commands.rs b/src/commands.rs
index 10cc788b00df2cc07fed30f5b7e2fb84934e58c9..73c8102a0aac85ca1b9f2b091290d714c5e42921 100644 (file)
--- a/src/commands.rs
+++ b/src/commands.rs
@@ -16,6 +16,8 @@ pub enum MgmtResponse {
 #[derive(Debug,Error)]
 pub enum MgmtError {
   ParseFailed(String),
+  SetScope(ManagementScope),
+  XXXU(&'static str),
 }
 display_as_debug!{MgmtError}
 

diff --git a/src/global.rs b/src/global.rs
index 9521b945dea0f068d43a1659eeeb91afca1d3abd..d4512f00fe120e334523cc1f3a9cc33d252dc4ec 100644 (file)
--- a/src/global.rs
+++ b/src/global.rs
@@ -26,7 +26,7 @@ pub struct Instance {
   pub tokens_clients : TokenRegistry<ClientId>,
 }
 
-#[derive(Debug,Serialize)]
+#[derive(Debug,Deserialize,Serialize)]
 pub enum ManagementScope {
   XXX,
   Unix { user : String /* username, so filename-safe */ },