Add authorized actions output on resources (#870)

internal/auth/additional_verification_test.go

@@ -153,7 +153,7 @@ func TestAdditionalVerification(t *testing.T) {
 	}
 }
 
-func TestFetchActionsForId(t *testing.T) {
+func TestFetchActionSetForId(t *testing.T) {
 	tc := controller.NewTestController(t, nil)
 	defer tc.Shutdown()
 
@@ -182,8 +182,8 @@ func TestFetchActionsForId(t *testing.T) {
 	cases := []struct {
 		name         string
 		id           string
-		avail        action.Actions
-		allowed      action.Actions
+		avail        action.ActionSet
+		allowed      action.ActionSet
 		typeOverride resource.Type
 	}{
 		{
@@ -192,13 +192,13 @@ func TestFetchActionsForId(t *testing.T) {
 		{
 			name:  "no match",
 			id:    "zip",
-			avail: action.Actions{action.Read, action.Update},
+			avail: action.ActionSet{action.Read, action.Update},
 		},
 		{
 			name:    "disjoint match",
 			id:      "bar",
-			avail:   action.Actions{action.Delete, action.AddGrants, action.Read, action.RemoveHostSets},
-			allowed: action.Actions{action.Delete, action.Read},
+			avail:   action.ActionSet{action.Delete, action.AddGrants, action.Read, action.RemoveHostSets},
+			allowed: action.ActionSet{action.Delete, action.Read},
 		},
 		{
 			name:         "different type",
@@ -209,8 +209,8 @@ func TestFetchActionsForId(t *testing.T) {
 			name:         "type match",
 			id:           "anything",
 			typeOverride: resource.Role,
-			avail:        action.Actions{action.Read, action.AddGrants},
-			allowed:      action.Actions{action.AddGrants},
+			avail:        action.ActionSet{action.Read, action.AddGrants},
+			allowed:      action.ActionSet{action.AddGrants},
 		},
 	}
 	for _, tt := range cases {
@@ -239,7 +239,7 @@ func TestFetchActionsForId(t *testing.T) {
 				auth.WithType(typ),
 			}...)
 			req.NoError(res.Error)
-			assert.Equal(t, tt.allowed, res.FetchActionsForId(ctx, tt.id, tt.avail))
+			assert.Equal(t, tt.allowed, res.FetchActionSetForId(ctx, tt.id, tt.avail))
 		})
 	}
 }

internal/auth/auth.go

@@ -554,9 +554,19 @@ func (r *VerifyResults) AdditionalVerification(ctx context.Context, opt ...Optio
 	return
 }
 
-// FetchActionsForId returns the allowed actions for a given ID using the
-// current set of ACLs and all other parameters the same (user, scope, etc.)
-func (r *VerifyResults) FetchActionsForId(ctx context.Context, id string, availableActions action.Actions, opt ...Option) action.Actions {
+// FetchActionSetForId returns the allowed actions for a given ID using the
+// current set of ACLs and all other parameters the same (user, etc.)
+func (r *VerifyResults) FetchActionSetForId(ctx context.Context, id string, availableActions action.ActionSet, opt ...Option) action.ActionSet {
+	return r.fetchActions(ctx, id, resource.Unknown, availableActions, opt...)
+}
+
+// FetchActionSetForType returns the allowed actions for a given collection type
+// using the current set of ACLs and all other parameters the same (user, etc.)
+func (r *VerifyResults) FetchActionSetForType(ctx context.Context, typ resource.Type, availableActions action.ActionSet, opt ...Option) action.ActionSet {
+	return r.fetchActions(ctx, "", typ, availableActions, opt...)
+}
+
+func (r *VerifyResults) fetchActions(ctx context.Context, id string, typ resource.Type, availableActions action.ActionSet, opt ...Option) action.ActionSet {
 	switch {
 	case r.v.requestInfo.DisableAuthEntirely,
 		r.v.requestInfo.TokenFormat == AuthTokenTypeRecoveryKms:
@@ -573,9 +583,14 @@ func (r *VerifyResults) FetchActionsForId(ctx context.Context, id string, availa
 	if res == nil {
 		res = new(perms.Resource)
 	}
-	res.Id = id
+	if id != "" {
+		res.Id = id
+	}
+	if typ != resource.Unknown {
+		res.Type = typ
+	}
 
-	ret := make(action.Actions, 0, len(availableActions))
+	ret := make(action.ActionSet, 0, len(availableActions))
 	for _, act := range availableActions {
 		if r.v.acl.Allowed(*res, act).Allowed {
 			ret = append(ret, act)