Skip to content

Commit aa845f0

Browse files
bkemburuBhavesh Kemburu
bkemburu
authored and
Bhavesh Kemburu
committed
Update application.conf
Changed Flag to shared-packages-execute-only with default value set to false.
1 parent 989ad61 commit aa845f0

6 files changed

Lines changed: 126 additions & 102 deletions

File tree

‎common/scala/src/main/resources/application.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ kamon {
9999
}
100100

101101
whisk {
102-
#packages-execute-only = true
102+
shared-packages-execute-only = false
103103
metrics {
104104
# Enable/disable Prometheus support. If enabled then metrics would be exposed at `/metrics` endpoint
105105
# If Prometheus is enabled then please review `kamon.metric.tick-interval` (set to 1 sec by default above).

‎common/scala/src/main/scala/org/apache/openwhisk/core/WhiskConfig.scala‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -273,4 +273,4 @@ object ConfigKeys {
273273
val apacheClientConfig = "whisk.apache-client"
274274

275275
val parameterStorage = "whisk.parameter-storage"
276-
}
276+
}

‎core/controller/src/main/scala/org/apache/openwhisk/core/controller/Actions.scala‎

Lines changed: 57 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ import org.apache.openwhisk.core.entitlement.Collection
4646
import org.apache.openwhisk.core.loadBalancer.LoadBalancerException
4747
import pureconfig._
4848
import org.apache.openwhisk.core.ConfigKeys
49+
4950
/**
5051
* A singleton object which defines the properties that must be present in a configuration
5152
* in order to implement the actions API.
@@ -105,9 +106,10 @@ trait WhiskActionsApi extends WhiskCollectionAPI with PostActionActivation with
105106
protected val activationStore: ActivationStore
106107

107108
/** Config flag for Execute Only for Actions in Shared Packages */
108-
protected def executeOnly = Try({
109-
loadConfigOrThrow[Boolean](ConfigKeys.sharedPackageExecuteOnly)
110-
}).getOrElse(false)
109+
protected def executeOnly =
110+
Try({
111+
loadConfigOrThrow[Boolean](ConfigKeys.sharedPackageExecuteOnly)
112+
}).getOrElse(false)
111113

112114
/** Entity normalizer to JSON object. */
113115
import RestApiCommons.emptyEntityToJsObject
@@ -337,8 +339,6 @@ trait WhiskActionsApi extends WhiskCollectionAPI with PostActionActivation with
337339
deleteEntity(WhiskAction, entityStore, entityName.toDocId, (a: WhiskAction) => Future.successful({}))
338340
}
339341

