Issue #776: Obey access levels in the server #778
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds the necessary checks to the NodeNamespace to verify access levels before setting or returning attribute values.
A couple integration test cases were added to verify this functionality. There are already some RO/RW integration tests but they weren't picking this up.
Further changes will eventually be needed to properly support both access types - user based and overall. Right now it treats them both the same. If server authentication is ever implemented, this will have to be revisited and the user data will somehow have to be provided to the attribute get/set functions or similar.
The issue also questions what the best way to get notifications from a node change event in the server is. This was not addressed - you can achieve this today with a custom Namespace implementation or though custom value functions on your nodes. I could add a generic notification mechanism to the server that would allow you to register a callback or channel to receive notifications on, but I'm not sure yet what would be a better solution so this is left for a future change.
There was also a problem with the new
DataValueFromValue
function introduced in the last change to the server which switched everything from variants to datavalues that would choke in certain cases. These have been addressed. In some future breaking change, I think this function should probably be renamed toMustDataValue
or similar to match equivalent functions in other parts of the code.-- Here's what copilot has to say about it --
This pull request introduces several improvements and new features to the server codebase, focusing on dynamic data value handling, access control, and enhanced testing. Below are the most important changes:
Dynamic Data Value Handling:
examples/server/node_server/server.go
: Updatedvar2
to useserver.DataValueFromValue
instead ofua.MustVariant
for better dynamic value handling. Added new nodes (var4
,var5
,var6
) with different access levels and data values. [1] [2]Access Control Enhancements:
server/namespace_node.go
: Added access checks inAttribute
andSetAttribute
methods to enforce read and write permissions based on access levels. [1] [2]server/node.go
: IntroducedAccess
method toNode
struct to check user and global access levels.Code Refactoring:
server/monitored_item_service.go
: ModifiedDeleteMonitoredItem
method to properly update theNodes
andSubs
maps after deletion. [1] [2]server/node.go
: EnhancedDataValueFromValue
function to handle multiple types and addedValueFunc
handling inNewVariableNode
. [1] [2]Testing Improvements:
tests/go/read_test.go
: AddedTestReadPerms
to verify read permissions for various nodes and their expected status codes. [1] [2]tests/go/server.go
: Added new nodes with specific access levels for testing purposes.Miscellaneous:
server/nodeset2_import.go
: Fixed error handling inImportNodeSet
method.server/server.go
: Added comments to explain the pre-compiled nodeset in theNew
function.server/view_service.go
: Correctedslices.Delete
usage insuitableRefType
function.These changes collectively enhance the server's functionality, security, and maintainability, while also improving test coverage.