Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add read-only configuration #2893

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Add read-only configuration #2893

wants to merge 1 commit into from

Conversation

codihuston
Copy link
Contributor

@codihuston codihuston commented Aug 8, 2023 •
edited

  • When read-only mode is enabled via rails config, controller endpoints that are explicitly enrolled into a read_safe list return a HTTP 405 Method Not Allowed when invoked, also throwing Conjur error code: CONJ00153E
  • Implemented using module prepending

Desired Outcome

Please describe the desired outcome for this PR. Said another way, what was
the original request that resulted in these code changes? Feel free to copy
this information from the connected issue.

Implemented Changes

Describe how the desired outcome above has been achieved with this PR. In
particular, consider:

  • What's changed? Why were these changes made?
  • How should the reviewer approach this PR, especially if manual tests are required?
  • Are there relevant screenshots you can add to the PR description?

Connected Issue/Story

Resolves #[relevant GitHub issue(s), e.g. 76]

CyberArk internal issue ID: [insert issue ID]

Definition of Done

At least 1 todo must be completed in the sections below for the PR to be
merged.

Changelog

  • The CHANGELOG has been updated, or
  • This PR does not include user-facing changes and doesn't require a
    CHANGELOG update

Test coverage

  • This PR includes new unit and integration tests to go with the code
    changes, or
  • The changes in this PR do not require tests

Documentation

  • Docs (e.g. READMEs) were updated in this PR
  • A follow-up issue to update official docs has been filed here: [insert issue ID]
  • This PR does not require updating any documentation

Behavior

  • This PR changes product behavior and has been reviewed by a PO, or
  • These changes are part of a larger initiative that will be reviewed later, or
  • No behavior was changed with this PR

Security

  • Security architect has reviewed the changes in this PR,
  • These changes are part of a larger initiative with a separate security review, or
  • There are no security aspects to these changes

@codihuston
Copy link
Contributor Author

Sample output with Rails.configuration.read_only_api=true

root@86de487fed92:/# conjur policy load root /src/conjur-server/dev/policies/example.yml
{"error":{"code":"method_not_allowed","message":"CONJ00153E This action is not permitted when the server is in read-only mode"}}
error: 405 Method Not Allowed
root@86de487fed92:/# conjur variable values add test-variable test-value
{"error":{"code":"method_not_allowed","message":"CONJ00153E This action is not permitted when the server is in read-only mode"}}
error: 405 Method Not Allowed
root@86de487fed92:/# conjur variable value test-variable
test-value

Sample output with Rails.configuration.read_only_api=false

root@86de487fed92:/# conjur policy load root /src/conjur-server/dev/policies/example.yml
Loaded policy 'root'
{
  "created_roles": {
  },
  "version": 2
}
root@86de487fed92:/# conjur variable values add test-variable test-value
Value added

root@86de487fed92:/# conjur variable value test-variable
test-value

@codihuston
Add read-only configuration
380bb0a 
- When read-only mode is enabled via rails config, controller endpoints that are explicitly enrolled into a `write_protected` list return a HTTP 405 Method Not Allowed when invoked, also throwing Conjur error code: `CONJ00153E`
- Implemented using module prepending
codeclimate[bot]
codeclimate bot reviewed Aug 15, 2023
View reviewed changes
app/controllers/concerns/prepend.rb
@@ -0,0 +1,15 @@
module ReadOnlyPrepender
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ReadOnlyPrepender has no descriptive comment

app/controllers/concerns/prepend.rb
def write_protected(*method_names)
method_names.each do |m|
proxy = Module.new do
define_method(m) do |*args|
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ReadOnlyPrepender#write_protected contains iterators nested 2 deep

app/controllers/concerns/prepend.rb
method_names.each do |m|
proxy = Module.new do
define_method(m) do |*args|
raise ::Errors::Conjur::ReadOnly::ActionNotPermitted unless !Rails.configuration.read_only
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add empty line after guard clause.

app/controllers/concerns/prepend.rb
self.prepend proxy
end
end
end
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

end at 15, 2 is not aligned with module ReadOnlyPrepender at 1, 0.

app/controllers/concerns/prepend.rb
module ReadOnlyPrepender
# Given a list of method symbols, preempt calls to them using a proxy that
# raises an error if read_only is enabled.
def write_protected(*method_names)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use 2 (not 4) spaces for indentation.

@codeclimate
Copy link

codeclimate bot commented Aug 15, 2023

Code Climate has analyzed commit 380bb0a and detected 9 issues on this pull request.

Here's the issue category breakdown:

Category Count
Complexity 2
Style 7

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 87.4% (-0.7% change).

View more on Code Climate.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@codeclimate codeclimate[bot] codeclimate left review comments

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@codihuston