Lines
40.3 %
Functions
37.5 %
use std::collections::HashSet;
use indoc::indoc;
use nix::{libc::gid_t, unistd::Group};
use serde::{Deserialize, Serialize};
use thiserror::Error;
use crate::core::{common::UnixUser, types::DbOrUser};
#[derive(Error, Debug, PartialEq, Eq, Clone, Copy, Serialize, Deserialize)]
pub enum NameValidationError {
#[error("Name cannot be empty.")]
EmptyString,
#[error(
"Name contains invalid characters. Only A-Z, a-z, 0-9, _ (underscore) and - (dash) are permitted."
)]
InvalidCharacters,
#[error("Name is too long. Maximum length is 64 characters.")]
TooLong,
}
impl NameValidationError {
#[must_use]
pub fn to_error_message(self, db_or_user: &DbOrUser) -> String {
match self {
NameValidationError::EmptyString => {
format!("{} name can not be empty.", db_or_user.capitalized_noun())
NameValidationError::TooLong => format!(
"{} is too long, maximum length is 64 characters.",
db_or_user.capitalized_noun()
),
NameValidationError::InvalidCharacters => format!(
indoc! {r"
Invalid characters in {} name: '{}', only A-Z, a-z, 0-9, _ (underscore) and - (dash) are permitted.
"},
db_or_user.lowercased_noun(),
db_or_user.name(),
pub fn error_type(&self) -> &'static str {
NameValidationError::EmptyString => "empty-string",
NameValidationError::InvalidCharacters => "invalid-characters",
NameValidationError::TooLong => "too-long",
pub enum AuthorizationError {
#[error("Illegal prefix, user is not authorized to manage this resource")]
IllegalPrefix,
// TODO: I don't think this should ever happen?
#[error("Name cannot be empty")]
StringEmpty,
#[error("Group was found in denylist")]
DenylistError,
impl AuthorizationError {
AuthorizationError::IllegalPrefix => format!(
"Illegal {} name prefix: you are not allowed to manage databases or users prefixed with '{}'",
db_or_user.prefix(),
)
.to_owned(),
// TODO: This error message could be clearer
AuthorizationError::StringEmpty => {
AuthorizationError::DenylistError => {
format!("'{}' is denied by the group denylist", db_or_user.name())
AuthorizationError::IllegalPrefix => "illegal-prefix",
AuthorizationError::StringEmpty => "string-empty",
AuthorizationError::DenylistError => "denylist-error",
#[derive(Error, Debug, PartialEq, Eq, Clone, Serialize, Deserialize)]
pub enum ValidationError {
#[error("Name validation error: {0}")]
NameValidationError(NameValidationError),
#[error("Authorization error: {0}")]
AuthorizationError(AuthorizationError),
// AuthorizationHandlerError(String),
impl ValidationError {
pub fn to_error_message(&self, db_or_user: &DbOrUser) -> String {
ValidationError::NameValidationError(err) => err.to_error_message(db_or_user),
ValidationError::AuthorizationError(err) => err.to_error_message(db_or_user),
// AuthorizationError::AuthorizationHandlerError(msg) => {
// format!(
// "Authorization handler error for '{}': {}",
// db_or_user.name(),
// msg
// )
// }
pub fn error_type(&self) -> String {
ValidationError::NameValidationError(err) => {
format!("name-validation-error/{}", err.error_type())
ValidationError::AuthorizationError(err) => {
format!("authorization-error/{}", err.error_type())
} // AuthorizationError::AuthorizationHandlerError(_) => {
// "authorization-handler-error".to_string()
pub type GroupDenylist = HashSet<gid_t>;
const MAX_NAME_LENGTH: usize = 64;
pub fn validate_name(name: &str) -> Result<(), NameValidationError> {
if name.is_empty() {
Err(NameValidationError::EmptyString)
} else if name.len() > MAX_NAME_LENGTH {
Err(NameValidationError::TooLong)
} else if !name
.chars()
.all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
{
Err(NameValidationError::InvalidCharacters)
} else {
Ok(())
pub fn validate_authorization_by_unix_user(
name: &str,
user: &UnixUser,
) -> Result<(), AuthorizationError> {
let prefixes = std::iter::once(user.username.clone())
.chain(user.groups.iter().cloned())
.collect::<Vec<String>>();
validate_authorization_by_prefixes(name, &prefixes)
/// Core logic for validating the ownership of a database name.
/// This function checks if the given name matches any of the given prefixes.
/// These prefixes will in most cases be the user's unix username and any
/// unix groups the user is a member of.
pub fn validate_authorization_by_prefixes(
prefixes: &[String],
return Err(AuthorizationError::StringEmpty);
if prefixes
.iter()
.filter(|p| name.starts_with(&((*p).clone() + "_")))
.collect::<Vec<_>>()
.is_empty()
return Err(AuthorizationError::IllegalPrefix);
pub fn validate_authorization_by_group_denylist(
group_denylist: &GroupDenylist,
// NOTE: if the username matches, we allow it regardless of denylist
if user.username == name {
return Ok(());
let user_group = Group::from_name(name)
.ok()
.flatten()
.map(|g| g.gid.as_raw());
if let Some(gid) = user_group
&& group_denylist.contains(&gid)
Err(AuthorizationError::DenylistError)
pub fn validate_db_or_user_request(
db_or_user: &DbOrUser,
unix_user: &UnixUser,
) -> Result<(), ValidationError> {
validate_name(db_or_user.name()).map_err(ValidationError::NameValidationError)?;
validate_authorization_by_unix_user(db_or_user.name(), unix_user)
.map_err(ValidationError::AuthorizationError)?;
validate_authorization_by_group_denylist(db_or_user.name(), unix_user, group_denylist)
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn test_validate_name() {
assert_eq!(validate_name(""), Err(NameValidationError::EmptyString));
assert_eq!(validate_name("abcdefghijklmnopqrstuvwxyz"), Ok(()));
assert_eq!(validate_name("ABCDEFGHIJKLMNOPQRSTUVWXYZ"), Ok(()));
assert_eq!(validate_name("0123456789_-"), Ok(()));
for c in "\n\t\r !@#$%^&*()+=[]{}|;:,.<>?/".chars() {
assert_eq!(
validate_name(&c.to_string()),
);
assert_eq!(validate_name(&"a".repeat(MAX_NAME_LENGTH)), Ok(()));
validate_name(&"a".repeat(MAX_NAME_LENGTH + 1)),
fn test_validate_authorization_by_prefixes() {
let prefixes = vec!["user".to_string(), "group".to_string()];
validate_authorization_by_prefixes("", &prefixes),
Err(AuthorizationError::StringEmpty)
validate_authorization_by_prefixes("user_testdb", &prefixes),
validate_authorization_by_prefixes("group_testdb", &prefixes),
validate_authorization_by_prefixes("group_test_db", &prefixes),
validate_authorization_by_prefixes("group_test-db", &prefixes),
validate_authorization_by_prefixes("nonexistent_testdb", &prefixes),
Err(AuthorizationError::IllegalPrefix)