Replace godep with dep

vendor/k8s.io/apiserver/pkg/authorization/union/BUILD

@@ -0,0 +1,40 @@
+package(default_visibility = ["//visibility:public"])
+
+load(
+    "@io_bazel_rules_go//go:def.bzl",
+    "go_library",
+    "go_test",
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["union_test.go"],
+    library = ":go_default_library",
+    deps = [
+        "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
+    ],
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = ["union.go"],
+    deps = [
+        "//vendor/k8s.io/apimachinery/pkg/util/errors:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authentication/user:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/authorization/authorizer:go_default_library",
+    ],
+)
+
+filegroup(
+    name = "package-srcs",
+    srcs = glob(["**"]),
+    tags = ["automanaged"],
+    visibility = ["//visibility:private"],
+)
+
+filegroup(
+    name = "all-srcs",
+    srcs = [":package-srcs"],
+    tags = ["automanaged"],
+)

vendor/k8s.io/apiserver/pkg/authorization/union/union.go

@@ -0,0 +1,95 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package union
+
+import (
+	"strings"
+
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apiserver/pkg/authentication/user"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+)
+
+// unionAuthzHandler authorizer against a chain of authorizer.Authorizer
+type unionAuthzHandler []authorizer.Authorizer
+
+// New returns an authorizer that authorizes against a chain of authorizer.Authorizer objects
+func New(authorizationHandlers ...authorizer.Authorizer) authorizer.Authorizer {
+	return unionAuthzHandler(authorizationHandlers)
+}
+
+// Authorizes against a chain of authorizer.Authorizer objects and returns nil if successful and returns error if unsuccessful
+func (authzHandler unionAuthzHandler) Authorize(a authorizer.Attributes) (bool, string, error) {
+	var (
+		errlist    []error
+		reasonlist []string
+	)
+
+	for _, currAuthzHandler := range authzHandler {
+		authorized, reason, err := currAuthzHandler.Authorize(a)
+
+		if err != nil {
+			errlist = append(errlist, err)
+		}
+		if len(reason) != 0 {
+			reasonlist = append(reasonlist, reason)
+		}
+		if !authorized {
+			continue
+		}
+		return true, reason, nil
+	}
+
+	return false, strings.Join(reasonlist, "\n"), utilerrors.NewAggregate(errlist)
+}
+
+// unionAuthzRulesHandler authorizer against a chain of authorizer.RuleResolver
+type unionAuthzRulesHandler []authorizer.RuleResolver
+
+// NewRuleResolvers returns an authorizer that authorizes against a chain of authorizer.Authorizer objects
+func NewRuleResolvers(authorizationHandlers ...authorizer.RuleResolver) authorizer.RuleResolver {
+	return unionAuthzRulesHandler(authorizationHandlers)
+}
+
+// RulesFor against a chain of authorizer.RuleResolver objects and returns nil if successful and returns error if unsuccessful
+func (authzHandler unionAuthzRulesHandler) RulesFor(user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error) {
+	var (
+		errList              []error
+		resourceRulesList    []authorizer.ResourceRuleInfo
+		nonResourceRulesList []authorizer.NonResourceRuleInfo
+	)
+	incompleteStatus := false
+
+	for _, currAuthzHandler := range authzHandler {
+		resourceRules, nonResourceRules, incomplete, err := currAuthzHandler.RulesFor(user, namespace)
+
+		if incomplete == true {
+			incompleteStatus = true
+		}
+		if err != nil {
+			errList = append(errList, err)
+		}
+		if len(resourceRules) > 0 {
+			resourceRulesList = append(resourceRulesList, resourceRules...)
+		}
+		if len(nonResourceRules) > 0 {
+			nonResourceRulesList = append(nonResourceRulesList, nonResourceRules...)
+		}
+	}
+
+	return resourceRulesList, nonResourceRulesList, incompleteStatus, utilerrors.NewAggregate(errList)
+}

