Merge #127

127: Refactor security r=MikailBag a=MikailBag

bors r+

Co-authored-by: Mikail Bagishov <bagishov.mikail@yandex.ru>

Author: bors[bot]

Cargo.lock

@@ -5,6 +5,7 @@ mod monitor;
 mod queries;
 mod runs;
 mod schema;
+mod security;
 mod users;
 use slog_scope::error;
 
@@ -219,6 +220,7 @@ mod prelude {
 }
 
 pub(crate) use context::{Context, ContextFactory};
+pub use security::{TokenMgr, TokenMgrError};
 
 pub(crate) struct Query;
 

src/frontend-engine/src/gql_server.rs renamed to src/frontend-engine/src/api.rs

@@ -1,4 +1,4 @@
-use crate::security::{AccessChecker, Token, TokenMgr, TokenMgrError};
+use super::security::{RawAccessChecker, Token, TokenMgr, TokenMgrError};
 use std::sync::{Arc, Mutex};
 
 pub(crate) type DbPool = Arc<dyn db::DbConn>;
@@ -14,8 +14,8 @@ pub(crate) struct ContextData {
 }
 
 impl ContextData {
-    pub(crate) fn access(&self) -> AccessChecker {
-        AccessChecker {
+    pub(crate) fn access(&self) -> RawAccessChecker {
+        RawAccessChecker {
             token: &self.token,
             cfg: &self.cfg,
             db: &*self.db,
@@ -53,7 +53,7 @@ impl<'a, 'r> rocket::request::FromRequest<'a, 'r> for ContextData {
             .expect("State<Arc<FrontendConfig>> missing");
 
         let secret_key = request
-            .guard::<rocket::State<crate::security::SecretKey>>()
+            .guard::<rocket::State<crate::secret_key::SecretKey>>()
             .expect("State<SecretKey> missing");
 
         let token = request

src/frontend-engine/src/gql_server/auth.rs renamed to src/frontend-engine/src/api/auth.rs

@@ -216,7 +216,12 @@ pub(super) fn submit_simple(
     if contest != "TODO" {
         return Err(ApiError::new(ctx, "ContestUnknown"));
     }
-    if !ctx.access().user_can_submit(&contest).internal(ctx)? {
+    if !ctx
+        .access()
+        .wrap_contest(contest)
+        .can_submit()
+        .internal(ctx)?
+    {
         return Err(ApiError::access_denied(ctx));
     }
     let problem = ctx.cfg.contests[0]
@@ -274,7 +279,7 @@ pub(super) fn modify(
     rejudge: Option<bool>,
     delete: Option<bool>,
 ) -> ApiResult<()> {
-    if !ctx.access().user_can_modify_run(id).internal(ctx)? {
+    if !ctx.access().wrap_run(id).can_modify_run().internal(ctx)? {
         return Err(ApiError::access_denied(ctx));
     }
     let should_delete = delete.unwrap_or(false);