Commit 674f1701 authored by Kevin Di Lallo's avatar Kevin Di Lallo
Browse files

service permissions configuration & cleanup + meep-sessions updates

parent cb8e1e70

config/permissions.yaml

0 → 100644
+717 −0
Original line number Diff line number Diff line 
# Copyright (c) 2020  InterDigital Communications, Inc

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

#     http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.





# Service API & File Server Access Permissions

# 

# Each service provides route-specific access authorization mode & role permissions:

# - Route name uniquely identifies http router paths

#   -> NOTE: route names are case-insensitive

# - 'mode' is the access authorization mode

#   -> allow: grant access 

#   -> block: deny access

#   -> verify: obtain session role & verify role-specific access permissions

# - 'roles' is a map of role permissions

#   -> allow: grant access 

#   -> block: deny access 

#

# Default access mode & role permissions are used when service-specific

# values are not provided.

#

services:



  #------------------------------

  #  Default

  #------------------------------

  # Default access mode & permissions for File Server & API routes

  default:

    # access authorization mode: allow|block|verify

    mode: 'block'

    # role permissions: allow|block

    roles:

      admin: 'allow'

      user: 'block'



  #------------------------------

  #  GIS Engine

  #------------------------------

  meep-gis-engine:

    # REST API endpoint routes: names provided to endpoint routes during router initialization

    Index:

      # access authorization mode: allow|block|verify

      mode: 'block'

    GetAutomationState:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    GetAutomationStateByName:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    SetAutomationStateByName:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    DeleteGeoDataByName:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    GetAssetData:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    GetGeoDataByName:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    UpdateGeoDataByName:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'



  #------------------------------

  #  Location Service

  #------------------------------

  meep-loc-serv:

    # REST API endpoint routes: names provided to endpoint routes during router initialization

    Index:

      # access authorization mode: allow|block|verify

      mode: 'block'

    UserTrackingSubDelById:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    UserTrackingSubGet:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    UserTrackingSubGetById:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    UserTrackingSubPost:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    UserTrackingSubPutById:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZonalTrafficSubDelById:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZonalTrafficSubGet:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZonalTrafficSubGetById:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZonalTrafficSubPost:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZonalTrafficSubPutById:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZoneStatusDelById:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZoneStatusGet:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZoneStatusGetById:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZoneStatusPost:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZoneStatusPutById:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    UsersGet:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    UsersGetById:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZonesByIdGetAps:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZonesByIdGetApsById:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZonesGet:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    ZonesGetById:

      # access authorization mode: allow|block|verify

      mode: 'allow'



  #------------------------------

  #  Metrics Engine

  #------------------------------

  meep-metrics-engine:

    # REST API endpoint routes: names provided to endpoint routes during router initialization

    IndexV2:

      # access authorization mode: allow|block|verify

      mode: 'block'

    PostEventQuery:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    PostHttpQuery:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    PostNetworkQuery:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    CreateEventSubscription:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    CreateNetworkSubscription:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    DeleteEventSubscriptionById:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    DeleteNetworkSubscriptionById:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    GetEventSubscription:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    GetEventSubscriptionById:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    GetNetworkSubscription:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    GetNetworkSubscriptionById:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'



  #------------------------------

  #  Mobility Group Manager

  #------------------------------

  meep-mg-manager:

    # REST API endpoint routes: names provided to endpoint routes during router initialization

    Index:

      # access authorization mode: allow|block|verify

      mode: 'block'

    CreateMobilityGroup:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    CreateMobilityGroupApp:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    CreateMobilityGroupUe:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    DeleteMobilityGroup:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    DeleteMobilityGroupApp:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    GetMobilityGroup:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    GetMobilityGroupApp:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    GetMobilityGroupAppList:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    GetMobilityGroupList:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    SetMobilityGroup:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    SetMobilityGroupApp:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    TransferAppState:

      # access authorization mode: allow|block|verify

      mode: 'allow'



  #------------------------------

  #  Monitoring Engine

  #------------------------------

  meep-mon-engine:

