feat(api): rewrite access control management in Docker (#3337)

* feat(api): decorate Docker resource creation response with resource control * fix(api): fix a potential resource control conflict between stacks/volumes * feat(api): generate a default private resource control instead of admin only * fix(api): fix default RC value * fix(api): update RC authorizations check to support admin only flag * refactor(api): relocate access control related methods * fix(api): fix a potential conflict when fetching RC from database * refactor(api): refactor access control logic * refactor(api): remove the concept of DecoratedStack * feat(api): automatically remove RC when removing a Docker resource * refactor(api): update filter resource methods documentation * refactor(api): update proxy package structure * refactor(api): renamed proxy/misc package * feat(api): re-introduce ResourceControlDelete operation as admin restricted * refactor(api): relocate default endpoint authorizations * feat(api): migrate RBAC data * feat(app): ResourceControl management refactor * fix(api): fix access control issue on stack deletion and automatically delete RC * fix(api): fix stack filtering * fix(api): fix UpdateResourceControl operation checks * refactor(api): introduce a NewTransport builder method * refactor(api): inject endpoint in Docker transport * refactor(api): introduce Docker client into Docker transport * refactor(api): refactor http/proxy package * feat(api): inspect a Docker resource labels during access control validation * fix(api): only apply automatic resource control creation on success response * fix(api): fix stack access control check * fix(api): use StatusCreated instead of StatusOK for automatic resource control creation * fix(app): resource control fixes * fix(api): fix an issue preventing administrator to inspect a resource with a RC * refactor(api): remove useless error return * refactor(api): document DecorateStacks function * fix(api): fix invalid resource control type for container deletion * feat(api): support Docker system networks * feat(api): update Swagger docs * refactor(api): rename transport variable * refactor(api): rename transport variable * feat(networks): add system tag for system networks * feat(api): add support for resource control labels * feat(api): upgrade to DBVersion 22 * refactor(api): refactor access control management in Docker proxy * refactor(api): re-implement docker proxy taskListOperation * refactor(api): review parameters declaration * refactor(api): remove extra blank line * refactor(api): review method comments * fix(api): fix invalid ServerAddress property and review method visibility * feat(api): update error message * feat(api): update restrictedVolumeBrowserOperation method * refactor(api): refactor method parameters * refactor(api): minor refactor * refactor(api): change Azure transport visibility * refactor(api): update struct documentation * refactor(api): update struct documentation * feat(api): review restrictedResourceOperation method * refactor(api): remove unused authorization methods * feat(api): apply RBAC when enabled on stack operations * fix(api): fix invalid data migration procedure for DBVersion = 22 * fix(app): RC duplicate on private resource * feat(api): change Docker API version logic for libcompose/client factory * fix(api): update access denied error message to be Docker API compliant * fix(api): update volume browsing authorizations data migration * fix(api): fix an issue with access control in multi-node agent Swarm cluster
2025-08-02 20:35:25 +02:00 · 2019-11-13 12:41:42 +13:00 · 2019-11-13 12:41:42 +13:00 · 19d4db13be
commit 19d4db13be
parent 198e92c734
118 changed files with 3600 additions and 3020 deletions
--- a/api/http/proxy/factory/factory.go
+++ b/api/http/proxy/factory/factory.go
@ -0,0 +1,109 @@
+package factory
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+
+	"github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/docker"
+)
+
+const azureAPIBaseURL = "https://management.azure.com"
+
+var extensionPorts = map[portainer.ExtensionID]string{
+	portainer.RegistryManagementExtension:  "7001",
+	portainer.OAuthAuthenticationExtension: "7002",
+	portainer.RBACExtension:                "7003",
+}
+
+type (
+	// ProxyFactory is a factory to create reverse proxies to Docker endpoints and extensions
+	ProxyFactory struct {
+		resourceControlService portainer.ResourceControlService
+		userService            portainer.UserService
+		teamService            portainer.TeamService
+		teamMembershipService  portainer.TeamMembershipService
+		settingsService        portainer.SettingsService
+		registryService        portainer.RegistryService
+		dockerHubService       portainer.DockerHubService
+		signatureService       portainer.DigitalSignatureService
+		reverseTunnelService   portainer.ReverseTunnelService
+		extensionService       portainer.ExtensionService
+		dockerClientFactory    *docker.ClientFactory
+	}
+
+	// ProxyFactoryParameters is used to create a new ProxyFactory
+	ProxyFactoryParameters struct {
+		ResourceControlService portainer.ResourceControlService
+		UserService            portainer.UserService
+		TeamService            portainer.TeamService
+		TeamMembershipService  portainer.TeamMembershipService
+		SettingsService        portainer.SettingsService
+		RegistryService        portainer.RegistryService
+		DockerHubService       portainer.DockerHubService
+		SignatureService       portainer.DigitalSignatureService
+		ReverseTunnelService   portainer.ReverseTunnelService
+		ExtensionService       portainer.ExtensionService
+		DockerClientFactory    *docker.ClientFactory
+	}
+)
+
+// NewProxyFactory returns a pointer to a new instance of a ProxyFactory
+func NewProxyFactory(parameters *ProxyFactoryParameters) *ProxyFactory {
+	return &ProxyFactory{
+		resourceControlService: parameters.ResourceControlService,
+		userService:            parameters.UserService,
+		teamService:            parameters.TeamService,
+		teamMembershipService:  parameters.TeamMembershipService,
+		settingsService:        parameters.SettingsService,
+		registryService:        parameters.RegistryService,
+		dockerHubService:       parameters.DockerHubService,
+		signatureService:       parameters.SignatureService,
+		reverseTunnelService:   parameters.ReverseTunnelService,
+		extensionService:       parameters.ExtensionService,
+		dockerClientFactory:    parameters.DockerClientFactory,
+	}
+}
+
+// BuildExtensionURL returns the URL to an extension server
+func BuildExtensionURL(extensionID portainer.ExtensionID) string {
+	return fmt.Sprintf("http://%s:%s", portainer.ExtensionServer, extensionPorts[extensionID])
+}
+
+// NewExtensionProxy returns a new HTTP proxy to an extension server
+func (factory *ProxyFactory) NewExtensionProxy(extensionID portainer.ExtensionID) (http.Handler, error) {
+	address := "http://" + portainer.ExtensionServer + ":" + extensionPorts[extensionID]
+
+	extensionURL, err := url.Parse(address)
+	if err != nil {
+		return nil, err
+	}
+
+	extensionURL.Scheme = "http"
+	proxy := httputil.NewSingleHostReverseProxy(extensionURL)
+	return proxy, nil
+}
+
+// NewLegacyExtensionProxy returns a new HTTP proxy to a legacy extension server (Storidge)
+func (factory *ProxyFactory) NewLegacyExtensionProxy(extensionAPIURL string) (http.Handler, error) {
+	extensionURL, err := url.Parse(extensionAPIURL)
+	if err != nil {
+		return nil, err
+	}
+
+	extensionURL.Scheme = "http"
+	proxy := httputil.NewSingleHostReverseProxy(extensionURL)
+	return proxy, nil
+}
+
+// NewEndpointProxy returns a new reverse proxy (filesystem based or HTTP) to an endpoint API server
+func (factory *ProxyFactory) NewEndpointProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	switch endpoint.Type {
+	case portainer.AzureEnvironment:
+		return newAzureProxy(endpoint)
+	}
+
+	return factory.newDockerProxy(endpoint)
+}