-
Notifications
You must be signed in to change notification settings - Fork 4.7k
/
strategy.go
84 lines (66 loc) · 2.63 KB
/
strategy.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
package oauthauthorizetoken
import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/util/validation/field"
apirequest "k8s.io/apiserver/pkg/endpoints/request"
"k8s.io/apiserver/pkg/registry/rest"
"k8s.io/kubernetes/pkg/api/legacyscheme"
scopeauthorizer "github.com/openshift/origin/pkg/authorization/authorizer/scope"
oauthapi "github.com/openshift/origin/pkg/oauth/apis/oauth"
"github.com/openshift/origin/pkg/oauth/apis/oauth/validation"
"github.com/openshift/origin/pkg/oauth/registry/oauthclient"
)
// strategy implements behavior for OAuthAuthorizeTokens
type strategy struct {
runtime.ObjectTyper
clientGetter oauthclient.Getter
}
var _ rest.RESTCreateStrategy = strategy{}
var _ rest.RESTUpdateStrategy = strategy{}
var _ rest.GarbageCollectionDeleteStrategy = strategy{}
func NewStrategy(clientGetter oauthclient.Getter) strategy {
return strategy{ObjectTyper: legacyscheme.Scheme, clientGetter: clientGetter}
}
func (strategy) DefaultGarbageCollectionPolicy(ctx apirequest.Context) rest.GarbageCollectionPolicy {
return rest.Unsupported
}
func (strategy) PrepareForUpdate(ctx apirequest.Context, obj, old runtime.Object) {}
// NamespaceScoped is false for OAuth objects
func (strategy) NamespaceScoped() bool {
return false
}
func (strategy) GenerateName(base string) string {
return base
}
func (strategy) PrepareForCreate(ctx apirequest.Context, obj runtime.Object) {
}
// Canonicalize normalizes the object after validation.
func (strategy) Canonicalize(obj runtime.Object) {
}
// Validate validates a new token
func (s strategy) Validate(ctx apirequest.Context, obj runtime.Object) field.ErrorList {
token := obj.(*oauthapi.OAuthAuthorizeToken)
validationErrors := validation.ValidateAuthorizeToken(token)
client, err := s.clientGetter.Get(token.ClientName, metav1.GetOptions{})
if err != nil {
return append(validationErrors, field.InternalError(field.NewPath("clientName"), err))
}
if err := scopeauthorizer.ValidateScopeRestrictions(client, token.Scopes...); err != nil {
return append(validationErrors, field.InternalError(field.NewPath("clientName"), err))
}
return validationErrors
}
// ValidateUpdate validates an update
func (s strategy) ValidateUpdate(ctx apirequest.Context, obj, old runtime.Object) field.ErrorList {
oldToken := old.(*oauthapi.OAuthAuthorizeToken)
newToken := obj.(*oauthapi.OAuthAuthorizeToken)
return validation.ValidateAuthorizeTokenUpdate(newToken, oldToken)
}
// AllowCreateOnUpdate is false for OAuth objects
func (strategy) AllowCreateOnUpdate() bool {
return false
}
func (strategy) AllowUnconditionalUpdate() bool {
return false
}