Add deny types

Change-Id: Ife48273f31f8a07e719d9b8037ed52a1fc2f5b5e

diff --git a/src/common/types/SupportedTypes.h b/src/common/types/SupportedTypes.h
index 2776ff5..97ff82f 100644 (file)
--- a/src/common/types/SupportedTypes.h
+++ b/src/common/types/SupportedTypes.h
@@ -39,6 +39,11 @@ const Cynara::PolicyType ALLOW_ONCE = 11;
 const Cynara::PolicyType ALLOW_PER_SESSION = 12;
 // This one will never reach client, but will be interpreted in service plugin
 const Cynara::PolicyType ALLOW_PER_LIFE = 13;
+
+const Cynara::PolicyType DENY_ONCE = 14;
+const Cynara::PolicyType DENY_PER_SESSION = 15;
+// This one will never reach client, but will be interpreted in service plugin
+const Cynara::PolicyType DENY_PER_LIFE = 16;
 } //namespace Client
 
 } //namespace SupportedTypes

diff --git a/src/plugin/client/ClientPlugin.cpp b/src/plugin/client/ClientPlugin.cpp
index 12026b7..2616a09 100644 (file)
--- a/src/plugin/client/ClientPlugin.cpp
+++ b/src/plugin/client/ClientPlugin.cpp
@@ -32,7 +32,10 @@ using namespace Cynara;
 namespace AskUser {
 const std::vector<PolicyType> clientTypes = {
         SupportedTypes::Client::ALLOW_ONCE,
-        SupportedTypes::Client::ALLOW_PER_SESSION
+        SupportedTypes::Client::ALLOW_PER_SESSION,
+
+        SupportedTypes::Client::DENY_ONCE,
+        SupportedTypes::Client::DENY_PER_SESSION
 };
 
 class ClientPlugin : public ClientPluginInterface {
@@ -42,7 +45,8 @@ public:
     }
 
     bool isCacheable(const ClientSession &session UNUSED, const PolicyResult &result) {
-        return (result.policyType() == SupportedTypes::Client::ALLOW_PER_SESSION);
+        return (result.policyType() == SupportedTypes::Client::ALLOW_PER_SESSION
+                || result.policyType() == SupportedTypes::Client::DENY_PER_SESSION);
     }
 
     bool isUsable(const ClientSession &session,
@@ -52,16 +56,18 @@ public:
     {
         updateSession = false;
 
-        if (result.policyType() == SupportedTypes::Client::ALLOW_PER_SESSION) {
+        switch (result.policyType()) {
+        case SupportedTypes::Client::ALLOW_PER_SESSION:
+        case SupportedTypes::Client::DENY_PER_SESSION:
             if (session == prevSession) {
                 return true;
             }
             LOGD("Previous session <" << prevSession << "> does not match current session <"
                     << session << ">");
             return false;
+        default:
+            return false;
         }
-
-        return false;
     }
 
     void invalidate() {}
@@ -71,8 +77,9 @@ public:
             case SupportedTypes::Client::ALLOW_ONCE:
             case SupportedTypes::Client::ALLOW_PER_SESSION:
                 return CYNARA_API_ACCESS_ALLOWED;
+            default:
+                return CYNARA_API_ACCESS_DENIED;
         }
-        return CYNARA_API_ACCESS_DENIED;
     }
 };
 

diff --git a/src/plugin/service/ServicePlugin.cpp b/src/plugin/service/ServicePlugin.cpp
index d6f2ee0..e8812a6 100644 (file)
--- a/src/plugin/service/ServicePlugin.cpp
+++ b/src/plugin/service/ServicePlugin.cpp
@@ -82,8 +82,10 @@ public:
                 requiredAgent = AgentType(SupportedTypes::Agent::AgentType);
                 return PluginStatus::ANSWER_NOTREADY;
             }
-
-            result = PolicyResult(PredefinedPolicyType::ALLOW);
+            if (result.policyType() == SupportedTypes::Client::ALLOW_PER_LIFE)
+                result = PolicyResult(PredefinedPolicyType::ALLOW);
+            else
+                result = PolicyResult(PredefinedPolicyType::DENY);
             return PluginStatus::ANSWER_READY;
         } catch (const Translator::TranslateErrorException &e) {
             LOGE("Error translating request to data : " << e.what());
@@ -104,9 +106,13 @@ public:
         try {
             PolicyType resultType = Translator::Plugin::dataToAnswer(agentData);
             result = PolicyResult(resultType);
+
             if (resultType == SupportedTypes::Client::ALLOW_PER_LIFE) {
                 m_cache.update(Key(client, user, privilege), PolicyResult(resultType));
                 result = PolicyResult(PredefinedPolicyType::ALLOW);
+            } else if (resultType == SupportedTypes::Client::DENY_PER_LIFE) {
+                m_cache.update(Key(client, user, privilege), PolicyResult(resultType));
+                result = PolicyResult(PredefinedPolicyType::DENY);
             }
 
             return PluginStatus::SUCCESS;