access_linux.go 7.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216
  1. package cmd
  2. import (
  3. "errors"
  4. "fmt"
  5. "github.com/urfave/cli/v2"
  6. "heckel.io/ntfy/auth"
  7. "heckel.io/ntfy/util"
  8. )
  9. func init() {
  10. commands = append(commands, cmdAccess)
  11. }
  12. const (
  13. userEveryone = "everyone"
  14. )
  15. var flagsAccess = append(
  16. userCommandFlags(),
  17. &cli.BoolFlag{Name: "reset", Aliases: []string{"r"}, Usage: "reset access for user (and topic)"},
  18. )
  19. var cmdAccess = &cli.Command{
  20. Name: "access",
  21. Usage: "Grant/revoke access to a topic, or show access",
  22. UsageText: "ntfy access [USERNAME [TOPIC [PERMISSION]]]",
  23. Flags: flagsAccess,
  24. Before: initConfigFileInputSourceFunc("config", flagsAccess),
  25. Action: execUserAccess,
  26. Category: categoryServer,
  27. Description: `Manage the access control list for the ntfy server.
  28. This is a server-only command. It directly manages the user.db as defined in the server config
  29. file server.yml. The command only works if 'auth-file' is properly defined. Please also refer
  30. to the related command 'ntfy user'.
  31. The command allows you to show the access control list, as well as change it, depending on how
  32. it is called.
  33. Usage:
  34. ntfy access # Shows access control list (alias: 'ntfy user list')
  35. ntfy access USERNAME # Shows access control entries for USERNAME
  36. ntfy access USERNAME TOPIC PERMISSION # Allow/deny access for USERNAME to TOPIC
  37. Arguments:
  38. USERNAME an existing user, as created with 'ntfy user add', or "everyone"/"*"
  39. to define access rules for anonymous/unauthenticated clients
  40. TOPIC name of a topic with optional wildcards, e.g. "mytopic*"
  41. PERMISSION one of the following:
  42. - read-write (alias: rw)
  43. - read-only (aliases: read, ro)
  44. - write-only (aliases: write, wo)
  45. - deny (alias: none)
  46. Examples:
  47. ntfy access # Shows access control list (alias: 'ntfy user list')
  48. ntfy access phil # Shows access for user phil
  49. ntfy access phil mytopic rw # Allow read-write access to mytopic for user phil
  50. ntfy access everyone mytopic rw # Allow anonymous read-write access to mytopic
  51. ntfy access everyone "up*" write # Allow anonymous write-only access to topics "up..."
  52. ntfy access --reset # Reset entire access control list
  53. ntfy access --reset phil # Reset all access for user phil
  54. ntfy access --reset phil mytopic # Reset access for user phil and topic mytopic
  55. `,
  56. }
  57. func execUserAccess(c *cli.Context) error {
  58. if c.NArg() > 3 {
  59. return errors.New("too many arguments, please check 'ntfy access --help' for usage details")
  60. }
  61. manager, err := createAuthManager(c)
  62. if err != nil {
  63. return err
  64. }
  65. username := c.Args().Get(0)
  66. if username == userEveryone {
  67. username = auth.Everyone
  68. }
  69. topic := c.Args().Get(1)
  70. perms := c.Args().Get(2)
  71. reset := c.Bool("reset")
  72. if reset {
  73. if perms != "" {
  74. return errors.New("too many arguments, please check 'ntfy access --help' for usage details")
  75. }
  76. return resetAccess(c, manager, username, topic)
  77. } else if perms == "" {
  78. if topic != "" {
  79. return errors.New("invalid syntax, please check 'ntfy access --help' for usage details")
  80. }
  81. return showAccess(c, manager, username)
  82. }
  83. return changeAccess(c, manager, username, topic, perms)
  84. }
  85. func changeAccess(c *cli.Context, manager auth.Manager, username string, topic string, perms string) error {
  86. if !util.InStringList([]string{"", "read-write", "rw", "read-only", "read", "ro", "write-only", "write", "wo", "none", "deny"}, perms) {
  87. return errors.New("permission must be one of: read-write, read-only, write-only, or deny (or the aliases: read, ro, write, wo, none)")
  88. }
  89. read := util.InStringList([]string{"read-write", "rw", "read-only", "read", "ro"}, perms)
  90. write := util.InStringList([]string{"read-write", "rw", "write-only", "write", "wo"}, perms)
  91. user, err := manager.User(username)
  92. if err == auth.ErrNotFound {
  93. return fmt.Errorf("user %s does not exist", username)
  94. } else if user.Role == auth.RoleAdmin {
  95. return fmt.Errorf("user %s is an admin user, access control entries have no effect", username)
