25 #ifndef _GVMD_MANAGE_ACL_H
26 #define _GVMD_MANAGE_ACL_H
28 #include "manage_sql.h"
36 #define ACL_USER_MAY(resource) \
37 "SELECT count(*) > 0 FROM permissions" \
38 " WHERE resource = " resource \
39 " AND subject_location = " G_STRINGIFY (LOCATION_TABLE) \
40 " AND ((subject_type = 'user'" \
42 " = (SELECT id FROM users" \
43 " WHERE users.uuid = '%s'))" \
44 " OR (subject_type = 'group'" \
46 " IN (SELECT DISTINCT \"group\"" \
48 " WHERE \"user\" = (SELECT id" \
52 " OR (subject_type = 'role'" \
54 " IN (SELECT DISTINCT role" \
56 " WHERE \"user\" = (SELECT id" \
61 " AND ((lower (substr ('%s', 1, 3)) = 'get'" \
62 " AND name LIKE '%%'" \
63 " || lower (substr ('%s'," \
65 " length ('%s') - 5)))" \
66 " OR name = lower ('%s'))"
73 #define ACL_IS_GLOBAL() \
84 #define ACL_USER_OWNS() \
85 " (owner = (SELECT users.id FROM users" \
86 " WHERE users.uuid = '%s'))"
96 #define ACL_GLOBAL_OR_USER_OWNS() \
97 " ((" ACL_IS_GLOBAL () ")" \
98 " OR (owner = (SELECT users.id FROM users" \
99 " WHERE users.uuid = '%s')))"
145 array_t *, gchar **);
long long int resource_t
A resource, like a task or target.
Definition: iterator.h:40
gchar * acl_users_with_access_sql(const char *, const char *, const char *)
Get an SQL values expression of users that can get a resource.
Definition: manage_acl.c:1463
int acl_user_is_super_admin(const char *)
Check whether a user is a Super Admin.
Definition: manage_acl.c:337
int acl_user_can_super_everyone(const char *)
Check whether a user is a Super Admin.
Definition: manage_acl.c:122
int acl_user_is_admin(const char *)
Check whether a user is an Admin.
Definition: manage_acl.c:291
gchar * acl_where_owned(const char *, const get_data_t *, int, const gchar *, resource_t, array_t *, gchar **)
Generate the ownership part of an SQL WHERE clause.
Definition: manage_acl.c:1387
int acl_user_is_user(const char *)
Check whether a user has the User role.
Definition: manage_acl.c:360
int acl_user_has_super(const char *, user_t)
Test whether a user has super permission on another user.
Definition: manage_acl.c:221
int acl_user_owns_trash_uuid(const char *resource, const char *uuid)
Test whether a user effectively owns a resource.
Definition: manage_acl.c:687
int acl_user_owns(const char *, resource_t, int)
Test whether a user effectively owns a resource.
Definition: manage_acl.c:633
gchar * acl_users_with_access_where(const char *, const char *, const char *, const char *)
Get a static SQL condition selecting users that can get a resource.
Definition: manage_acl.c:1526
int acl_role_can_super_everyone(const char *)
Check whether a role has Super Admin capability.
Definition: manage_acl.c:90
gchar * acl_where_owned_for_get(const char *, const char *, gchar **)
Generate ownership part of WHERE, for getting a type of resource.
Definition: manage_acl.c:1416
int acl_user_is_observer(const char *)
Check whether a user is an Observer.
Definition: manage_acl.c:314
int acl_user_may(const char *)
Test whether a user may perform an operation.
Definition: manage_acl.c:51
int acl_user_is_owner(const char *, const char *)
Test whether a user is the actual owner of a resource.
Definition: manage_acl.c:526
int acl_user_has_access_uuid(const char *, const char *, const char *, int)
Test whether the user may access a resource.
Definition: manage_acl.c:722
int acl_user_can_everything(const char *)
Test whether a user may perform any operation.
Definition: manage_acl.c:174
int acl_user_owns_uuid(const char *, const char *, int)
Test whether a user effectively owns a resource.
Definition: manage_acl.c:559
Command data for a get command.
Definition: manage.h:355