puppet 6.29.0 → 7.0.0

data/lib/puppet/network/authorization.rb

@@ -1,41 +1,19 @@
-require 'puppet/network/client_request'
-require 'puppet/network/authconfig'
-require 'puppet/network/auth_config_parser'
-
 module Puppet::Network
-  class AuthConfigLoader
-    # Create our config object if necessary. If there's no configuration file
-    # we install our defaults
-    def self.authconfig
-      @auth_config_file ||= Puppet::Util::WatchedFile.new(Puppet[:rest_authconfig])
-      if (not @auth_config) or @auth_config_file.changed?
-        begin
-          @auth_config = Puppet::Network::AuthConfigParser.new_from_file(Puppet[:rest_authconfig]).parse
-        rescue Errno::ENOENT, Errno::ENOTDIR
-          @auth_config = Puppet::Network::AuthConfig.new
-        end
-      end
-
-      @auth_config
-    end
-  end
-
   module Authorization
-    @@authconfigloader_class = nil
-
-    def self.authconfigloader_class=(klass)
-      @@authconfigloader_class = klass
-    end
-
-    def authconfig
-      authconfigloader = @@authconfigloader_class || AuthConfigLoader
-      authconfigloader.authconfig
-    end
+    class << self
+      # This method is deprecated and will be removed in a future release.
+      def authconfigloader_class=(klass)
+        @authconfigloader_class = klass
+      end
 
-    # Verify that our client has access.
-    def check_authorization(method, path, params)
-      authconfig.check_authorization(method, path, params)
+      # Verify something external to puppet is authorizing REST requests, so
+      # we don't fail insecurely due to misconfiguration.
+      def check_external_authorization(method, path)
+        if @authconfigloader_class.nil?
+          message = "Forbidden request: #{path} (method #{method})"
+          raise Puppet::Network::HTTP::Error::HTTPNotAuthorizedError.new(message, Puppet::Network::HTTP::Issues::FAILED_AUTHORIZATION)
+        end
+      end
     end
   end
 end
-

data/lib/puppet/network/formats.rb

@@ -183,73 +183,6 @@ Puppet::Network::FormatHandler.create(:console,
   end
 end
 
-Puppet::Network::FormatHandler.create(:flat,
-                                      :mime   => 'text/x-flat-text',
-                                      :weight => 0) do
-
-  def flatten_hash(hash)
-    hash.each_with_object({}) do |(k, v), h|
-      if v.is_a? Hash
-        flatten_hash(v).map do |h_k, h_v|
-          h["#{k}.#{h_k}"] = h_v
-        end
-      elsif v.is_a? Array
-        v.each_with_index do |el, i|
-          if el.is_a? Hash
-            flatten_hash(el).map do |el_k, el_v|
-              h["#{k}.#{i}.#{el_k}"] = el_v
-            end
-          else
-            h["#{k}.#{i}"] = el
-          end
-        end
-      else
-        h[k] = v
-      end
-    end
-  end
-
-  def flatten_array(array)
-    a={}
-    array.each_with_index do |el, i|
-      if el.is_a? Hash
-        flatten_hash(el).map do |el_k, el_v|
-          a["#{i}.#{el_k}"] = el_v
-        end
-      else
-        a["#{i}"] = el
-      end
-    end
-    a
-  end
-
-  def construct_output(data)
-    output = ''
-    data.each do |key, value|
-      output << "#{key}=#{value}"
-      output << "\n"
-    end
-    output
-  end
-
-  def render(datum)
-    return datum if datum.is_a?(String) || datum.is_a?(Numeric)
-    # Simple hash
-    if datum.is_a?(Hash)
-      data = flatten_hash(datum)
-      return construct_output(data)
-    elsif datum.is_a?(Array)
-      data = flatten_array(datum)
-      return construct_output(data)
-    end
-    Puppet::Util::Json.dump(datum, :pretty => true, :quirks_mode => true)
-  end
-  def render_multiple(data)
-    data.collect(&:render).join("\n")
-  end
-end
-
-
 Puppet::Network::FormatHandler.create(:rich_data_json, mime: 'application/vnd.puppet.rich+json', charset: Encoding::UTF_8, weight: 30) do
   def intern(klass, text)
     Puppet.override({:rich_data => true}) do

data/lib/puppet/network/http/api/indirected_routes.rb

@@ -1,8 +1,6 @@
-require 'puppet/network/authorization'
 require 'puppet/network/http/api/indirection_type'
 
 class Puppet::Network::HTTP::API::IndirectedRoutes
-  include Puppet::Network::Authorization
 
