Skip to content

Commit

Permalink
fix(basic):Modify fill ctx judgment field (#717)
Browse files Browse the repository at this point in the history
  • Loading branch information
RWDai authored May 6, 2024
1 parent 732bf23 commit fa61d49
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
4 changes: 2 additions & 2 deletions backend/basic/src/rbum/helper/rbum_scope_helper.rs
Original file line number Diff line number Diff line change
Expand Up @@ -245,15 +245,15 @@ where
/// Check ``owner`` field of the context and fill the context.
///
/// When using ``ak/sk`` authentication from an internal calling interface (mostly ``ci`` type interfaces),
/// there is no ``owner`` field,
/// there is ``ak`` field,
/// so this method can be used to determine whether it comes from an internal calling interface.
///
/// This method will fetch the context from the request header (default: 'Bios-Ctx') and fill the current context.
///
/// Warning: This operation is unsafe, and it should only be used in scenarios where there is no security risk.
#[cfg(feature = "default")]
pub fn check_without_owner_and_unsafe_fill_ctx(request: &tardis::web::poem::Request, funs: &TardisFunsInst, ctx: &mut TardisContext) -> TardisResult<()> {
if !ctx.owner.is_empty() {
if ctx.ak.is_empty() {
return Err(TardisError::forbidden("[Basic] Request context owner is not empty", "403-rbum-req-ctx-owner-is-not-empty"));
}
unsafe_fill_ctx(request, funs, ctx)
Expand Down
4 changes: 2 additions & 2 deletions backend/basic/src/spi.rs
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@
//! 1. The binding relationship between each SPI backend implementation and the corresponding tenant or application must be bound before use,
//! and the binding relationship is stored in ``rbum_rel``, with the tag as ``spi_ident``
//! 1. No request authentication is done.
//! The SPI service trusts the authentication information carried by the request (``owner`` in ``TardisContext``, corresponding to the Id of the tenant or application).
//! The SPI service trusts the authentication information carried by the request (``ak`` in ``TardisContext``, corresponding to the Id of the tenant or application).
//! The authentication logic will be implemented uniformly by the gateway
//! 1. Delayed initialization.
//! The backend implementation of each SPI service is initialized (client generated) only when called for the first time to reduce resource consumption at startup.
Expand All @@ -65,7 +65,7 @@
//! 1. 每个SPI的后端实现可以有多个,对应于``rbum_item及扩展的spi_bs``。如可以为spi-search的``spi-bs-pg``指定多个连接
//! 1. 每个SPI后端实现的连接信息存储于``rbum_cert``
//! 1. 每个SPI后端实现的要绑定给对应的租户或应用后才能使用,绑定关系存储于``rbum_rel``,tag为``spi_ident``
//! 1. 不做请求认证。SPI服务信任请求带来的认证信息(``TardisContext``中的``owner``,对应于租户或应用的Id)。认证的逻辑将由网关统一实现
//! 1. 不做请求认证。SPI服务信任请求带来的认证信息(``TardisContext``中的``ak``,对应于租户或应用的Id)。认证的逻辑将由网关统一实现
//! 1. 延时初始化。SPI服务的每个后端实现只有在第一次调用时才会初始化(生成client),以减少启动时的资源消耗。详见 [`crate::spi::spi_funs::SpiBsInst`]
#[cfg(feature = "default")]
pub mod api;
Expand Down

0 comments on commit fa61d49

Please sign in to comment.