    # REST API endpoint routes: names provided to endpoint routes during router initialization

    Index:

      # access authorization mode: allow|block|verify

      mode: 'block'

    GetStates:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'



  #------------------------------

  #  Platform Controller

  #------------------------------

  meep-platform-ctrl:

    # File server routes: names provided to file server routes during router initialization

    AltSw:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    AltFe:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    PriSw:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    PriFe:

      # access authorization mode: allow|block|verify

      mode: 'allow'



    # REST API endpoint routes: names provided to endpoint routes during router initialization

    Index:

      # access authorization mode: allow|block|verify

      mode: 'block'

    CreateSandbox:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    CreateSandboxWithName:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    DeleteSandbox:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    DeleteSandboxList:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    GetSandbox:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    GetSandboxList:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    CreateScenario:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    DeleteScenario:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    DeleteScenarioList:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    GetScenario:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    GetScenarioList:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    SetScenario:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    LoginUser:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    LogoutUser:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'



  #------------------------------

  #  RNI Service

  #------------------------------

  meep-rnis:

    # REST API endpoint routes: names provided to endpoint routes during router initialization

    Index:

      # access authorization mode: allow|block|verify

      mode: 'block'

    CaReConfSubscriptionSubscriptionsGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    CaReConfSubscriptionSubscriptionsPOST:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    CaReConfSubscriptionSubscriptionsPUT:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    CaReConfSubscriptionsSubscrIdDELETE:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    CellChangeSubscriptionsGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    CellChangeSubscriptionsPOST:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    CellChangeSubscriptionsPUT:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    CellChangeSubscriptionsSubscrIdDELETE:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    MeasRepUeReportSubscriptionsPUT:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    MeasRepUeSubscriptionsGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    MeasRepUeSubscriptionsPOST:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    MeasRepUeSubscriptionsSubscrIdDELETE:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    MeasTaSubscriptionsGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    MeasTaSubscriptionsPOST:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    MeasTaSubscriptionsPUT:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    MeasTaSubscriptionsSubscrIdDELETE:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    PlmnInfoGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabEstSubscriptionSubscriptionsGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabEstSubscriptionSubscriptionsPOST:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabEstSubscriptionSubscriptionsPUT:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabEstSubscriptionsSubscrIdDELETE:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabInfoGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabModSubscriptionSubscriptionsGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabModSubscriptionSubscriptionsPOST:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabModSubscriptionSubscriptionsPUT:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabModSubscriptionsSubscrIdDELETE:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabRelSubscriptionSubscriptionsGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabRelSubscriptionSubscriptionsPOST:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabRelSubscriptionSubscriptionsPUT:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    RabRelSubscriptionsSubscrIdDELETE:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    S1BearerInfoGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    S1BearerSubscriptionSubscriptionsGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    S1BearerSubscriptionSubscriptionsPOST:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    S1BearerSubscriptionSubscriptionsPUT:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    S1BearerSubscriptionsSubscrIdDELETE:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    SubscriptionLinkListSubscriptionsCcGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    SubscriptionLinkListSubscriptionsCrGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    SubscriptionLinkListSubscriptionsGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    SubscriptionLinkListSubscriptionsMrGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    SubscriptionLinkListSubscriptionsReGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    SubscriptionLinkListSubscriptionsRmGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    SubscriptionLinkListSubscriptionsRrGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    SubscriptionLinkListSubscriptionsS1GET:

      # access authorization mode: allow|block|verify

      mode: 'allow'

    SubscriptionLinkListSubscriptionsTaGET:

      # access authorization mode: allow|block|verify

      mode: 'allow'



  #------------------------------

  #  Sandbox Controller

  #------------------------------

  meep-sandbox-ctrl:

    # File server routes

    AltSw:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    PriSw:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'



    # REST API endpoints

    Index:

      # access authorization mode: allow|block|verify

      mode: 'block'

    ActivateScenario:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    GetActiveNodeServiceMaps:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    GetActiveScenario:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    TerminateScenario:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'allow'

