mirror of
https://github.com/paralus/paralus.git
synced 2026-02-14 09:39:50 +00:00
122 lines
3.2 KiB
Go
122 lines
3.2 KiB
Go
package authv3
|
|
|
|
import (
|
|
"database/sql"
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/paralus/paralus/pkg/enforcer"
|
|
logv2 "github.com/paralus/paralus/pkg/log"
|
|
"github.com/paralus/paralus/pkg/service"
|
|
kclient "github.com/ory/kratos-client-go"
|
|
"github.com/uptrace/bun"
|
|
"go.uber.org/zap"
|
|
|
|
"github.com/uptrace/bun/dialect/pgdialect"
|
|
"github.com/uptrace/bun/driver/pgdriver"
|
|
"gorm.io/driver/postgres"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
var _log = logv2.GetLogger()
|
|
|
|
type Option struct {
|
|
// ExcludeRPCMethods is a list of full RPC method string in
|
|
// format /package.service/method (for example,
|
|
// /rafay.dev.rpc.v3.Idp/ListIdps). These RPC methods are to
|
|
// be excluded from the auth interceptor.
|
|
ExcludeRPCMethods []string
|
|
|
|
// ExcludeURLs is a list of URL regular expressions that are
|
|
// excluded from the auth middleware.
|
|
ExcludeURLs []string
|
|
|
|
// ExcludeAuthzMethods is a list of RPC method strings which only
|
|
// do authentication and not authorization.
|
|
ExcludeAuthzMethods []string
|
|
}
|
|
|
|
type authContext struct {
|
|
db *bun.DB
|
|
kc *kclient.APIClient
|
|
ks service.ApiKeyService
|
|
as service.AuthzService
|
|
}
|
|
|
|
// SetupAuthContext sets up new authContext along with its
|
|
// dependencies. If the caller already has instances of authContext
|
|
// fields created then use NewAuthContext instead.
|
|
func SetupAuthContext(auditLogger *zap.Logger) authContext {
|
|
var (
|
|
kc *kclient.APIClient
|
|
kratosAddr string
|
|
db *bun.DB
|
|
)
|
|
|
|
// Initialize database
|
|
sqldb := sql.OpenDB(pgdriver.NewConnector(pgdriver.WithDSN(getDSN())))
|
|
db = bun.NewDB(sqldb, pgdialect.New())
|
|
|
|
if v, ok := os.LookupEnv("KRATOS_PUB_ADDR"); ok {
|
|
kratosAddr = v
|
|
} else {
|
|
kratosAddr = "http://localhost:4433"
|
|
}
|
|
kratosConfig := kclient.NewConfiguration()
|
|
kratosConfig.Servers[0].URL = kratosAddr
|
|
kc = kclient.NewAPIClient(kratosConfig)
|
|
|
|
gormDb, err := gorm.Open(
|
|
postgres.New(postgres.Config{Conn: db.DB}),
|
|
&gorm.Config{},
|
|
)
|
|
if err != nil {
|
|
_log.Fatalw("unable to create db connection", "error", err)
|
|
}
|
|
enforcer, err := enforcer.NewCasbinEnforcer(gormDb).Init()
|
|
if err != nil {
|
|
_log.Fatalw("unable to init enforcer", "error", err)
|
|
}
|
|
as := service.NewAuthzService(db, enforcer)
|
|
|
|
return authContext{db: db, kc: kc, as: as, ks: service.NewApiKeyService(db, auditLogger)}
|
|
}
|
|
|
|
func getDSN() string {
|
|
dsn := getEnvWithDefault("DSN", "")
|
|
if dsn == "" {
|
|
dbUser := getEnvWithDefault("DB_USER", "admindbuser")
|
|
dbPassword := getEnvWithDefault("DB_PASSWORD", "admindbpassword")
|
|
dbAddr := getEnvWithDefault("DB_ADDR", "localhost:5432")
|
|
dbName := getEnvWithDefault("DB_NAME", "admindb")
|
|
dsn = fmt.Sprintf("postgres://%s:%s@%s/%s?sslmode=disable", dbUser, dbPassword, dbAddr, dbName)
|
|
}
|
|
return dsn
|
|
}
|
|
|
|
func getEnvWithDefault(env, def string) string {
|
|
val := os.Getenv(env)
|
|
if val == "" {
|
|
return def
|
|
}
|
|
return val
|
|
}
|
|
|
|
// NewAuthContext instantiate authContext. NewAuthContext creates
|
|
// authContext reusing dependency instances from calling function
|
|
// instead of creating new instances. To create authContext along with
|
|
// its dependencies, use SetupAuthContext.
|
|
func NewAuthContext(
|
|
db *bun.DB,
|
|
kc *kclient.APIClient,
|
|
apiKeySvc service.ApiKeyService,
|
|
authzSvc service.AuthzService,
|
|
) authContext {
|
|
return authContext{
|
|
db: db,
|
|
kc: kc,
|
|
ks: apiKeySvc,
|
|
as: authzSvc,
|
|
}
|
|
}
|