Skip to content

refactor: move identities code out of state package #744

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
benhoyt merged 16 commits into from
Jan 5, 2026
Merged

refactor: move identities code out of state package #744

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
8c84ad5
move identities out of state package - "go vet" passes
benhoyt Dec 4, 2025
d42438f
fix a couple of tests
benhoyt Dec 5, 2025
c6c6a97
fix the rest of the tests
benhoyt Dec 8, 2025
cca7705
get loading from and storing to state working
benhoyt Dec 11, 2025
d97e026
revert changes to client/identities.go
benhoyt Dec 11, 2025
11a1390
test that API *****'s passwords (I'm surprised we weren't testing this)
benhoyt Dec 11, 2025
d487790
rename identities.IdentityAccess to identities.Access
benhoyt Dec 11, 2025
6eb8a93
ensure identities are loaded from top-level "identities" key (legacy)
benhoyt Dec 11, 2025
0c71a20
remove TODO comment; we'll do that in a follow-up PR
benhoyt Dec 11, 2025
f53d625
fix linter error
benhoyt Dec 11, 2025
4cfd602
Merge branch 'master' into move-identities
benhoyt Dec 11, 2025
02d6646
couple of minor changes from self review
benhoyt Dec 11, 2025
dcf305d
remove unneeded assert
benhoyt Dec 12, 2025
0d055e3
add warning log if both new and legacy identities present; test this
benhoyt Dec 15, 2025
0cc6bbf
Use "patch" feature instead of ad-hoc migration
benhoyt Jan 5, 2026
c07fff6
move migration tests to patch/patch2_test.go
benhoyt Jan 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions internals/daemon/access.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ package daemon
import (
"net/http"

"github.com/canonical/pebble/internals/overlord/state"
"github.com/canonical/pebble/internals/overlord/identities"
)

const (
Expand Down Expand Up @@ -52,7 +52,7 @@ func (ac AdminAccess) CheckAccess(d *Daemon, r *http.Request, user *UserState) R
// Not Unix Domain Socket or HTTPS.
return Unauthorized(accessDenied)
}
if user.Access == state.AdminAccess {
if user.Access == identities.AdminAccess {
return nil
}
// An identity explicitly set to "access: read" or "access: untrusted" isn't allowed.
Expand All @@ -73,7 +73,7 @@ func (ac UserAccess) CheckAccess(d *Daemon, r *http.Request, user *UserState) Re
return Unauthorized(accessDenied)
}
switch user.Access {
case state.ReadAccess, state.AdminAccess:
case identities.ReadAccess, identities.AdminAccess:
return nil
}
// An identity explicitly set to "access: untrusted" isn't allowed.
Expand All @@ -95,15 +95,15 @@ func (ac MetricsAccess) CheckAccess(d *Daemon, r *http.Request, user *UserState)
// HTTP access (only basic auth is possible here, so no need to
// check with identity type).
transport := RequestTransportType(r)
if transport == TransportTypeHTTP && user.Access == state.MetricsAccess {
if transport == TransportTypeHTTP && user.Access == identities.MetricsAccess {
return nil
}
if !transport.IsConcealed() {
// Not Unix Domain Socket or HTTPS.
return Unauthorized(accessDenied)
}
switch user.Access {
case state.MetricsAccess, state.ReadAccess, state.AdminAccess:
case identities.MetricsAccess, identities.ReadAccess, identities.AdminAccess:
return nil
default:
// All other access levels, including "access: untrusted", are denied.
Expand Down
26 changes: 13 additions & 13 deletions internals/daemon/access_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ import (
. "gopkg.in/check.v1"