340-
341-
342342
/**
343343
* Gets action. The action name is prefixed with the namespace to create the primary index key.
344344
*
@@ -352,21 +352,34 @@ trait WhiskActionsApi extends WhiskCollectionAPI with PostActionActivation with
352352
parameter('code ? true) { code =>
353353
//check if execute only is enabled, and if there is a discrepancy between the current user's namespace
354354
//and that of the entity we are trying to fetch
355-
if (executeOnly && user.namespace.name.toString != entityName.namespace.toString) {
355+
356+
if (executeOnly && user.namespace.name != entityName.namespace) {
356357
val value = entityName.path
357-
terminate(StatusCode.int2StatusCode(403), s"GET not permitted for '$value' since it's an action in a shared package")
358+
terminate(
359+
StatusCode.int2StatusCode(403),
360+
s"GET not permitted for '$value' since it's an action in a shared package")
358361
} else {
359362
code match {
360363
case true =>
361-
//Resolve Binding(Package) of the action
364+
//Resolve Binding(Package) of the action
365+
if (entityName.path.defaultPackage) {
366+
getEntity(WhiskAction.resolveActionAndMergeParameters(entityStore, entityName), Some {
367+
action: WhiskAction =>
368+
val mergedAction = env map {
369+
action inherit _
370+
} getOrElse action
371+
complete(OK, mergedAction)
372+
})
373+
} else {
362374
getEntity(
363375
WhiskPackage.resolveBinding(entityStore, entityName.path.toDocId, mergeParameters = true),
364-
Some {pkg: WhiskPackage =>
376+
Some { pkg: WhiskPackage =>
365377
val originalPackageLocation = pkg.fullyQualifiedName(withVersion = false).namespace
366-
if (executeOnly && originalPackageLocation != entityName.namespace){
367-
terminate(StatusCode.int2StatusCode(403),
378+
if (executeOnly && originalPackageLocation != entityName.namespace) {
379+
terminate(
380+
StatusCode.int2StatusCode(403),
368381
s"GET not permitted for '${entityName.toDocId}'. Resource does not exist or an action in a shared package binding")
369-
}else{
382+
} else {
370383
getEntity(WhiskAction.resolveActionAndMergeParameters(entityStore, entityName), Some {
371384
action: WhiskAction =>
372385
val mergedAction = env map {
@@ -375,33 +388,42 @@ trait WhiskActionsApi extends WhiskCollectionAPI with PostActionActivation with
375388
complete(OK, mergedAction)
376389
})
377390
}
378-
}
379-
)
391+
})
392+
}
380393
case false =>
381-
getEntity(
382-
WhiskPackage.resolveBinding(entityStore, entityName.path.toDocId, mergeParameters = true),
383-
Some {pkg: WhiskPackage =>
384-
val originalPackageLocation = pkg.fullyQualifiedName(withVersion = false).namespace
385-
if (executeOnly && originalPackageLocation != entityName.namespace){
386-
terminate(StatusCode.int2StatusCode(403),
387-
s"GET not permitted for '${entityName.toDocId}'. Resource does not exist or an action in a shared package binding")
388-
}else{
389-
getEntity(WhiskActionMetaData.resolveActionAndMergeParameters(entityStore, entityName), Some {
390-
action: WhiskActionMetaData =>
391-
val mergedAction = env map {
392-
action inherit _
393-
} getOrElse action
394-
complete(OK, mergedAction)
395-
})
396-
}
397-
}
398-
)
399-
}
400-
}
394+
if (entityName.path.defaultPackage) {
395+
getEntity(WhiskActionMetaData.resolveActionAndMergeParameters(entityStore, entityName), Some {
396+
action: WhiskActionMetaData =>
397+
val mergedAction = env map {
398+
action inherit _
399+
} getOrElse action
400+
complete(OK, mergedAction)
401+
})
402+
} else {
403+
getEntity(
404+
WhiskPackage.resolveBinding(entityStore, entityName.path.toDocId, mergeParameters = true),
405+
Some { pkg: WhiskPackage =>
406+
val originalPackageLocation = pkg.fullyQualifiedName(withVersion = false).namespace
407+
if (executeOnly && originalPackageLocation != entityName.namespace) {
408+
terminate(
409+
StatusCode.int2StatusCode(403),
410+
s"GET not permitted for '${entityName.toDocId}'. Resource does not exist or an action in a shared package binding")
411+
} else {
412+
getEntity(WhiskActionMetaData.resolveActionAndMergeParameters(entityStore, entityName), Some {
413+
action: WhiskActionMetaData =>
414+
val mergedAction = env map {
415+
action inherit _
416+
} getOrElse action
417+
complete(OK, mergedAction)
418+
})
419+
}
420+
})
421+
}
422+
}
423+
}
401424
}
402425
}
403426

404-
405427
/**
406428
* Gets all actions in a path.
407429
*

‎core/controller/src/main/scala/org/apache/openwhisk/core/controller/Packages.scala‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,10 @@ trait WhiskPackagesApi extends WhiskCollectionAPI with ReferencedEntities {
4444
protected val entityStore: EntityStore
4545

4646
/** Config flag for Execute Only for Shared Packages */
47-
48-
protected def executeOnly = Try({
49-
loadConfigOrThrow[Boolean](ConfigKeys.sharedPackageExecuteOnly)
50-
}).getOrElse(false)
47+
protected def executeOnly =
48+
Try({
49+
loadConfigOrThrow[Boolean](ConfigKeys.sharedPackageExecuteOnly)
50+
}).getOrElse(false)
5151

5252
/** Notification service for cache invalidation. */
5353
protected implicit val cacheChangeNotification: Some[CacheChangeNotification]
@@ -153,7 +153,6 @@ trait WhiskPackagesApi extends WhiskCollectionAPI with ReferencedEntities {
153153
})
154154
}
155155