    CreateReplayFile:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    CreateReplayFileFromScenarioExec:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    DeleteReplayFile:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    DeleteReplayFileList:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    GetReplayFile:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    GetReplayFileList:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    GetReplayStatus:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    LoopReplay:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    PlayReplayFile:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    StopReplayFile:

      # access authorization mode: allow|block|verify

      mode: 'verify'

      # role permissions: allow|block

      roles:

        admin: 'allow'

        user: 'block'

    SendEvent:

      # access authorization mode: allow|block|verify

      mode: 'allow'

go-apps/meep-gis-engine/main.go

+1 −12
Original line number Diff line number Diff line
@@ -25,7 +25,6 @@ import ( 


	server "github.com/InterDigitalInc/AdvantEDGE/go-apps/meep-gis-engine/server"

	log "github.com/InterDigitalInc/AdvantEDGE/go-packages/meep-logger"

	ss "github.com/InterDigitalInc/AdvantEDGE/go-packages/meep-sessions"



	"github.com/gorilla/handlers"

)
@@ -67,17 +66,7 @@ func main() { 
		}



		// Start GIS Engine REST API Server

		accessMap := map[string]string{

			"Index":                    ss.AccessBlock,

			"GetAutomationState":       ss.AccessVerify,

			"GetAutomationStateByName": ss.AccessVerify,

			"SetAutomationStateByName": ss.AccessVerify,

			"DeleteGeoDataByName":      ss.AccessBlock,

			"GetAssetData":             ss.AccessVerify,

			"GetGeoDataByName":         ss.AccessVerify,

			"UpdateGeoDataByName":      ss.AccessBlock,

		}

		router := server.NewRouter(accessMap)

		router := server.NewRouter()

		methods := handlers.AllowedMethods([]string{"DELETE", "GET", "POST"})

		header := handlers.AllowedHeaders([]string{"content-type"})

		log.Fatal(http.ListenAndServe(":80", handlers.CORS(methods, header)(router)))

go-apps/meep-gis-engine/server/gis-engine.go

+6 −6
Original line number Diff line number Diff line
@@ -34,7 +34,7 @@ import ( 
	mq "github.com/InterDigitalInc/AdvantEDGE/go-packages/meep-mq"

	postgis "github.com/InterDigitalInc/AdvantEDGE/go-packages/meep-postgis"

	sbox "github.com/InterDigitalInc/AdvantEDGE/go-packages/meep-sandbox-ctrl-client"

	ss "github.com/InterDigitalInc/AdvantEDGE/go-packages/meep-sessions"

	sm "github.com/InterDigitalInc/AdvantEDGE/go-packages/meep-sessions"

	"github.com/gorilla/mux"

)
@@ -74,7 +74,7 @@ type GisEngine struct { 
	handlerId      int

	sboxCtrlClient *sbox.APIClient

	activeModel    *mod.Model

	sessionStore   *ss.SessionStore

	sessionMgr     *sm.SessionMgr

	pc             *postgis.Connector

	assets         map[string]Asset

	uePoaInfo      map[string]PoaInfo
@@ -137,13 +137,13 @@ func Init() (err error) { 
		return err

	}



	// Connect to Session Store

	ge.sessionStore, err = ss.NewSessionStore(redisAddr)

	// Connect to Session Manager

	ge.sessionMgr, err = sm.NewSessionMgr(moduleName, redisAddr, redisAddr)

	if err != nil {

		log.Error("Failed connection to Session Store: ", err.Error())

		log.Error("Failed connection to Session Manager: ", err.Error())

		return err

	}

	log.Info("Connected to Session Store")

	log.Info("Connected to Session Manager")



	// Connect to Postgis DB

	ge.pc, err = postgis.NewConnector(moduleName, ge.sandboxName, postgisUser, postgisPwd, "", "")

go-apps/meep-gis-engine/server/routers.go

+2 −25

File changed.

Preview size limit exceeded, changes collapsed.

go-apps/meep-loc-serv/go.mod

+3 −1

File changed.

Preview size limit exceeded, changes collapsed.