"github.com/canonical/pebble/internals/daemon"
"github.com/canonical/pebble/internals/overlord/state"
"github.com/canonical/pebble/internals/overlord/identities"
)

type accessSuite struct{}
Expand Down Expand Up @@ -54,7 +54,7 @@ func (s *accessSuite) TestAccess(c *C) {
}, {
// User access: UntrustedAccess
apiSource: daemon.TransportTypeUnixSocket,
user: &daemon.UserState{Access: state.UntrustedAccess},
user: &daemon.UserState{Access: identities.UntrustedAccess},
openCheckErr: nil,
adminCheckErr: errUnauthorized,
userCheckErr: errUnauthorized,
Expand All @@ -63,7 +63,7 @@ func (s *accessSuite) TestAccess(c *C) {
}, {
// User access: MetricsAccess
apiSource: daemon.TransportTypeUnixSocket,
user: &daemon.UserState{Access: state.MetricsAccess},
user: &daemon.UserState{Access: identities.MetricsAccess},
openCheckErr: nil,
adminCheckErr: errUnauthorized,
userCheckErr: errUnauthorized,
Expand All @@ -72,7 +72,7 @@ func (s *accessSuite) TestAccess(c *C) {
}, {
// User access: ReadAccess
apiSource: daemon.TransportTypeUnixSocket,
user: &daemon.UserState{Access: state.ReadAccess},
user: &daemon.UserState{Access: identities.ReadAccess},
openCheckErr: nil,
adminCheckErr: errUnauthorized,
userCheckErr: nil,
Expand All @@ -81,7 +81,7 @@ func (s *accessSuite) TestAccess(c *C) {
}, {
// User access: AdminAccess
apiSource: daemon.TransportTypeUnixSocket,
user: &daemon.UserState{Access: state.AdminAccess},
user: &daemon.UserState{Access: identities.AdminAccess},
openCheckErr: nil,
adminCheckErr: nil,
userCheckErr: nil,
Expand All @@ -101,7 +101,7 @@ func (s *accessSuite) TestAccess(c *C) {
}, {
// User access: UntrustedAccess
apiSource: daemon.TransportTypeHTTP,
user: &daemon.UserState{Access: state.UntrustedAccess},
user: &daemon.UserState{Access: identities.UntrustedAccess},
openCheckErr: nil,
adminCheckErr: errUnauthorized,
userCheckErr: errUnauthorized,
Expand All @@ -110,7 +110,7 @@ func (s *accessSuite) TestAccess(c *C) {
}, {
// User access: MetricsAccess
apiSource: daemon.TransportTypeHTTP,
user: &daemon.UserState{Access: state.MetricsAccess},
user: &daemon.UserState{Access: identities.MetricsAccess},
openCheckErr: nil,
adminCheckErr: errUnauthorized,
userCheckErr: errUnauthorized,
Expand All @@ -119,7 +119,7 @@ func (s *accessSuite) TestAccess(c *C) {
}, {
// User access: ReadAccess
apiSource: daemon.TransportTypeHTTP,
user: &daemon.UserState{Access: state.ReadAccess},
user: &daemon.UserState{Access: identities.ReadAccess},
openCheckErr: nil,
adminCheckErr: errUnauthorized,
userCheckErr: errUnauthorized,
Expand All @@ -128,7 +128,7 @@ func (s *accessSuite) TestAccess(c *C) {
}, {
// User access: AdminAccess
apiSource: daemon.TransportTypeHTTP,
user: &daemon.UserState{Access: state.AdminAccess},
user: &daemon.UserState{Access: identities.AdminAccess},
openCheckErr: nil,
adminCheckErr: errUnauthorized,
userCheckErr: errUnauthorized,
Expand All @@ -148,7 +148,7 @@ func (s *accessSuite) TestAccess(c *C) {
}, {
// User access: UntrustedAccess
apiSource: daemon.TransportTypeHTTPS,
user: &daemon.UserState{Access: state.UntrustedAccess},
user: &daemon.UserState{Access: identities.UntrustedAccess},
openCheckErr: nil,
adminCheckErr: errUnauthorized,
userCheckErr: errUnauthorized,
Expand All @@ -157,7 +157,7 @@ func (s *accessSuite) TestAccess(c *C) {
}, {
// User access: MetricsAccess
apiSource: daemon.TransportTypeHTTPS,
user: &daemon.UserState{Access: state.MetricsAccess},
user: &daemon.UserState{Access: identities.MetricsAccess},
openCheckErr: nil,
adminCheckErr: errUnauthorized,
userCheckErr: errUnauthorized,
Expand All @@ -166,7 +166,7 @@ func (s *accessSuite) TestAccess(c *C) {
}, {
// User access: ReadAccess
apiSource: daemon.TransportTypeHTTPS,
user: &daemon.UserState{Access: state.ReadAccess},
user: &daemon.UserState{Access: identities.ReadAccess},
openCheckErr: nil,
adminCheckErr: errUnauthorized,
userCheckErr: nil,
Expand All @@ -175,7 +175,7 @@ func (s *accessSuite) TestAccess(c *C) {
}, {
// User access: AdminAccess
apiSource: daemon.TransportTypeHTTPS,
user: &daemon.UserState{Access: state.AdminAccess},
user: &daemon.UserState{Access: identities.AdminAccess},
openCheckErr: nil,
adminCheckErr: nil,
userCheckErr: nil,
Expand Down
19 changes: 11 additions & 8 deletions internals/daemon/api_identities.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,22 +20,23 @@ import (
"net/http"