   # How we map http methods and the indirection name in the URI
   # to an indirection method.
@@ -31,7 +29,8 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
     Puppet::Network::HTTP::Route.path(/.*/).any(new)
   end
 
-  # handle an HTTP request
+  # Handle an HTTP request. The request has already been authenticated prior
+  # to calling this method.
   def call(request, response)
     indirection, method, key, params = uri2indirection(request.method, request.path, request.params)
     certificate = request.client_cert
@@ -99,13 +98,7 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
       params[:environment] = configured_environment
     end
 
-    begin
-      check_authorization(method, "#{url_prefix}/#{indirection_name}/#{key}", params)
-    rescue Puppet::Network::AuthorizationError => e
-      raise Puppet::Network::HTTP::Error::HTTPNotAuthorizedError.new(e.message)
-    end
-
-    if configured_environment.nil? && indirection.terminus.require_environment?
+    if configured_environment.nil?
       raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new(
         _("Could not find environment '%{environment}'") % { environment: environment })
     end
@@ -120,17 +113,6 @@ class Puppet::Network::HTTP::API::IndirectedRoutes
     [indirection, method, key, params]
   end
 
-  def self.request_to_uri(request)
-    uri, body = request_to_uri_and_body(request)
-    "#{uri}?#{body}"
-  end
-
-  def self.request_to_uri_and_body(request)
-    url_prefix = IndirectionType.url_prefix_for(request.indirection_name.to_s)
-    indirection = request.method == :search ? pluralize(request.indirection_name.to_s) : request.indirection_name.to_s
-    ["#{url_prefix}/#{indirection}/#{Puppet::Util.uri_encode(request.key)}", "environment=#{request.environment.name}&#{request.query_string}"]
-  end
-
   private
 
   # Execute our find.

data/lib/puppet/network/http/api/master/v3.rb

@@ -1,28 +1,26 @@
 class Puppet::Network::HTTP::API::Master::V3
-  require 'puppet/network/http/api/master/v3/authorization'
   require 'puppet/network/http/api/master/v3/environments'
-  require 'puppet/network/http/api/master/v3/environment'
   require 'puppet/network/http/api/indirected_routes'
 
-  AUTHZ = Authorization.new
+  def self.wrap(&block)
+    lambda do |request, response|
+      Puppet::Network::Authorization.check_external_authorization(request.method, request.path)
+
+      block.call.call(request, response)
+    end
+  end
 
   INDIRECTED = Puppet::Network::HTTP::Route.
       path(/.*/).
-      any(Puppet::Network::HTTP::API::IndirectedRoutes.new)
+      any(wrap { Puppet::Network::HTTP::API::IndirectedRoutes.new } )
 
   ENVIRONMENTS = Puppet::Network::HTTP::Route.
-      path(%r{^/environments$}).get(AUTHZ.wrap do
-    Environments.new(Puppet.lookup(:environments))
-  end)
-
-  ENVIRONMENT = Puppet::Network::HTTP::Route.
-      path(%r{^/environment/[^/]+$}).get(AUTHZ.wrap do
-    Environment.new
-  end)
+      path(%r{^/environments$}).
+      get(wrap { Environments.new(Puppet.lookup(:environments)) } )
 
   def self.routes
     Puppet::Network::HTTP::Route.path(%r{v3}).
         any.
-        chain(ENVIRONMENTS, ENVIRONMENT, INDIRECTED)
+        chain(ENVIRONMENTS, INDIRECTED)
   end
 end