vendor/k8s.io/apiserver/pkg/authorization/union/union_test.go

@@ -0,0 +1,225 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package union
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+
+	"k8s.io/apiserver/pkg/authentication/user"
+	"k8s.io/apiserver/pkg/authorization/authorizer"
+)
+
+type mockAuthzHandler struct {
+	isAuthorized bool
+	err          error
+}
+
+func (mock *mockAuthzHandler) Authorize(a authorizer.Attributes) (bool, string, error) {
+	if mock.err != nil {
+		return false, "", mock.err
+	}
+	if !mock.isAuthorized {
+		return false, "", nil
+	}
+	return true, "", nil
+}
+
+func TestAuthorizationSecondPasses(t *testing.T) {
+	handler1 := &mockAuthzHandler{isAuthorized: false}
+	handler2 := &mockAuthzHandler{isAuthorized: true}
+	authzHandler := New(handler1, handler2)
+
+	authorized, _, _ := authzHandler.Authorize(nil)
+	if !authorized {
+		t.Errorf("Unexpected authorization failure")
+	}
+}
+
+func TestAuthorizationFirstPasses(t *testing.T) {
+	handler1 := &mockAuthzHandler{isAuthorized: true}
+	handler2 := &mockAuthzHandler{isAuthorized: false}
+	authzHandler := New(handler1, handler2)
+
+	authorized, _, _ := authzHandler.Authorize(nil)
+	if !authorized {
+		t.Errorf("Unexpected authorization failure")
+	}
+}
+
+func TestAuthorizationNonePasses(t *testing.T) {
+	handler1 := &mockAuthzHandler{isAuthorized: false}
+	handler2 := &mockAuthzHandler{isAuthorized: false}
+	authzHandler := New(handler1, handler2)
+
+	authorized, _, _ := authzHandler.Authorize(nil)
+	if authorized {
+		t.Errorf("Expected failed authorization")
+	}
+}
+
+func TestAuthorizationError(t *testing.T) {
+	handler1 := &mockAuthzHandler{err: fmt.Errorf("foo")}
+	handler2 := &mockAuthzHandler{err: fmt.Errorf("foo")}
+	authzHandler := New(handler1, handler2)
+
+	_, _, err := authzHandler.Authorize(nil)
+	if err == nil {
+		t.Errorf("Expected error: %v", err)
+	}
+}
+
+type mockAuthzRuleHandler struct {
+	resourceRules    []authorizer.ResourceRuleInfo
+	nonResourceRules []authorizer.NonResourceRuleInfo
+	err              error
+}
+
+func (mock *mockAuthzRuleHandler) RulesFor(user user.Info, namespace string) ([]authorizer.ResourceRuleInfo, []authorizer.NonResourceRuleInfo, bool, error) {
+	if mock.err != nil {
+		return []authorizer.ResourceRuleInfo{}, []authorizer.NonResourceRuleInfo{}, false, mock.err
+	}
+	return mock.resourceRules, mock.nonResourceRules, false, nil
+}
+
+func TestAuthorizationResourceRules(t *testing.T) {
+	handler1 := &mockAuthzRuleHandler{
+		resourceRules: []authorizer.ResourceRuleInfo{
+			&authorizer.DefaultResourceRuleInfo{
+				Verbs:     []string{"*"},
+				APIGroups: []string{"*"},
+				Resources: []string{"bindings"},
+			},
+			&authorizer.DefaultResourceRuleInfo{
+				Verbs:     []string{"get", "list", "watch"},
+				APIGroups: []string{"*"},
+				Resources: []string{"*"},
+			},
+		},
+	}
+	handler2 := &mockAuthzRuleHandler{
+		resourceRules: []authorizer.ResourceRuleInfo{
+			&authorizer.DefaultResourceRuleInfo{
+				Verbs:     []string{"*"},
+				APIGroups: []string{"*"},
+				Resources: []string{"events"},
+			},
+			&authorizer.DefaultResourceRuleInfo{
+				Verbs:         []string{"get"},
+				APIGroups:     []string{"*"},
+				Resources:     []string{"*"},
+				ResourceNames: []string{"foo"},
+			},
+		},
+	}
+
+	expected := []authorizer.DefaultResourceRuleInfo{
+		{
+			Verbs:     []string{"*"},
+			APIGroups: []string{"*"},
+			Resources: []string{"bindings"},
+		},
+		{
+			Verbs:     []string{"get", "list", "watch"},
+			APIGroups: []string{"*"},
+			Resources: []string{"*"},
+		},
+		{
+			Verbs:     []string{"*"},
+			APIGroups: []string{"*"},
+			Resources: []string{"events"},
+		},
+		{
+			Verbs:         []string{"get"},
+			APIGroups:     []string{"*"},
+			Resources:     []string{"*"},
+			ResourceNames: []string{"foo"},
+		},
+	}
+
+	authzRulesHandler := NewRuleResolvers(handler1, handler2)
+
+	rules, _, _, _ := authzRulesHandler.RulesFor(nil, "")
+	actual := getResourceRules(rules)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("Expected: \n%#v\n but actual: \n%#v\n", expected, actual)
+	}
+}
+
+func TestAuthorizationNonResourceRules(t *testing.T) {
+	handler1 := &mockAuthzRuleHandler{
+		nonResourceRules: []authorizer.NonResourceRuleInfo{
+			&authorizer.DefaultNonResourceRuleInfo{
+				Verbs:           []string{"get"},
+				NonResourceURLs: []string{"/api"},
+			},
+		},
+	}
+
+	handler2 := &mockAuthzRuleHandler{
+		nonResourceRules: []authorizer.NonResourceRuleInfo{
+			&authorizer.DefaultNonResourceRuleInfo{
+				Verbs:           []string{"get"},
+				NonResourceURLs: []string{"/api/*"},
+			},
+		},
+	}
+
+	expected := []authorizer.DefaultNonResourceRuleInfo{
+		{
+			Verbs:           []string{"get"},
+			NonResourceURLs: []string{"/api"},
+		},
+		{
+			Verbs:           []string{"get"},
+			NonResourceURLs: []string{"/api/*"},
+		},
+	}
+
+	authzRulesHandler := NewRuleResolvers(handler1, handler2)
+
+	_, rules, _, _ := authzRulesHandler.RulesFor(nil, "")
+	actual := getNonResourceRules(rules)
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("Expected: \n%#v\n but actual: \n%#v\n", expected, actual)
+	}
+}
+
+func getResourceRules(infos []authorizer.ResourceRuleInfo) []authorizer.DefaultResourceRuleInfo {
+	rules := make([]authorizer.DefaultResourceRuleInfo, len(infos))
+	for i, info := range infos {
+		rules[i] = authorizer.DefaultResourceRuleInfo{
+			Verbs:         info.GetVerbs(),
+			APIGroups:     info.GetAPIGroups(),
+			Resources:     info.GetResources(),
+			ResourceNames: info.GetResourceNames(),
+		}
+	}
+	return rules
+}
+
+func getNonResourceRules(infos []authorizer.NonResourceRuleInfo) []authorizer.DefaultNonResourceRuleInfo {
+	rules := make([]authorizer.DefaultNonResourceRuleInfo, len(infos))
+	for i, info := range infos {
+		rules[i] = authorizer.DefaultNonResourceRuleInfo{
+			Verbs:           info.GetVerbs(),
+			NonResourceURLs: info.GetNonResourceURLs(),
+		}
+	}
+	return rules
+}