working commit

app/handler/manifest.go

@@ -10,8 +10,10 @@
 package handler
 
 import (
+	"fmt"
 	"net/http"
 
+	"mstore/app/descr"
 	"mstore/app/operator"
 	"mstore/app/router"
 )
@@ -24,6 +26,20 @@ func (hand *Handler) ManifestExists(rctx *router.Context) {
 		Name:      name,
 		Reference: reference,
 	}
+	// Rigth checking
+	operatorID, _ := rctx.GetString(userTag)
+	opEnable, err := hand.CheckRight(rctx.Ctx, operatorID, descr.RightReadImages, "")
+	if err != nil {
+		err := fmt.Errorf("Operation error: %v", err)
+		hand.SendError(rctx, err)
+		return
+	}
+	if !opEnable {
+		err := fmt.Errorf("Operation not enabled for this account")
+		hand.SendError(rctx, err)
+		return
+	}
+	// Execution of the operation
 	ctx := rctx.GetContext()
 	res, code, err := hand.oper.ManifestExists(ctx, params)
 	if err != nil {
@@ -54,6 +70,20 @@ func (hand *Handler) PutManifest(rctx *router.Context) {
 		Reference:     reference,
 		Reader:        rctx.Request.Body,
 	}
+	// Rigth checking
+	operatorID, _ := rctx.GetString(userTag)
+	opEnable, err := hand.CheckRight(rctx.Ctx, operatorID, descr.RightWriteImages, "")
+	if err != nil {
+		err := fmt.Errorf("Operation error: %v", err)
+		hand.SendError(rctx, err)
+		return
+	}
+	if !opEnable {
+		err := fmt.Errorf("Operation not enabled for this account")
+		hand.SendError(rctx, err)
+		return
+	}
+	// Execution of the operation
 	ctx := rctx.GetContext()
 	res, code, err := hand.oper.PutManifest(ctx, params)
 	if err != nil {
@@ -73,6 +103,20 @@ func (hand *Handler) GetManifest(rctx *router.Context) {
 		Name:      name,
 		Reference: reference,
 	}
+	// Rigth checking
+	operatorID, _ := rctx.GetString(userTag)
+	opEnable, err := hand.CheckRight(rctx.Ctx, operatorID, descr.RightReadImages, "")
+	if err != nil {
+		err := fmt.Errorf("Operation error: %v", err)
+		hand.SendError(rctx, err)
+		return
+	}
+	if !opEnable {
+		err := fmt.Errorf("Operation not enabled for this account")
+		hand.SendError(rctx, err)
+		return
+	}
+	// Execution of the operation
 	ctx := rctx.GetContext()
 	res, code, err := hand.oper.GetManifest(ctx, params)
 	if err != nil {
@@ -99,6 +143,20 @@ func (hand *Handler) DeleteManifest(rctx *router.Context) {
 		Name:      name,
 		Reference: reference,
 	}
+	// Rigth checking
+	operatorID, _ := rctx.GetString(userTag)
+	opEnable, err := hand.CheckRight(rctx.Ctx, operatorID, descr.RightWriteImages, "")
+	if err != nil {
+		err := fmt.Errorf("Operation error: %v", err)
+		hand.SendError(rctx, err)
+		return
+	}
+	if !opEnable {
+		err := fmt.Errorf("Operation not enabled for this account")
+		hand.SendError(rctx, err)
+		return
+	}
+	// Execution of the operation
 	ctx := rctx.GetContext()
 	_, code, err := hand.oper.DeleteManifest(ctx, params)
 	if err != nil {
@@ -116,6 +174,20 @@ func (hand *Handler) GetReferer(rctx *router.Context) {
 		Name:   name,
 		Digest: digest,
 	}
+	// Rigth checking
+	operatorID, _ := rctx.GetString(userTag)
+	opEnable, err := hand.CheckRight(rctx.Ctx, operatorID, descr.RightReadImages, "")
+	if err != nil {
+		err := fmt.Errorf("Operation error: %v", err)
+		hand.SendError(rctx, err)
+		return
+	}
+	if !opEnable {
+		err := fmt.Errorf("Operation not enabled for this account")
+		hand.SendError(rctx, err)
+		return
+	}
+	// Execution of the operation
 	res, code, err := hand.oper.GetReferer(rctx.Ctx, params)
 	if err != nil {
 		hand.logg.Errorf("GetReferer error: %v", err)
@@ -130,6 +202,20 @@ func (hand *Handler) GetTags(rctx *router.Context) {
 	params := &operator.GetTagsParams{
 		Name: name,
 	}
+	// Rigth checking
+	operatorID, _ := rctx.GetString(userTag)
+	opEnable, err := hand.CheckRight(rctx.Ctx, operatorID, descr.RightReadImages, "")
+	if err != nil {
+		err := fmt.Errorf("Operation error: %v", err)
+		hand.SendError(rctx, err)
+		return
+	}
+	if !opEnable {
+		err := fmt.Errorf("Operation not enabled for this account")
+		hand.SendError(rctx, err)
+		return
+	}
+	// Execution of the operation
 	ctx := rctx.GetContext()
 	res, code, err := hand.oper.GetTags(ctx, params)
 	if err != nil {