  96. }
  97. if err := manager.AllowAccess(username, topic, read, write); err != nil {
  98. return err
  99. }
  100. if read && write {
  101. fmt.Fprintf(c.App.ErrWriter, "granted read-write access to topic %s\n\n", topic)
  102. } else if read {
  103. fmt.Fprintf(c.App.ErrWriter, "granted read-only access to topic %s\n\n", topic)
  104. } else if write {
  105. fmt.Fprintf(c.App.ErrWriter, "granted write-only access to topic %s\n\n", topic)
  106. } else {
  107. fmt.Fprintf(c.App.ErrWriter, "revoked all access to topic %s\n\n", topic)
  108. }
  109. return showUserAccess(c, manager, username)
  110. }
  111. func resetAccess(c *cli.Context, manager auth.Manager, username, topic string) error {
  112. if username == "" {
  113. return resetAllAccess(c, manager)
  114. } else if topic == "" {
  115. return resetUserAccess(c, manager, username)
  116. }
  117. return resetUserTopicAccess(c, manager, username, topic)
  118. }
  119. func resetAllAccess(c *cli.Context, manager auth.Manager) error {
  120. if err := manager.ResetAccess("", ""); err != nil {
  121. return err
  122. }
  123. fmt.Fprintln(c.App.ErrWriter, "reset access for all users")
  124. return nil
  125. }
  126. func resetUserAccess(c *cli.Context, manager auth.Manager, username string) error {
  127. if err := manager.ResetAccess(username, ""); err != nil {
  128. return err
  129. }
  130. fmt.Fprintf(c.App.ErrWriter, "reset access for user %s\n\n", username)
  131. return showUserAccess(c, manager, username)
  132. }
  133. func resetUserTopicAccess(c *cli.Context, manager auth.Manager, username string, topic string) error {
  134. if err := manager.ResetAccess(username, topic); err != nil {
  135. return err
  136. }
  137. fmt.Fprintf(c.App.ErrWriter, "reset access for user %s and topic %s\n\n", username, topic)
  138. return showUserAccess(c, manager, username)
  139. }
  140. func showAccess(c *cli.Context, manager auth.Manager, username string) error {
  141. if username == "" {
  142. return showAllAccess(c, manager)
  143. }
  144. return showUserAccess(c, manager, username)
  145. }
  146. func showAllAccess(c *cli.Context, manager auth.Manager) error {
  147. users, err := manager.Users()
  148. if err != nil {
  149. return err
  150. }
  151. return showUsers(c, manager, users)
  152. }
  153. func showUserAccess(c *cli.Context, manager auth.Manager, username string) error {
  154. users, err := manager.User(username)
  155. if err == auth.ErrNotFound {
  156. return fmt.Errorf("user %s does not exist", username)
  157. } else if err != nil {
  158. return err
  159. }
  160. return showUsers(c, manager, []*auth.User{users})
  161. }
  162. func showUsers(c *cli.Context, manager auth.Manager, users []*auth.User) error {
  163. for _, user := range users {
  164. fmt.Fprintf(c.App.ErrWriter, "user %s (%s)\n", user.Name, user.Role)
  165. if user.Role == auth.RoleAdmin {
  166. fmt.Fprintf(c.App.ErrWriter, "- read-write access to all topics (admin role)\n")
  167. } else if len(user.Grants) > 0 {
  168. for _, grant := range user.Grants {
  169. if grant.AllowRead && grant.AllowWrite {
  170. fmt.Fprintf(c.App.ErrWriter, "- read-write access to topic %s\n", grant.TopicPattern)
  171. } else if grant.AllowRead {
  172. fmt.Fprintf(c.App.ErrWriter, "- read-only access to topic %s\n", grant.TopicPattern)
  173. } else if grant.AllowWrite {
  174. fmt.Fprintf(c.App.ErrWriter, "- write-only access to topic %s\n", grant.TopicPattern)
  175. } else {
  176. fmt.Fprintf(c.App.ErrWriter, "- no access to topic %s\n", grant.TopicPattern)
  177. }
  178. }
  179. } else {
  180. fmt.Fprintf(c.App.ErrWriter, "- no topic-specific permissions\n")
  181. }
  182. if user.Name == auth.Everyone {
  183. defaultRead, defaultWrite := manager.DefaultAccess()
  184. if defaultRead && defaultWrite {
  185. fmt.Fprintln(c.App.ErrWriter, "- read-write access to all (other) topics (server config)")
  186. } else if defaultRead {
  187. fmt.Fprintln(c.App.ErrWriter, "- read-only access to all (other) topics (server config)")
  188. } else if defaultWrite {
  189. fmt.Fprintln(c.App.ErrWriter, "- write-only access to all (other) topics (server config)")
  190. } else {
  191. fmt.Fprintln(c.App.ErrWriter, "- no access to any (other) topics (server config)")
  192. }
  193. }
  194. }
  195. return nil
  196. }