File Coverage

blib/lib/Beam/Runnable/AllowUsers.pm

Criterion	Covered	Total	%
statement	15	15	100.0
branch			n/a
condition			n/a
subroutine	5	5	100.0
pod			n/a
total	20	20	100.0

package Beam::Runnable::AllowUsers;
our $VERSION = '0.015';
# ABSTRACT: Only allow certain users to run a command

#pod =head1 SYNOPSIS
#pod
#pod     ### In a Runnable module
#pod     package My::Runnable::Script;
#pod     use Moo;
#pod     with 'Beam::Runnable', 'Beam::Runnable::AllowUsers';
#pod     has '+allow_users' => ( default => [ 'root' ] );
#pod     sub run { }
#pod
#pod     ### In a container config file
#pod     runnable:
#pod         $class: My::Runnable::Script
#pod         $with:
#pod             - 'Beam::Runnable::AllowUsers'
#pod         allow_users:
#pod             - root
#pod             - doug
#pod
#pod =head1 DESCRIPTION
#pod
#pod This role checks to ensure that only certain users can run a command. If
#pod an unauthorized user runs the command, it dies with an error instead.
#pod
#pod B This is mostly a demonstration of a L role.
#pod Users that can write to the configuration file can edit who is allowed
#pod to run the command, and there are other ways to prevent access to
#pod a file/command.
#pod
#pod =head1 SEE ALSO
#pod
#pod L, L, L<< perlvar/$> >>
#pod
#pod =cut

use strict;
use warnings;
use Moo::Role;
use List::Util qw( any );
use Types::Standard qw( ArrayRef Str );

#pod =attr allow_users
#pod
#pod An array reference of user names that are allowed to run this task.
#pod
#pod =cut

has allow_users => (
    is => 'ro',
    isa => ArrayRef[ Str ],
    required => 1,
);

#pod =method run
#pod
#pod This role wraps the C method of your runnable class to check that
#pod the user is authorized.
#pod
#pod =cut

before run => sub {
    my ( $self, @args ) = @_;
    my $user = getpwuid( $> );
    die "Unauthorized user: $user\n"
        unless any { $_ eq $user } @{ $self->allow_users };
};

1;

__END__