server

Documentation

Overview

Package server provides the HTTP server for zitadel-rbac-mapper.

Index

• func NewSyncAllHandler(logger *slog.Logger, res resolver.GroupsResolver, ...) fiber.Handler
• func NewZitadelWebhookHandler(logger *slog.Logger, res resolver.GroupsResolver, ...) fiber.Handler
• func Run(ctx context.Context, logger *slog.Logger, cfg Config, ...) error
• type Config
• type Problem
• type SyncAllResponse
• type UserLocks
  • func (ul *UserLocks) Lock(userID string)
  • func (ul *UserLocks) Unlock(userID string)

Functions

func NewSyncAllHandler

func NewSyncAllHandler(
	logger *slog.Logger,
	res resolver.GroupsResolver,
	rulesSource mapper.RulesSource,
	syncer *grantsync.Syncer,
	apiKey string,
	userLocks *UserLocks,
) fiber.Handler

NewSyncAllHandler returns a fiber handler for POST /sync (full reconciliation). It verifies the X-Sync-Key header, force-refreshes rules across all orgs, then iterates each org → lists users → syncs grants.

func NewZitadelWebhookHandler

func NewZitadelWebhookHandler(
	logger *slog.Logger,
	res resolver.GroupsResolver,
	rulesSource mapper.RulesSource,
	syncer *grantsync.Syncer,
	jwtVerifier *zitadeljwt.Verifier,
	userLocks *UserLocks,
) fiber.Handler

NewZitadelWebhookHandler creates a fiber handler for POST /webhook.

This handler receives Zitadel Actions V2 function payloads (preuserinfo, preaccesstoken) via a restCall target with JWT payload type. It:

1. Verifies the JWT signature using the instance JWKS
2. Extracts the user email from the payload
3. Resolves Google Workspace groups via the groups resolver
4. Maps groups to desired grants using the cached rules
5. Syncs UserGrants in Zitadel (idempotent add/update/remove)
6. Returns append_claims with a "groups" claim containing the group emails

func Run

func Run(
	ctx context.Context,
	logger *slog.Logger,
	cfg Config,
	res resolver.GroupsResolver,
	rulesSource mapper.RulesSource,
	syncer *grantsync.Syncer,
	jwtVerifier *zitadeljwt.Verifier,
) error

Run starts the HTTP server and blocks until the context is canceled.

Types

type Config

type Config struct {
	Port       int
	HealthPort int
	SyncAPIKey string
}

Config holds server configuration.

type Problem

type Problem struct {
	Type   string `json:"type"`
	Title  string `json:"title"`
	Status int    `json:"status"`
	Detail string `json:"detail,omitempty"`
}

Problem represents an RFC 9457 Problem Details response.

type SyncAllResponse

type SyncAllResponse struct {
	UsersProcessed int `json:"users_processed"`
	GrantsAdded    int `json:"grants_added"`
	GrantsUpdated  int `json:"grants_updated"`
	GrantsRemoved  int `json:"grants_removed"`
}

SyncAllResponse is the JSON response for POST /sync.

type UserLocks

type UserLocks struct {
	// contains filtered or unexported fields
}

UserLocks provides per-user mutexes to prevent race conditions when scheduled sync-all and login webhook fire for the same user.

func (*UserLocks) Lock

func (ul *UserLocks) Lock(userID string)

Lock acquires the mutex for the given userID.

func (*UserLocks) Unlock

func (ul *UserLocks) Unlock(userID string)

Unlock releases the mutex for the given userID.