Skip to content

Commit 5cf731b

Browse files
JacobBarthelmehJacobBarthelmeh
committed
add demo for set permissions and update delete function to have current user
1 parent a0573be commit 5cf731b

7 files changed

Lines changed: 216 additions & 104 deletions

File tree

‎src/wh_auth.c‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -208,18 +208,21 @@ int wh_Auth_UserDelete(whAuthContext* context, whUserId user_id)
208208
return WH_ERROR_BADARGS;
209209
}
210210

211-
return context->cb->UserDelete(context->context, user_id);
211+
return context->cb->UserDelete(context->context, context->user.user_id, user_id);
212212
}
213213

214214

215215
int wh_Auth_UserSetPermissions(whAuthContext* context, whUserId user_id,
216216
whAuthPermissions permissions)
217217
{
218-
/* TODO: Set user permissions */
219-
(void)context;
220-
(void)user_id;
221-
(void)permissions;
222-
return WH_ERROR_NOTIMPL;
218+
if ( (context == NULL) ||
219+
(context->cb == NULL) ||
220+
(context->cb->UserSetPermissions == NULL) ) {
221+
return WH_ERROR_BADARGS;
222+
}
223+
224+
return context->cb->UserSetPermissions(context->context,
225+
context->user.user_id, user_id, permissions);
223226
}
224227

225228
int wh_Auth_UserGet(whAuthContext* context, const char* username, whUserId* out_user_id,

‎src/wh_auth_base.c‎

Lines changed: 54 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,7 @@ int wh_AuthBase_Login(void* context, uint8_t client_id,
173173
*loggedIn = 1;
174174
*out_user_id = current_user->user.user_id;
175175
current_user->user.is_active = true;
176+
*out_permissions = current_user->user.permissions;
176177
}
177178
}
178179

@@ -267,27 +268,41 @@ int wh_AuthBase_CheckRequestAuthorization(void* context,
267268
int wh_AuthBase_CheckKeyAuthorization(void* context, uint16_t user_id,
268269
uint32_t key_id, uint16_t action)
269270
{
270-
int rc = WH_ERROR_OK;
271+
int rc = WH_ERROR_ACCESS;
272+
int i;
273+
whAuthBase_User* user;
271274

272275
printf("In key authorization check: User ID: %d, Key ID: %d, Action: %d\n",
273276
user_id, key_id, action);
274277

275278
if (user_id == WH_USER_ID_INVALID) {
276-
rc = WH_ERROR_ACCESS;
279+
return WH_ERROR_ACCESS;
277280
}
278-
else {
279-
/*
280-
if (auth_context->user.permissions.keyId == key_id) {
281+
282+
if (user_id - 1 >= WH_AUTH_BASE_MAX_USERS) {
283+
return WH_ERROR_NOTFOUND;
284+
}
285+
286+
user = &users[user_id - 1];
287+
288+
if (user->user.user_id == WH_USER_ID_INVALID) {
289+
return WH_ERROR_NOTFOUND;
290+
}
291+
292+
/* Check if the requested key_id is in the user's keyIds array */
293+
for (i = 0; i < user->user.permissions.keyIdCount && i < WH_AUTH_MAX_KEY_IDS; i++) {
294+
if (user->user.permissions.keyIds[i] == key_id) {
281295
rc = WH_ERROR_OK;
296+
break;
282297
}
283-
else {
284-
printf("User does not have access to the key");
285-
rc = WH_ERROR_ACCESS;
286-
}
287-
*/
298+
}
299+
300+
if (rc != WH_ERROR_OK) {
301+
printf("User does not have access to the key");
288302
}
289303

290304
(void)context;
305+
(void)action; /* Action could be used for future fine-grained key access control */
291306
return rc;
292307
}
293308

@@ -324,6 +339,17 @@ int wh_AuthBase_UserAdd(void* context, const char* username,
324339
new_user->user.user_id = userId;
325340
*out_user_id = userId;
326341
new_user->user.permissions = permissions;
342+
/* Clamp keyIdCount to valid range and zero out unused keyIds */
343+
if (new_user->user.permissions.keyIdCount > WH_AUTH_MAX_KEY_IDS) {
344+
new_user->user.permissions.keyIdCount = WH_AUTH_MAX_KEY_IDS;
345+
}
346+
/* Zero out unused keyIds beyond keyIdCount */
347+
if (new_user->user.permissions.keyIdCount < WH_AUTH_MAX_KEY_IDS) {
348+
int j;
349+
for (j = new_user->user.permissions.keyIdCount; j < WH_AUTH_MAX_KEY_IDS; j++) {
350+
new_user->user.permissions.keyIds[j] = 0;
351+
}
352+
}
327353
strcpy(new_user->user.username, username);
328354
new_user->user.is_active = false;
329355
new_user->user.failed_attempts = 0;
@@ -343,26 +369,39 @@ int wh_AuthBase_UserAdd(void* context, const char* username,
343369
return WH_ERROR_OK;
344370
}
345371

