Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhance ACL WHOAMI command to display active ACL rules for the current connection #1821

Open
wants to merge 1 commit into
base: unstable
Choose a base branch
from
Open

Enhance ACL WHOAMI command to display active ACL rules for the current connection #1821

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions src/acl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2910,9 +2910,18 @@ void aclCommand(client *c) {
}
}
raxStop(&ri);
} else if (!strcasecmp(sub, "whoami") && c->argc == 2) {
} else if (!strcasecmp(sub, "whoami") && (c->argc == 2 || c->argc == 3)) {
if (c->user != NULL) {
addReplyBulkCBuffer(c, c->user->name, sdslen(c->user->name));
if (c->argc == 3) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I generally don't like variadic arguments that change the type of response. So would also somewhat prefer another command.

Also, do we want this to be a variant of ACL GETUSER instead? Somewhat related to this issue, #1807.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another command? you mean a new command? I am afraid the user need to remember one more.
I guess this command is not same as ACL GETUSER, because this command only apply to current connection, even user do not know the username either.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess this command is not same as ACL GETUSER, because this command only apply to current connection, even user do not know the username either.

A new command, like ACL GETMYSELF, is what I'm suggesting. I agree it's one more command.

sds config = sdsnew(c->user->name);
config = sdscatlen(config, " ", 1);
robj *descr = ACLDescribeUser(c->user);
config = sdscatsds(config, descr->ptr);
decrRefCount(descr);
addReplyBulkSds(c, config);
} else {
addReplyBulkCBuffer(c, c->user->name, sdslen(c->user->name));
}
} else {
addReplyNull(c);
}
Expand Down
11 changes: 9 additions & 2 deletions src/commands.def
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6380,7 +6380,9 @@ struct COMMAND_ARG ACL_SETUSER_Args[] = {

#ifndef SKIP_CMD_HISTORY_TABLE
/* ACL WHOAMI history */
#define ACL_WHOAMI_History NULL
commandHistory ACL_WHOAMI_History[] = {
{"9.0.0","Added the `FULL` option."},
};
#endif

#ifndef SKIP_CMD_TIPS_TABLE
Expand All @@ -6393,6 +6395,11 @@ struct COMMAND_ARG ACL_SETUSER_Args[] = {
#define ACL_WHOAMI_Keyspecs NULL
#endif

/* ACL WHOAMI argument table */
struct COMMAND_ARG ACL_WHOAMI_Args[] = {
{MAKE_ARG("full",ARG_TYPE_PURE_TOKEN,-1,"FULL",NULL,"9.0.0",CMD_ARG_OPTIONAL,0,NULL)},
};

/* ACL command table */
struct COMMAND_STRUCT ACL_Subcommands[] = {
{MAKE_CMD("cat","Lists the ACL categories, or the commands inside a category.","O(1) since the categories and commands are a fixed set.","6.0.0",CMD_DOC_NONE,NULL,NULL,"server",COMMAND_GROUP_SERVER,ACL_CAT_History,0,ACL_CAT_Tips,0,aclCommand,-2,CMD_NOSCRIPT|CMD_LOADING|CMD_STALE|CMD_SENTINEL,0,ACL_CAT_Keyspecs,0,NULL,1),.args=ACL_CAT_Args},
Expand All @@ -6407,7 +6414,7 @@ struct COMMAND_STRUCT ACL_Subcommands[] = {
{MAKE_CMD("save","Saves the effective ACL rules in the configured ACL file.","O(N). Where N is the number of configured users.","6.0.0",CMD_DOC_NONE,NULL,NULL,"server",COMMAND_GROUP_SERVER,ACL_SAVE_History,0,ACL_SAVE_Tips,2,aclCommand,2,CMD_ADMIN|CMD_NOSCRIPT|CMD_LOADING|CMD_STALE|CMD_SENTINEL,0,ACL_SAVE_Keyspecs,0,NULL,0)},
{MAKE_CMD("setuser","Creates and modifies an ACL user and its rules.","O(N). Where N is the number of rules provided.","6.0.0",CMD_DOC_NONE,NULL,NULL,"server",COMMAND_GROUP_SERVER,ACL_SETUSER_History,2,ACL_SETUSER_Tips,2,aclCommand,-3,CMD_ADMIN|CMD_NOSCRIPT|CMD_LOADING|CMD_STALE|CMD_SENTINEL,0,ACL_SETUSER_Keyspecs,0,NULL,2),.args=ACL_SETUSER_Args},
{MAKE_CMD("users","Lists all ACL users.","O(N). Where N is the number of configured users.","6.0.0",CMD_DOC_NONE,NULL,NULL,"server",COMMAND_GROUP_SERVER,ACL_USERS_History,0,ACL_USERS_Tips,0,aclCommand,2,CMD_ADMIN|CMD_NOSCRIPT|CMD_LOADING|CMD_STALE|CMD_SENTINEL,0,ACL_USERS_Keyspecs,0,NULL,0)},
{MAKE_CMD("whoami","Returns the authenticated username of the current connection.","O(1)","6.0.0",CMD_DOC_NONE,NULL,NULL,"server",COMMAND_GROUP_SERVER,ACL_WHOAMI_History,0,ACL_WHOAMI_Tips,0,aclCommand,2,CMD_NOSCRIPT|CMD_LOADING|CMD_STALE|CMD_SENTINEL,0,ACL_WHOAMI_Keyspecs,0,NULL,0)},
{MAKE_CMD("whoami","Returns the authenticated username of the current connection or its effective rules in ACL file format.","O(1)","6.0.0",CMD_DOC_NONE,NULL,NULL,"server",COMMAND_GROUP_SERVER,ACL_WHOAMI_History,1,ACL_WHOAMI_Tips,0,aclCommand,-2,CMD_NOSCRIPT|CMD_LOADING|CMD_STALE|CMD_SENTINEL,0,ACL_WHOAMI_Keyspecs,0,NULL,1),.args=ACL_WHOAMI_Args},
{0}
};

Expand Down
22 changes: 19 additions & 3 deletions src/commands/acl-whoami.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,18 @@
{
"WHOAMI": {
"summary": "Returns the authenticated username of the current connection.",
"summary": "Returns the authenticated username of the current connection or its effective rules in ACL file format.",
"complexity": "O(1)",
"group": "server",
"since": "6.0.0",
"arity": 2,
"arity": -2,
"container": "ACL",
"function": "aclCommand",
"history": [
[
"9.0.0",
"Added the `FULL` option."
]
],
"command_flags": [
"NOSCRIPT",
"LOADING",
Expand All @@ -16,6 +22,16 @@
"reply_schema": {
"type": "string",
"description": "The username of the current connection."
}
},
"arguments": [
{
"name": "full",
"type": "pure-token",
"token": "FULL",
"optional": true,
"since": "9.0.0"
}
]

}
}
4 changes: 4 additions & 0 deletions tests/unit/acl.tcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ start_server {tags {"acl external:skip"}} {
r ACL WHOAMI
} {default}

test {Connections with the effective ACL rules of the default user} {
r ACL WHOAMI FULL
} {*default on nopass*}

test {It is possible to create new users} {
r ACL setuser newuser
}
Expand Down
Loading