156-
157156
/**
158157
* Gets package/binding.
159158
* The package/binding name is prefixed with the namespace to create the primary index key.
@@ -168,9 +167,9 @@ trait WhiskPackagesApi extends WhiskCollectionAPI with ReferencedEntities {
168167
override def fetch(user: Identity, entityName: FullyQualifiedEntityName, env: Option[Parameters])(
169168
implicit transid: TransactionId) = {
170169
if (executeOnly && user.namespace.name.toString != entityName.namespace.toString) {
171-
val value = entityName.toString
172-
terminate(StatusCode.int2StatusCode(403), s"GET not permitted for '$value' since it's a shared package")
173-
}else {
170+
val value = entityName.toString
171+
terminate(StatusCode.int2StatusCode(403), s"GET not permitted for '$value' since it's a shared package")
172+
} else {
174173
getEntity(WhiskPackage.get(entityStore, entityName.toDocId), Some {
175174
mergePackageWithBinding() _
176175
})
@@ -320,13 +319,16 @@ trait WhiskPackagesApi extends WhiskCollectionAPI with ReferencedEntities {
320319
logging.error(this, s"unexpected package binding refers to itself: $docid")
321320
terminate(UnprocessableEntity, Messages.packageBindingCircularReference(b.fullyQualifiedName.toString))
322321
} else {
322+
323323
/** Here's where I check package execute only case with package binding. */
324324
val packagePath = wp.namespace.toString()
325325
val bindingPath = wp.binding.iterator.next().toString()
326326
val indexOfSlash = bindingPath.indexOf('/')
327-
if (executeOnly && packagePath != bindingPath.take(indexOfSlash)){
328-
terminate(StatusCode.int2StatusCode(403), s"GET not permitted since ${wp.name.toString} is a binding of a shared package")
329-
}else {
327+
if (executeOnly && packagePath != bindingPath.take(indexOfSlash)) {
328+
terminate(
329+
StatusCode.int2StatusCode(403),
330+
s"GET not permitted since ${wp.name.toString} is a binding of a shared package")
331+
} else {
330332
getEntity(WhiskPackage.get(entityStore, docid), Some {
331333
mergePackageWithBinding(Some {
332334
wp

‎tests/src/test/scala/org/apache/openwhisk/core/controller/test/PackageActionsApiTests.scala‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -639,7 +639,7 @@ class PackageActionsApiTests extends ControllerTestCommon with WhiskActionsApi {
639639
var testExecuteOnly = false
640640
override def executeOnly = testExecuteOnly
641641

642-
it should("allow access to get of action in binding of shared package when config option is disabled") in {
642+
it should ("allow access to get of action in binding of shared package when config option is disabled") in {
643643
testExecuteOnly = false
644644
implicit val tid = transid()
645645
val auser = WhiskAuthHelpers.newIdentity()
@@ -654,18 +654,18 @@ class PackageActionsApiTests extends ControllerTestCommon with WhiskActionsApi {
654654
}
655655
}
656656

657-
it should("deny access to get of action in binding of shared package when config option is enabled") in {
658-
testExecuteOnly = true
659-
implicit val tid = transid()
660-
val auser = WhiskAuthHelpers.newIdentity()
661-
val provider = WhiskPackage(namespace, aname(), None, Parameters("p", "P"), publish = true)
662-
val binding = WhiskPackage(EntityPath(auser.subject.asString), aname(), provider.bind, Parameters("b", "B"))
663-
val action = WhiskAction(provider.fullPath, aname(), jsDefault("??"), Parameters("a", "A"))
664-
put(entityStore, provider)
665-
put(entityStore, binding)
666-
put(entityStore, action)
667-
Get(s"$collectionPath/${binding.name}/${action.name}") ~> Route.seal(routes(auser)) ~> check {
668-
status should be(Forbidden)
669-
}
657+
it should ("deny access to get of action in binding of shared package when config option is enabled") in {
658+
testExecuteOnly = true
659+
implicit val tid = transid()
660+
val auser = WhiskAuthHelpers.newIdentity()
661+
val provider = WhiskPackage(namespace, aname(), None, Parameters("p", "P"), publish = true)
662+
val binding = WhiskPackage(EntityPath(auser.subject.asString), aname(), provider.bind, Parameters("b", "B"))
663+
val action = WhiskAction(provider.fullPath, aname(), jsDefault("??"), Parameters("a", "A"))
664+
put(entityStore, provider)
665+
put(entityStore, binding)
666+
put(entityStore, action)
667+
Get(s"$collectionPath/${binding.name}/${action.name}") ~> Route.seal(routes(auser)) ~> check {
668+
status should be(Forbidden)
669+
}
670670
}
671671
}

‎tests/src/test/scala/org/apache/openwhisk/core/controller/test/PackagesApiTests.scala‎

Lines changed: 40 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -888,54 +888,54 @@ class PackagesApiTests extends ControllerTestCommon with WhiskPackagesApi {
888888
var testExecuteOnly = false
889889
override def executeOnly = testExecuteOnly
890890