346-
int wh_AuthBase_UserDelete(void* context, uint16_t user_id)
372+
int wh_AuthBase_UserDelete(void* context, uint16_t current_user_id, uint16_t user_id)
347373
{
348-
whAuthBase_User* user = &users[user_id];
374+
whAuthBase_User* user = &users[user_id - 1];
349375
if (user->user.user_id == WH_USER_ID_INVALID) {
350376
return WH_ERROR_NOTFOUND;
351377
}
352378
memset(user, 0, sizeof(whAuthBase_User));
353379
(void)context;
380+
(void)current_user_id;
354381
return WH_ERROR_OK;
355382
}
356383

357-
int wh_AuthBase_UserSetPermissions(void* context, uint16_t user_id,
358-
whAuthPermissions permissions)
384+
int wh_AuthBase_UserSetPermissions(void* context, uint16_t current_user_id,
385+
uint16_t user_id, whAuthPermissions permissions)
359386
{
360-
whAuthBase_User* user = &users[user_id];
387+
whAuthBase_User* user = &users[user_id - 1];
361388
if (user->user.user_id == WH_USER_ID_INVALID) {
362389
return WH_ERROR_NOTFOUND;
363390
}
364391
user->user.permissions = permissions;
392+
/* Clamp keyIdCount to valid range and zero out unused keyIds */
393+
if (user->user.permissions.keyIdCount > WH_AUTH_MAX_KEY_IDS) {
394+
user->user.permissions.keyIdCount = WH_AUTH_MAX_KEY_IDS;
395+
}
396+
/* Zero out unused keyIds beyond keyIdCount */
397+
if (user->user.permissions.keyIdCount < WH_AUTH_MAX_KEY_IDS) {
398+
int j;
399+
for (j = user->user.permissions.keyIdCount; j < WH_AUTH_MAX_KEY_IDS; j++) {
400+
user->user.permissions.keyIds[j] = 0;
401+
}
402+
}
365403
(void)context;
404+
(void)current_user_id;
366405
return WH_ERROR_OK;
367406
}
368407

‎src/wh_client_auth.c‎

Lines changed: 60 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -443,36 +443,75 @@ int wh_Client_AuthUserGet(whClientContext* c, const char* username,
443443
int wh_Client_AuthUserSetPermissionsRequest(whClientContext* c,
444444
whUserId user_id, whAuthPermissions permissions)
445445
{
446-
/* TODO: Send user set permissions request (non-blocking).
447-
* Builds and sends the user set permissions request message. Returns immediately.
448-
* May return WH_ERROR_NOTREADY if send buffer is busy. */
449-
(void)c;
450-
(void)user_id;
451-
(void)permissions;
452-
return WH_ERROR_NOTIMPL;
446+
whMessageAuth_UserSetPermissionsRequest msg = {0};
447+
448+
if (c == NULL){
449+
return WH_ERROR_BADARGS;
450+
}
451+
452+
msg.user_id = user_id;
453+
if (wh_MessageAuth_FlattenPermissions(&permissions, msg.permissions,
454+
sizeof(msg.permissions)) != 0) {
455+
return WH_ERROR_BUFFER_SIZE;
456+
}
457+
return wh_Client_SendRequest(c,
458+
WH_MESSAGE_GROUP_AUTH, WH_MESSAGE_AUTH_ACTION_USER_SET_PERMISSIONS,
459+
sizeof(msg), &msg);
453460
}
454461

455462
int wh_Client_AuthUserSetPermissionsResponse(whClientContext* c, int32_t *out_rc)
456463
{
457-
/* TODO: Receive user set permissions response (non-blocking).
458-
* Polls for and processes the user set permissions response. Returns immediately.
459-
* Returns WH_ERROR_NOTREADY if response not yet available. */
460-
(void)c;
461-
(void)out_rc;
462-
return WH_ERROR_NOTIMPL;
464+
uint8_t buffer[WOLFHSM_CFG_COMM_DATA_LEN] = {0};
465+
whMessageAuth_SimpleResponse* msg = (whMessageAuth_SimpleResponse*)buffer;
466+
467+
int rc = 0;
468+
uint16_t resp_group = 0;
469+
uint16_t resp_action = 0;
470+
uint16_t resp_size = 0;
471+
472+
if (c == NULL){
473+
return WH_ERROR_BADARGS;
474+
}
475+
476+
rc = wh_Client_RecvResponse(c,
477+
&resp_group, &resp_action,
478+
&resp_size, buffer);
479+
if (rc == 0) {
480+
/* Validate response */
481+
if ((resp_group != WH_MESSAGE_GROUP_AUTH) ||
482+
(resp_action != WH_MESSAGE_AUTH_ACTION_USER_SET_PERMISSIONS) ||
483+
(resp_size != sizeof(whMessageAuth_SimpleResponse))) {
484+
/* Invalid message */
485+
rc = WH_ERROR_ABORTED;
486+
}
487+
else {
488+
/* Valid message */
489+
if (out_rc != NULL) {
490+
*out_rc = msg->rc;
491+
}
492+
}
493+
}
494+
return rc;
463495
}
464496

