peridot/utils/interceptors.go
Mustafa Gezen eeaced0b14
Chain interceptors using grpc_middleware
Signed-off-by: Mustafa Gezen <mustafa@ctrliq.com>
2022-08-31 20:06:03 +02:00

213 lines
7.5 KiB
Go

// Copyright (c) All respective contributors to the Peridot Project. All rights reserved.
// Copyright (c) 2021-2022 Rocky Enterprise Software Foundation, Inc. All rights reserved.
// Copyright (c) 2021-2022 Ctrl IQ, Inc. All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are met:
//
// 1. Redistributions of source code must retain the above copyright notice,
// this list of conditions and the following disclaimer.
//
// 2. Redistributions in binary form must reproduce the above copyright notice,
// this list of conditions and the following disclaimer in the documentation
// and/or other materials provided with the distribution.
//
// 3. Neither the name of the copyright holder nor the names of its contributors
// may be used to endorse or promote products derived from this software without
// specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
// ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
// LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
// SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
// CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
// POSSIBILITY OF SUCH DAMAGE.
package utils
import (
"context"
"fmt"
"github.com/go-openapi/runtime"
"github.com/go-openapi/strfmt"
"github.com/ory/hydra-client-go/client"
"github.com/ory/hydra-client-go/client/admin"
"github.com/ory/hydra-client-go/client/public"
"github.com/sirupsen/logrus"
"google.golang.org/grpc"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/metadata"
"google.golang.org/grpc/status"
"strings"
)
type InterceptorFunc func(ctx context.Context, req interface{}, usi *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error)
type ServerInterceptorFunc func(srv interface{}, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error
type ContextUser struct {
ID string `json:"id"`
AuthToken string `json:"authToken"`
Name string `json:"name"`
Email string `json:"email"`
}
// Finish chains all interceptors
func (a InterceptorFunc) Finish(ctx context.Context, req interface{}, usi *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
return a(ctx, req, usi, handler)
}
func (a ServerInterceptorFunc) Finish(srv interface{}, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
return a(srv, ss, info, handler)
}
// EndInterceptor should be used in the end of an interceptor chain
func EndInterceptor(ctx context.Context, req interface{}, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
return handler(ctx, req)
}
func ServerEndInterceptor(srv interface{}, ss grpc.ServerStream, _ *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
return handler(srv, ss)
}
func checkAuth(ctx context.Context, hydraSDK *client.OryHydra, hydraAdmin *client.OryHydra) (context.Context, error) {
// fetch metadata from grpc
meta, ok := metadata.FromIncomingContext(ctx)
if !ok {
return ctx, status.Error(codes.InvalidArgument, "invalid request sent")
}
// get authorization header
authHeader := meta["authorization"]
if len(authHeader) == 0 {
return ctx, status.Error(codes.InvalidArgument, "empty authorization header")
}
// verify that the authorization header contains a Bearer token
authToken := strings.SplitN(authHeader[0], " ", 2)
if len(authToken) != 2 || authToken[0] != "Bearer" {
return ctx, status.Error(codes.InvalidArgument, "invalid authorization token")
}
userInfo, err := hydraSDK.Public.Userinfo(
&public.UserinfoParams{
Context: ctx,
},
runtime.ClientAuthInfoWriterFunc(func(request runtime.ClientRequest, registry strfmt.Registry) error {
return request.SetHeaderParam("Authorization", authHeader[0])
}),
)
if err != nil {
return ctx, err
}
if userInfo.Payload.Sub == "" && hydraAdmin != nil {
introspect, err := hydraAdmin.Admin.IntrospectOAuth2Token(
&admin.IntrospectOAuth2TokenParams{
Context: ctx,
Token: authToken[1],
},
)
if err != nil {
logrus.Errorf("error introspecting token: %s", err)
return ctx, status.Errorf(codes.Unauthenticated, "invalid authorization token")
}
userInfo.Payload.Sub = introspect.Payload.ClientID
userInfo.Payload.Name = introspect.Payload.Sub
userInfo.Payload.Email = fmt.Sprintf("%s@%s", introspect.Payload.Sub, "serviceaccount.resf.org")
}
if userInfo.Payload.Sub == "" {
return ctx, status.Errorf(codes.Unauthenticated, "invalid authorization token")
}
// supply subject and token to further requests
pairs := metadata.Pairs("x-user-id", userInfo.Payload.Sub, "x-user-name", userInfo.Payload.Name, "x-user-email", userInfo.Payload.Email, "x-auth-token", authToken[1])
ctx = metadata.NewIncomingContext(ctx, metadata.Join(meta, pairs))
return ctx, nil
}
// AuthInterceptor requires OAuth2 authentication for all routes except listed
func AuthInterceptor(hydraSDK *client.OryHydra, hydraAdminSDK *client.OryHydra, excludedMethods []string, enforce bool, next InterceptorFunc) InterceptorFunc {
return func(ctx context.Context, req interface{}, usi *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
// skip authentication for excluded methods
if !StrContains(usi.FullMethod, excludedMethods) {
var err error
if ctx, err = checkAuth(ctx, hydraSDK, hydraAdminSDK); err != nil {
if enforce {
return nil, err
}
}
}
return next(ctx, req, usi, handler)
}
}
type serverStream struct {
grpc.ServerStream
ctx context.Context
}
func (ss *serverStream) Context() context.Context {
return ss.ctx
}
func ServerAuthInterceptor(hydraSDK *client.OryHydra, hydraAdminSDK *client.OryHydra, excludedMethods []string, enforce bool, next ServerInterceptorFunc) ServerInterceptorFunc {
return func(srv interface{}, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
newStream := serverStream{
ServerStream: ss,
ctx: ss.Context(),
}
// skip authentication for excluded methods
if !StrContains(info.FullMethod, excludedMethods) {
var ctx context.Context
var err error
if ctx, err = checkAuth(ss.Context(), hydraSDK, hydraAdminSDK); err != nil {
if enforce {
return err
}
}
if ctx != nil {
newStream.ctx = ctx
}
}
return next(srv, &newStream, info, handler)
}
}
func UserFromContext(ctx context.Context) (*ContextUser, error) {
meta, ok := metadata.FromIncomingContext(ctx)
if !ok {
return nil, status.Error(codes.InvalidArgument, "invalid request sent")
}
uid := meta["x-user-id"]
if len(uid) == 0 {
return nil, status.Error(codes.Unauthenticated, "no user id")
}
authTokens := meta["x-auth-token"]
if len(authTokens) == 0 {
return nil, status.Error(codes.Unauthenticated, "no auth token")
}
var name string
if names := meta["x-user-name"]; len(names) > 0 {
name = names[0]
}
var email string
if emails := meta["x-user-email"]; len(emails) > 0 {
email = emails[0]
}
return &ContextUser{
ID: uid[0],
AuthToken: authTokens[0],
Name: name,
Email: email,
}, nil
}