"github.com/canonical/pebble/internals/logger"
"github.com/canonical/pebble/internals/overlord/state"
"github.com/canonical/pebble/internals/overlord/identities"
)

func v1GetIdentities(c *Command, r *http.Request, _ *UserState) Response {
st := c.d.overlord.State()
st.Lock()
defer st.Unlock()

identities := st.Identities()
identitiesMgr := c.d.overlord.IdentitiesManager()
identities := identitiesMgr.Identities()
return SyncResponse(identities)
}

func v1PostIdentities(c *Command, r *http.Request, user *UserState) Response {
var payload struct {
Action string `json:"action"`
Identities map[string]*state.Identity `json:"identities"`
Action string `json:"action"`
Identities map[string]*identities.Identity `json:"identities"`
}
decoder := json.NewDecoder(r.Body)
if err := decoder.Decode(&payload); err != nil {
Expand Down Expand Up @@ -68,6 +69,8 @@ func v1PostIdentities(c *Command, r *http.Request, user *UserState) Response {
st.Lock()
defer st.Unlock()

identitiesMgr := c.d.overlord.IdentitiesManager()

var err error
switch payload.Action {
case "add":
Expand All @@ -76,14 +79,14 @@ func v1PostIdentities(c *Command, r *http.Request, user *UserState) Response {
fmt.Sprintf("%s,%s,%s", userString(user), name, identity.Access),
fmt.Sprintf("Creating %s user %s", identity.Access, name))
}
err = st.AddIdentities(payload.Identities)
err = identitiesMgr.AddIdentities(payload.Identities)
case "update":
for name, identity := range payload.Identities {
logger.SecurityWarn(logger.SecurityUserUpdated,
fmt.Sprintf("%s,%s,%s", userString(user), name, identity.Access),
fmt.Sprintf("Updating %s user %s", identity.Access, name))
}
err = st.UpdateIdentities(payload.Identities)
err = identitiesMgr.UpdateIdentities(payload.Identities)
case "replace":
for name, identity := range payload.Identities {
if identity == nil {
Expand All @@ -96,14 +99,14 @@ func v1PostIdentities(c *Command, r *http.Request, user *UserState) Response {
fmt.Sprintf("Updating %s user %s", identity.Access, name))
}
}
err = st.ReplaceIdentities(payload.Identities)
err = identitiesMgr.ReplaceIdentities(payload.Identities)
case "remove":
for name := range payload.Identities {
logger.SecurityWarn(logger.SecurityUserDeleted,
fmt.Sprintf("%s,%s", userString(user), name),
fmt.Sprintf("Deleting user %s", name))
}
err = st.RemoveIdentities(identityNames)
err = identitiesMgr.RemoveIdentities(identityNames)
}
if err != nil {
return BadRequest("%v", err)
Expand Down
Loading
Loading