465497
int wh_Client_AuthUserSetPermissions(whClientContext* c, whUserId user_id,
466498
whAuthPermissions permissions, int32_t* out_rc)
467499
{
468-
/* TODO: Set user permissions (blocking convenience wrapper).
469-
* Calls Request, then loops on Response until complete. Blocks until
470-
* permissions are set or operation fails. */
471-
(void)c;
472-
(void)user_id;
473-
(void)permissions;
474-
(void)out_rc;
475-
return WH_ERROR_NOTIMPL;
500+
int rc;
501+
502+
do {
503+
rc = wh_Client_AuthUserSetPermissionsRequest(c, user_id, permissions);
504+
} while (rc == WH_ERROR_NOTREADY);
505+
506+
if (rc != 0) {
507+
return rc;
508+
}
509+
510+
do {
511+
rc = wh_Client_AuthUserSetPermissionsResponse(c, out_rc);
512+
} while (rc == WH_ERROR_NOTREADY);
513+
514+
return rc;
476515
}
477516

478517
/** User Set Credentials */

‎src/wh_message_auth.c‎

Lines changed: 66 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -94,17 +94,40 @@ int wh_MessageAuth_FlattenPermissions(whAuthPermissions* permissions,
9494
uint8_t* buffer, uint16_t buffer_len)
9595
{
9696
int idx = 0, i;
97+
uint16_t keyIdCount;
98+
uint32_t keyId;
9799

98100
if (permissions == NULL || buffer == NULL ||
99101
buffer_len < WH_FLAT_PERRMISIONS_LEN) {
100102
return WH_ERROR_BADARGS;
101103
}
102-
buffer[idx++] = permissions->groupPermissions;
103-
for (i = 0; i < WH_NUMBER_OF_GROUPS && (idx + i) < buffer_len; i++) {
104-
buffer[idx + i] = permissions->actionPermissions[i];
105-
idx++;
104+
105+
/* Serialize groupPermissions (2 bytes) */
106+
buffer[idx++] = (uint8_t)(permissions->groupPermissions & 0xFF);
107+
buffer[idx++] = (uint8_t)((permissions->groupPermissions >> 8) & 0xFF);
108+
109+
/* Serialize actionPermissions array (2*WH_NUMBER_OF_GROUPS bytes) */
110+
for (i = 0; i < WH_NUMBER_OF_GROUPS && (idx + (i*2) + 1) < buffer_len; i++) {
111+
buffer[idx + (i*2)] = (uint8_t)(permissions->actionPermissions[i] & 0xFF);
112+
buffer[idx + (i*2) + 1] = (uint8_t)((permissions->actionPermissions[i] >> 8) & 0xFF);
106113
}
107-
buffer[idx] = permissions->keyId;
114+
idx += (2 * WH_NUMBER_OF_GROUPS);
115+
116+
/* Serialize keyIdCount (2 bytes) */
117+
keyIdCount = (permissions->keyIdCount > WH_AUTH_MAX_KEY_IDS) ? WH_AUTH_MAX_KEY_IDS : permissions->keyIdCount;
118+
buffer[idx++] = (uint8_t)(keyIdCount & 0xFF);
119+
buffer[idx++] = (uint8_t)((keyIdCount >> 8) & 0xFF);
120+
121+
/* Serialize keyIds array (4*WH_AUTH_MAX_KEY_IDS bytes) */
122+
for (i = 0; i < WH_AUTH_MAX_KEY_IDS && (idx + (i*4) + 3) < buffer_len; i++) {
123+
if (i < keyIdCount) {
124+
keyId = permissions->keyIds[i];
125+
} else {
126+
keyId = 0; /* Pad with zeros */
127+
}
128+
memcpy(&buffer[idx + (i*4)], &keyId, sizeof(keyId));
129+
}
130+
108131
return 0;
109132
}
110133

