cartodb4/dataservices-api
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Permissions check and client templates

Browse Source
This commit is contained in:
antoniocarlon 2018-09-05 17:28:15 +02:00
parent 652242a8f8
commit 2a2ae481fb
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
client/renderer/templates/20_public_functions.erb
View File

@ -9,13 +9,17 @@ RETURNS <%= return_type %> AS $$
DECLARE DECLARE
<%= return_declaration if not multi_row %> <%= return_declaration if not multi_row %>
<%= user_org_declaration %> <%= user_org_declaration %>
<% unless superuser_function? -%>
appname TEXT;
apikey_permissions JSON;
<% end %>
BEGIN BEGIN
IF session_user = 'publicuser' OR session_user ~ 'cartodb_publicuser_*' THEN IF session_user = 'publicuser' OR session_user ~ 'cartodb_publicuser_*' THEN
RAISE EXCEPTION 'The api_key must be provided'; RAISE EXCEPTION 'The api_key must be provided';
END IF; END IF;
<% unless superuser_function? -%> <% unless superuser_function? -%>
<% if requires_permission %>
SELECT u, o, a, p INTO username, orgname, appname, apikey_permissions FROM cdb_dataservices_client._cdb_entity_config() AS (u text, o text, a text, p json); SELECT u, o, a, p INTO username, orgname, appname, apikey_permissions FROM cdb_dataservices_client._cdb_entity_config() AS (u text, o text, a text, p json);
<% if requires_permission %>
IF NOT apikey_permissions::jsonb ? '<%= permission_name %>' THEN IF NOT apikey_permissions::jsonb ? '<%= permission_name %>' THEN
RAISE EXCEPTION '<%= permission_error %>'; RAISE EXCEPTION '<%= permission_error %>';
END IF; END IF;

9
client/sql/15_config_management.sql
View File

@ -1,6 +1,8 @@
CREATE TYPE cdb_dataservices_client._entity_config AS ( CREATE TYPE cdb_dataservices_client._entity_config AS (
username text, username text,
organization_name text organization_name text,
application_name text,
apikey_permissions json
); );
-- --
@ -13,10 +15,13 @@ CREATE OR REPLACE FUNCTION cdb_dataservices_client._cdb_entity_config()
RETURNS record AS $$ RETURNS record AS $$
DECLARE DECLARE
result cdb_dataservices_client._entity_config; result cdb_dataservices_client._entity_config;
apikey_config json;
is_organization boolean; is_organization boolean;
username text; username text;
organization_name text; organization_name text;
BEGIN BEGIN
SELECT cartodb.cdb_conf_getconf('api_keys_'||session_user) INTO apikey_config;
SELECT cartodb.cdb_conf_getconf('user_config')->'is_organization' INTO is_organization; SELECT cartodb.cdb_conf_getconf('user_config')->'is_organization' INTO is_organization;
IF is_organization IS NULL THEN IF is_organization IS NULL THEN
RAISE EXCEPTION 'User must have user configuration in the config table'; RAISE EXCEPTION 'User must have user configuration in the config table';
@ -32,6 +37,8 @@ BEGIN
END IF; END IF;
result.username = username; result.username = username;
result.organization_name = organization_name; result.organization_name = organization_name;
result.application_name = apikey_config->'application';
result.apikey_permissions = apikey_config->'permissions';
RETURN result; RETURN result;
END; END;
$$ LANGUAGE 'plpgsql' SECURITY DEFINER STABLE PARALLEL SAFE; $$ LANGUAGE 'plpgsql' SECURITY DEFINER STABLE PARALLEL SAFE;