v0,28,2

src/admin/session.rs

@@ -40,7 +40,9 @@ async fn guard(State(state): State<Arc<App>>, mut request: Request, next: Next)
         && request.method() != Method::HEAD
         && request.method() != Method::OPTIONS;
     let secret = auth::cookie_secret(headers);
-    let certificate_api_session = if certificate_api_operation(request.method(), &path) {
+    let certificate_api_operation = certificate_api_operation(request.method(), &path);
+    let mut certificate_api_access = None;
+    let certificate_api_session = if let Some(operation) = certificate_api_operation.as_ref() {
         match certificate_api_credentials(headers) {
             Ok(None) => None,
             Ok(Some((key_id, token))) => {
@@ -51,26 +53,52 @@ async fn guard(State(state): State<Arc<App>>, mut request: Request, next: Next)
                     ));
                 }
                 let token_hash = auth::secret_hash(&token);
-                match state
+                let grant = match state
                     .store
                     .verify_certificate_api_credential(&key_id, &token_hash)
                     .await
                 {
-                    Ok(true) => Some(Session {
-                        token_hash,
-                        csrf: String::new(),
-                        username: format!("certificate-api:{key_id}"),
-                        expires_at: auth::now().saturating_add(60),
-                        generation: 0,
-                    }),
-                    Ok(false) => {
+                    Ok(Some(grant)) => grant,
+                    Ok(None) => {
                         return secure(reject(
                             StatusCode::UNAUTHORIZED,
                             "certificate_api.invalid_token",
                         ))
                     }
                     Err(error) => return secure(auth::internal(error).into_response()),
+                };
+                match operation {
+                    CertificateApiOperation::ReloadAll => {
+                        return secure(reject(
+                            StatusCode::FORBIDDEN,
+                            "certificate_api.target_required",
+                        ));
+                    }
+                    CertificateApiOperation::ReloadOne(certificate_id) => {
+                        if !grant.allows_certificate(certificate_id) {
+                            return secure(reject(
+                                StatusCode::FORBIDDEN,
+                                "certificate_api.certificate_forbidden",
+                            ));
+                        }
+                    }
+                    CertificateApiOperation::Deploy => {
+                        if !grant.allow_deploy {
+                            return secure(reject(
+                                StatusCode::FORBIDDEN,
+                                "certificate_api.deploy_forbidden",
+                            ));
+                        }
+                    }
                 }
+                certificate_api_access = Some(CertificateApiAccess { grant });
+                Some(Session {
+                    token_hash,
+                    csrf: String::new(),
+                    username: format!("certificate-api:{key_id}"),
+                    expires_at: auth::now().saturating_add(60),
+                    generation: 0,
+                })
             }
             Err(()) => {
                 return secure(reject(
@@ -132,6 +160,9 @@ async fn guard(State(state): State<Arc<App>>, mut request: Request, next: Next)
     if let Some(session) = session.clone() {
         request.extensions_mut().insert(session);
     }
+    if let Some(access) = certificate_api_access {
+        request.extensions_mut().insert(access);
+    }
     let admin_origin = AdminOrigin {
         secure: scheme == "https",
     };