@@ -113,17 +136,38 @@ int wh_MessageAuth_UnflattenPermissions(uint8_t* buffer, uint16_t buffer_len,
113136
whAuthPermissions* permissions)
114137
{
115138
int idx = 0, i;
139+
uint16_t keyIdCount;
140+
uint32_t keyId;
116141

117142
if (buffer == NULL || permissions == NULL ||
118143
buffer_len < WH_FLAT_PERRMISIONS_LEN) {
119144
return WH_ERROR_BADARGS;
120145
}
121-
permissions->groupPermissions = buffer[idx++];
122-
for (i = 0; i < WH_NUMBER_OF_GROUPS && (idx + i) < buffer_len; i++) {
123-
permissions->actionPermissions[i] = buffer[idx + i];
124-
idx++;
146+
147+
/* Deserialize groupPermissions (2 bytes) */
148+
permissions->groupPermissions = buffer[idx] | (buffer[idx + 1] << 8);
149+
idx += 2;
150+
151+
/* Deserialize actionPermissions array (2*WH_NUMBER_OF_GROUPS bytes) */
152+
for (i = 0; i < WH_NUMBER_OF_GROUPS && (idx + (i*2) + 1) < buffer_len; i++) {
153+
permissions->actionPermissions[i] = buffer[idx + (i*2)] | (buffer[idx + (i*2) + 1] << 8);
125154
}
126-
permissions->keyId = buffer[idx];
155+
idx += (2 * WH_NUMBER_OF_GROUPS);
156+
157+
/* Deserialize keyIdCount (2 bytes) */
158+
keyIdCount = buffer[idx] | (buffer[idx + 1] << 8);
159+
idx += 2;
160+
if (keyIdCount > WH_AUTH_MAX_KEY_IDS) {
161+
keyIdCount = WH_AUTH_MAX_KEY_IDS;
162+
}
163+
permissions->keyIdCount = keyIdCount;
164+
165+
/* Deserialize keyIds array (4*WH_AUTH_MAX_KEY_IDS bytes) */
166+
for (i = 0; i < WH_AUTH_MAX_KEY_IDS && (idx + (i*4) + 3) < buffer_len; i++) {
167+
memcpy(&keyId, &buffer[idx + (i*4)], sizeof(keyId));
168+
permissions->keyIds[i] = keyId;
169+
}
170+
127171
return 0;
128172
}
129173

@@ -166,10 +210,11 @@ int wh_MessageAuth_TranslateUserDeleteRequest(uint16_t magic,
166210
const whMessageAuth_UserDeleteRequest* src,
167211
whMessageAuth_UserDeleteRequest* dest)
168212
{
169-
/* TODO: Translate user delete request message */
170-
(void)magic;
171-
(void)src;
172-
(void)dest;
213+
if ((src == NULL) || (dest == NULL)) {
214+
return WH_ERROR_BADARGS;
215+
}
216+
217+
WH_T16(magic, dest, src, user_id);
173218
return 0;
174219
}
175220

@@ -207,10 +252,13 @@ int wh_MessageAuth_TranslateUserSetPermissionsRequest(uint16_t magic,
207252
const whMessageAuth_UserSetPermissionsRequest* src,
208253
whMessageAuth_UserSetPermissionsRequest* dest)
209254
{
210-
/* TODO: Translate user set permissions request message */
211-
(void)magic;
212-
(void)src;
213-
(void)dest;
255+
if ((src == NULL) || (dest == NULL)) {
256+
return WH_ERROR_BADARGS;
257+
}
258+
WH_T16(magic, dest, src, user_id);
259+
if (src != dest) {
260+
memcpy(dest->permissions, src->permissions, sizeof(dest->permissions));
261+
}
214262
return 0;
215263
}
216264

@@ -265,26 +313,3 @@ int wh_MessageAuth_TranslateUserSetCredentialsRequest(uint16_t magic,
265313

266314
return 0;
267315
}
268-
269-
270-
int wh_MessageAuth_TranslateCheckAuthorizationRequest(uint16_t magic,
271-
const whMessageAuth_CheckAuthorizationRequest* src,
272-
whMessageAuth_CheckAuthorizationRequest* dest)
273-
{
274-
/* TODO: Translate check authorization request message */
275-
(void)magic;
276-
(void)src;
277-
(void)dest;
278-
return 0;
279-
}
280-
281-
int wh_MessageAuth_TranslateCheckAuthorizationResponse(uint16_t magic,
282-
const whMessageAuth_CheckAuthorizationResponse* src,
283-
whMessageAuth_CheckAuthorizationResponse* dest)
284-
{
285-
/* TODO: Translate check authorization response message */
286-
(void)magic;
287-
(void)src;
288-
(void)dest;
289-
return 0;
290-
}

0 commit comments

Comments
 (0)