891-
it should("allow access to get of shared package binding when config option is disabled") in {
892-
testExecuteOnly = false
893-
implicit val tid = transid()
894-
val auser = WhiskAuthHelpers.newIdentity()
895-
val provider = WhiskPackage(namespace, aname(), None, Parameters("p", "P"), publish = true)
896-
val binding = WhiskPackage(EntityPath(auser.subject.asString), aname(), provider.bind, Parameters("b", "B"))
897-
put(entityStore, provider)
898-
put(entityStore, binding)
899-
Get(s"/$namespace/${collection.path}/${provider.name}") ~> Route.seal(routes(auser)) ~> check {
900-
status should be(OK)
901-
}
891+
it should ("allow access to get of shared package binding when config option is disabled") in {
892+
testExecuteOnly = false
893+
implicit val tid = transid()
894+
val auser = WhiskAuthHelpers.newIdentity()
895+
val provider = WhiskPackage(namespace, aname(), None, Parameters("p", "P"), publish = true)
896+
val binding = WhiskPackage(EntityPath(auser.subject.asString), aname(), provider.bind, Parameters("b", "B"))
897+
put(entityStore, provider)
898+
put(entityStore, binding)
899+
Get(s"/$namespace/${collection.path}/${provider.name}") ~> Route.seal(routes(auser)) ~> check {
900+
status should be(OK)
901+
}
902902
}
903903

904-
it should("allow access to get of shared package when config option is disabled") in {
905-
testExecuteOnly = false
906-
implicit val tid = transid()
907-
val auser = WhiskAuthHelpers.newIdentity()
908-
val provider = WhiskPackage(namespace, aname(), None, publish = true)
909-
put(entityStore, provider)
904+
it should ("allow access to get of shared package when config option is disabled") in {
905+
testExecuteOnly = false
906+
implicit val tid = transid()
907+
val auser = WhiskAuthHelpers.newIdentity()
908+
val provider = WhiskPackage(namespace, aname(), None, publish = true)
909+
put(entityStore, provider)
910910

911-
Get(s"/$namespace/${collection.path}/${provider.name}") ~> Route.seal(routes(auser)) ~> check {
912-
status should be(OK)
913-
}
911+
Get(s"/$namespace/${collection.path}/${provider.name}") ~> Route.seal(routes(auser)) ~> check {
912+
status should be(OK)
913+
}
914914
}
915915

916916
it should ("deny access to get of shared package binding when config option is enabled") in {
917-
testExecuteOnly = true
918-
implicit val tid = transid()
919-
val auser = WhiskAuthHelpers.newIdentity()
920-
val provider = WhiskPackage(namespace, aname(), None, Parameters("p", "P"), publish = true)
921-
val binding = WhiskPackage(EntityPath(auser.subject.asString), aname(), provider.bind, Parameters("b", "B"))
922-
put(entityStore, provider)
923-
put(entityStore, binding)
924-
Get(s"/$namespace/${collection.path}/${provider.name}") ~> Route.seal(routes(auser)) ~> check {
925-
status should be(Forbidden)
926-
}
917+
testExecuteOnly = true
918+
implicit val tid = transid()
919+
val auser = WhiskAuthHelpers.newIdentity()
920+
val provider = WhiskPackage(namespace, aname(), None, Parameters("p", "P"), publish = true)
921+
val binding = WhiskPackage(EntityPath(auser.subject.asString), aname(), provider.bind, Parameters("b", "B"))
922+
put(entityStore, provider)
923+
put(entityStore, binding)
924+
Get(s"/$namespace/${collection.path}/${provider.name}") ~> Route.seal(routes(auser)) ~> check {
925+
status should be(Forbidden)
926+
}
927927

928928
}
929929

930-
it should("deny access to get of shared package when config option is enabled") in {
931-
testExecuteOnly = true
932-
implicit val tid = transid()
933-
val auser = WhiskAuthHelpers.newIdentity()
934-
val provider = WhiskPackage(namespace, aname(), None, publish = true)
935-
put(entityStore, provider)
930+
it should ("deny access to get of shared package when config option is enabled") in {
931+
testExecuteOnly = true
932+
implicit val tid = transid()
933+
val auser = WhiskAuthHelpers.newIdentity()
934+
val provider = WhiskPackage(namespace, aname(), None, publish = true)
935+
put(entityStore, provider)
936936

937-
Get(s"/$namespace/${collection.path}/${provider.name}") ~> Route.seal(routes(auser)) ~> check {
938-
status should be(Forbidden)
939-
}
937+
Get(s"/$namespace/${collection.path}/${provider.name}") ~> Route.seal(routes(auser)) ~> check {
938+
status should be(Forbidden)
939+
}
940940
}
941-
}
941+
}

0 commit comments

Comments
 (0)