stdcrpcaccess

Documentation

Overview

Package stdcrpcaccess implements access control for our RPC.

Index

• func SignTestToken(tok jwt.Token) (string, error)
• func WithSignedTestToken(base connect.HTTPClient, createToken func(r *http.Request) jwt.Token) connect.HTTPClient
• func WithTestAuthBackend() fx.Option
• type AccessControl
  • func New[T Claims[T]](back AuthBackend, signing jwk.Set) *AccessControl[T]
  • func (ac *AccessControl[T]) Close(context.Context) error
  • func (ac *AccessControl[T]) Sign(ctx context.Context, claims T, signingKeyID string) ([]byte, error)
  • func (ac *AccessControl[T]) Wrap(next http.Handler) http.Handler
• type AuthBackend
• type Claims
• type RealAuthBackend
  • func (ap RealAuthBackend) JWKSEndpoint() string
• type TestAuthBackend
  • func NewTestAuthBackend() *TestAuthBackend
  • func (ap TestAuthBackend) JWKSEndpoint() string

Functions

func SignTestToken

func SignTestToken(tok jwt.Token) (string, error)

SignTestToken signs a valid JWT against a well-known private key for testing.

func WithSignedTestToken

func WithSignedTestToken(base connect.HTTPClient, createToken func(r *http.Request) jwt.Token) connect.HTTPClient

WithSignedTestToken is a http client middleware that always adds a valid (self signed) token for testing.

func WithTestAuthBackend

func WithTestAuthBackend() fx.Option

WithTestAuthBackend injects dependencies for allowing tests to sign and validate access tokens.

Types

type AccessControl

type AccessControl[T Claims[T]] struct {
	// contains filtered or unexported fields
}

AccessControl implements a simple access control scheme.

func New

func New[T Claims[T]](back AuthBackend, signing jwk.Set) *AccessControl[T]

New inits the access control.

func (*AccessControl[T]) Close

func (ac *AccessControl[T]) Close(context.Context) error

Close cancels the lifecycle context.

func (*AccessControl[T]) Sign

func (ac *AccessControl[T]) Sign(
	ctx context.Context,
	claims T,
	signingKeyID string,
) ([]byte, error)

Sign turns auth information T into an access token that is accepted by auth checks.

func (*AccessControl[T]) Wrap

func (ac *AccessControl[T]) Wrap(next http.Handler) http.Handler

type AuthBackend

type AuthBackend interface {
	JWKSEndpoint() string
}

AuthBackend represents and OIDC service that we don't control the signing process of.

type Claims

type Claims[T any] interface {
	// ProcedurePermissions is implemented to turn the claims into permissions for connect RPC procedure annotation.
	ProcedurePermissions() []string
	// ReadAccessToken allows the implementation to take information from the access token. This is called
	// AFTER custom claims have been read from the access token.
	ReadAccessToken(ctx context.Context, tok jwt.Token) (T, error)
	// ToAccessToken describes how an access token is created from the auth information. This is used for the signing
	// procedure.
	ToAccessToken(ctx context.Context) (jwt.Token, error)
	// DecorateContext implements how auth information is stored in the context for the rest of the application to use.
	DecorateContext(ctx context.Context) context.Context
	// AsAnonymous returns a copy of the info that is usuable to the application for anonymous access. If false is
	// returned anonymous access is not allowed.
	AsAnonymous(ctx context.Context, req *http.Request) (T, bool)
}

Claims constrains the type that will hold authentication claims.

type RealAuthBackend

type RealAuthBackend string

RealAuthBackend is used when actually deploying.

func (RealAuthBackend) JWKSEndpoint

func (ap RealAuthBackend) JWKSEndpoint() string

type TestAuthBackend

type TestAuthBackend struct {
	// contains filtered or unexported fields
}

TestAuthBackend is an auth backend that is run locally and we control the signing process for.

func NewTestAuthBackend

func NewTestAuthBackend() *TestAuthBackend

NewTestAuthBackend starts a server for testing that serves the key set.

func (TestAuthBackend) JWKSEndpoint

func (ap TestAuthBackend) JWKSEndpoint() string