krabka_authz/
allow_all.rs

1//! Default authorizer when authorization is unset.
2//!
3//! This authorizer returns `Allow` for any request. It is an explicit type, so
4//! the "allow everything" behavior is clear at config time. The behavior does
5//! not come from the empty-input path of the ACL implementation.
6
7use {
8    crate::{AclSource, AuthorizationRequest, AuthorizationResult, Authorizer},
9    std::net::SocketAddr,
10};
11
12/// Authorizer that always returns [`AuthorizationResult::Allow`].
13///
14/// This is the default authorizer value. An operator selects it with
15/// `type = "allow_all"` in the broker or gateway config, or by omission of the
16/// field.
17#[derive(Debug, Default)]
18pub struct AllowAllAuthorizer;
19
20impl Authorizer for AllowAllAuthorizer {
21    fn authorize(
22        &self,
23        _source: &dyn AclSource,
24        _req: &AuthorizationRequest<'_>,
25    ) -> AuthorizationResult {
26        AuthorizationResult::Allow
27    }
28
29    /// `false`: this is the value a deployment holds when it configured no
30    /// authorizer, which is what the ACL administration RPCs report as
31    /// `SECURITY_DISABLED`.
32    fn is_configured(&self) -> bool { false }
33
34    /// Always `Allow`, for the same reason `authorize` is: this authorizer
35    /// never denies anything, on any resource of any type.
36    fn authorize_by_resource_type(
37        &self,
38        _source: &dyn AclSource,
39        _principal: &krabka_security::Principal,
40        _host: &SocketAddr,
41        _resource_type: krabka_metadata::ResourceType,
42        _operation: krabka_metadata::AclOperation,
43    ) -> AuthorizationResult {
44        AuthorizationResult::Allow
45    }
46}
47
48#[cfg(test)]
49mod tests {
50    use {
51        super::*,
52        krabka_metadata::{AclOperation, MetadataImage, ResourceType},
53        krabka_security::{AuthMethod, Principal},
54        std::net::SocketAddr,
55        uuid::Uuid,
56    };
57
58    struct RequestIdentity {
59        image: MetadataImage,
60        principal: Principal,
61        host: SocketAddr,
62    }
63
64    fn request_identity() -> RequestIdentity {
65        let image = MetadataImage::new(Uuid::nil());
66        let principal = Principal {
67            name: "alice".into(),
68            auth_method: AuthMethod::SaslPlain,
69            groups: vec![],
70        };
71        let host = "1.2.3.4:9092".parse().unwrap();
72        RequestIdentity {
73            image,
74            principal,
75            host,
76        }
77    }
78
79    #[test]
80    fn allow_all_returns_allow_for_any_request() {
81        let RequestIdentity {
82            image: img,
83            principal: p,
84            host,
85        } = request_identity();
86        let req = AuthorizationRequest {
87            principal: &p,
88            host: &host,
89            resource_type: ResourceType::Topic,
90            resource_name: "anything",
91            operation: AclOperation::Write,
92        };
93        assert2::assert!(AllowAllAuthorizer.authorize(&img, &req) == AuthorizationResult::Allow);
94    }
95
96    #[test]
97    fn allow_all_is_not_a_configured_authorizer() {
98        assert2::assert!(!AllowAllAuthorizer.is_configured());
99    }
100
101    #[test]
102    fn allow_all_authorizes_by_resource_type_for_any_request() {
103        let RequestIdentity {
104            image: img,
105            principal: p,
106            host,
107        } = request_identity();
108        assert2::assert!(
109            AllowAllAuthorizer.authorize_by_resource_type(
110                &img,
111                &p,
112                &host,
113                ResourceType::Topic,
114                AclOperation::Write,
115            ) == AuthorizationResult::Allow
116        );
117    }
118}
krabka_authz/allow_all.rs

krabka_authz/
allow_all.rs
