working commit

app/handler/blob.go

@@ -11,9 +11,11 @@
 package handler
 
 import (
+	"fmt"
 	"io"
 	"net/http"
 
+	"mstore/app/descr"
 	"mstore/app/operator"
 	"mstore/app/router"
 )
@@ -29,6 +31,20 @@ func (hand *Handler) BlobExists(rctx *router.Context) {
 		Name:   name,
 		Digest: digest,
 	}
+	// Rigth checking
+	operatorID, _ := rctx.GetString(userTag)
+	opEnable, err := hand.CheckRight(rctx.Ctx, operatorID, descr.RightReadImages, "")
+	if err != nil {
+		err := fmt.Errorf("Operation error: %v", err)
+		hand.SendError(rctx, err)
+		return
+	}
+	if !opEnable {
+		err := fmt.Errorf("Operation not enabled for this account")
+		hand.SendError(rctx, err)
+		return
+	}
+	// Execution of the operation
 	ctx := rctx.GetContext()
 	res, code, err := hand.oper.BlobExists(ctx, params)
 	if err != nil {
@@ -57,6 +73,20 @@ func (hand *Handler) PostUpload(rctx *router.Context) {
 		Mount:  mount,
 		From:   from,
 	}
+	// Rigth checking
+	operatorID, _ := rctx.GetString(userTag)
+	opEnable, err := hand.CheckRight(rctx.Ctx, operatorID, descr.RightWriteImages, "")
+	if err != nil {
+		err := fmt.Errorf("Operation error: %v", err)
+		hand.SendError(rctx, err)
+		return
+	}
+	if !opEnable {
+		err := fmt.Errorf("Operation not enabled for this account")
+		hand.SendError(rctx, err)
+		return
+	}
+	// Execution of the operation
 	res, code, err := hand.oper.PostUpload(rctx.Ctx, params)
 	if err != nil {
 		hand.logg.Errorf("PostUpload error: %v", err)
@@ -90,6 +120,20 @@ func (hand *Handler) PatchUpload(rctx *router.Context) {
 		Reference:     reference,
 		Reader:        reader,
 	}
+	// Rigth checking
+	operatorID, _ := rctx.GetString(userTag)
+	opEnable, err := hand.CheckRight(rctx.Ctx, operatorID, descr.RightWriteImages, "")
+	if err != nil {
+		err := fmt.Errorf("Operation error: %v", err)
+		hand.SendError(rctx, err)
+		return
+	}
+	if !opEnable {
+		err := fmt.Errorf("Operation not enabled for this account")
+		hand.SendError(rctx, err)
+		return
+	}
+	// Execution of the operation
 	ctx := rctx.GetContext()
 	res, code, err := hand.oper.PatchUpload(ctx, params)
 	if err != nil {
@@ -122,6 +166,20 @@ func (hand *Handler) PutUpload(rctx *router.Context) {
 		Reference:     reference,
 		Digest:        digest,
 	}
+	// Rigth checking
+	operatorID, _ := rctx.GetString(userTag)
+	opEnable, err := hand.CheckRight(rctx.Ctx, operatorID, descr.RightWriteImages, "")
+	if err != nil {
+		err := fmt.Errorf("Operation error: %v", err)
+		hand.SendError(rctx, err)
+		return
+	}
+	if !opEnable {
+		err := fmt.Errorf("Operation not enabled for this account")
+		hand.SendError(rctx, err)
+		return
+	}
+	// Execution of the operation
 	res, code, err := hand.oper.PutUpload(rctx.Ctx, params)
 	if err != nil {
 		hand.logg.Errorf("PutUpload error: %v", err)
@@ -140,6 +198,20 @@ func (hand *Handler) GetBlob(rctx *router.Context) {
 		Name:   name,
 		Digest: digest,
 	}
+	// Rigth checking
+	operatorID, _ := rctx.GetString(userTag)
+	opEnable, err := hand.CheckRight(rctx.Ctx, operatorID, descr.RightReadImages, "")
+	if err != nil {
+		err := fmt.Errorf("Operation error: %v", err)
+		hand.SendError(rctx, err)
+		return
+	}
+	if !opEnable {
+		err := fmt.Errorf("Operation not enabled for this account")
+		hand.SendError(rctx, err)
+		return
+	}
+	// Execution of the operation
 	ctx := rctx.GetContext()
 	res, code, err := hand.oper.GetBlob(ctx, params)
 	if err != nil {
@@ -174,6 +246,20 @@ func (hand *Handler) DeleteBlob(rctx *router.Context) {
 		Name:   name,
 		Digest: digest,
 	}
+	// Rigth checking
+	operatorID, _ := rctx.GetString(userTag)
+	opEnable, err := hand.CheckRight(rctx.Ctx, operatorID, descr.RightWriteImages, "")
+	if err != nil {
+		err := fmt.Errorf("Operation error: %v", err)
+		hand.SendError(rctx, err)
+		return
+	}
+	if !opEnable {
+		err := fmt.Errorf("Operation not enabled for this account")
+		hand.SendError(rctx, err)
+		return
+	}
+	// Execution of the operation
 	ctx := rctx.GetContext()
 	_, code, err := hand.oper.DeleteBlob(ctx, params)
 	if err != nil {