rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Extract authn & authz utils

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-01-09 11:23:42 +01:00
committed by Bryan Frimin
parent bbdea575d1
commit 1257347df9
21 changed files with 185 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/server/api/console/v1/graphql_handler.go
View File

@@ -20,7 +20,7 @@ import (
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/probo"
connect_v1 "go.probo.inc/probo/pkg/server/api/connect/v1"
"go.probo.inc/probo/pkg/server/api/authz"
"go.probo.inc/probo/pkg/server/api/console/v1/schema"
"go.probo.inc/probo/pkg/server/gqlutils"
)
@@ -28,7 +28,7 @@ import (
func NewGraphQLHandler(iamSvc *iam.Service, proboSvc *probo.Service, customDomainCname string, logger *log.Logger) http.Handler {
config := schema.Config{
Resolvers: &Resolver{
authorize: connect_v1.NewAuthorizeFunc(iamSvc, logger),
authorize: authz.NewAuthorizeFunc(iamSvc, logger),
probo: proboSvc,
iam: iamSvc,
customDomainCname: customDomainCname,

17
pkg/server/api/console/v1/resolver.go
View File

@@ -35,14 +35,15 @@ import (
"go.probo.inc/probo/pkg/probo"
"go.probo.inc/probo/pkg/saferedirect"
"go.probo.inc/probo/pkg/securecookie"
connect_v1 "go.probo.inc/probo/pkg/server/api/connect/v1"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/authz"
"go.probo.inc/probo/pkg/server/api/console/v1/types"
"go.probo.inc/probo/pkg/statelesstoken"
)
type (
Resolver struct {
authorize connect_v1.AuthorizeFunc
authorize authz.AuthorizeFunc
probo *probo.Service
iam *iam.Service
customDomainCname string
@@ -63,9 +64,9 @@ func NewMux(
safeRedirect := &saferedirect.SafeRedirect{AllowedHost: baseURL.Host()}
r.Use(connect_v1.NewSessionMiddleware(iamSvc, cookieConfig))
r.Use(connect_v1.NewAPIKeyMiddleware(iamSvc, tokenSecret))
r.Use(connect_v1.NewIdentityPresenceMiddleware())
r.Use(authn.NewSessionMiddleware(iamSvc, cookieConfig))
r.Use(authn.NewAPIKeyMiddleware(iamSvc, tokenSecret))
r.Use(authn.NewIdentityPresenceMiddleware())
graphqlHandler := NewGraphQLHandler(iamSvc, proboSvc, customDomainCname, logger)
@@ -199,18 +200,18 @@ func NewMux(
panic(fmt.Errorf("cannot parse organization id: %w", err))
}
apiKey := connect_v1.APIKeyFromContext(r.Context())
apiKey := authn.APIKeyFromContext(r.Context())
if apiKey != nil {
httpserver.RenderError(w, http.StatusBadRequest, fmt.Errorf("api key authentication cannot be used for this endpoint"))
return
}
identity := connect_v1.IdentityFromContext(r.Context())
identity := authn.IdentityFromContext(r.Context())
if identity == nil {
httpserver.RenderError(w, http.StatusUnauthorized, fmt.Errorf("authentication required"))
return
}
session := connect_v1.SessionFromContext(r.Context())
session := authn.SessionFromContext(r.Context())
if session == nil {
httpserver.RenderError(w, http.StatusUnauthorized, fmt.Errorf("authentication required"))
return

30
pkg/server/api/console/v1/v1_resolver.go
View File

@@ -19,7 +19,7 @@ import (
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/page"
"go.probo.inc/probo/pkg/probo"
connect_v1 "go.probo.inc/probo/pkg/server/api/connect/v1"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/console/v1/schema"
"go.probo.inc/probo/pkg/server/api/console/v1/types"
"go.probo.inc/probo/pkg/server/gqlutils"
@@ -1037,7 +1037,7 @@ func (r *documentVersionResolver) Signed(ctx context.Context, obj *types.Documen
return false, err
}
identity := connect_v1.IdentityFromContext(ctx)
identity := authn.IdentityFromContext(ctx)
prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -2419,7 +2419,7 @@ func (r *mutationResolver) ExportFramework(ctx context.Context, input types.Expo
}
prb := r.ProboService(ctx, input.FrameworkID.TenantID())
identity := connect_v1.IdentityFromContext(ctx)
identity := authn.IdentityFromContext(ctx)
exportErr, exportJobID := prb.Frameworks.RequestExport(
ctx,
@@ -3681,7 +3681,7 @@ func (r *mutationResolver) PublishDocumentVersion(ctx context.Context, input typ
prb := r.ProboService(ctx, input.DocumentID.TenantID())
identity := connect_v1.IdentityFromContext(ctx)
identity := authn.IdentityFromContext(ctx)
document, documentVersion, err := prb.Documents.PublishVersion(ctx, input.DocumentID, identity.ID, input.Changelog)
if err != nil {
@@ -3717,7 +3717,7 @@ func (r *mutationResolver) BulkPublishDocumentVersions(ctx context.Context, inpu
prb := r.ProboService(ctx, input.DocumentIds[0].TenantID())
identity := connect_v1.IdentityFromContext(ctx)
identity := authn.IdentityFromContext(ctx)
documentVersions, documents, err := prb.Documents.BulkPublishVersions(
ctx,
@@ -3784,7 +3784,7 @@ func (r *mutationResolver) BulkExportDocuments(ctx context.Context, input types.
prb := r.ProboService(ctx, input.DocumentIds[0].TenantID())
identity := connect_v1.IdentityFromContext(ctx)
identity := authn.IdentityFromContext(ctx)
options := probo.ExportPDFOptions{
WithWatermark: input.WithWatermark,
@@ -3986,7 +3986,7 @@ func (r *mutationResolver) SignDocument(ctx context.Context, input types.SignDoc
return nil, err
}
identity := connect_v1.IdentityFromContext(ctx)
identity := authn.IdentityFromContext(ctx)
prb := r.ProboService(ctx, input.DocumentVersionID.TenantID())
documentVersionSignature, err := prb.Documents.SignDocumentVersionByEmail(ctx, input.DocumentVersionID, identity.EmailAddress)
@@ -4043,7 +4043,7 @@ func (r *mutationResolver) ExportSignableVersionDocumentPDF(ctx context.Context,
panic(fmt.Errorf("cannot get document version: %w", err))
}
identity := connect_v1.IdentityFromContext(ctx)
identity := authn.IdentityFromContext(ctx)
documentFilter := coredata.NewDocumentFilter(nil).WithUserEmail(&identity.EmailAddress)
_, err = prb.Documents.GetWithFilter(ctx, documentVersion.DocumentID, documentFilter)
@@ -6689,10 +6689,10 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
// Viewer is the resolver for the viewer field.
func (r *queryResolver) Viewer(ctx context.Context) (*types.Viewer, error) {
identity := connect_v1.IdentityFromContext(ctx)
identity := authn.IdentityFromContext(ctx)
session := connect_v1.SessionFromContext(ctx)
apiKey := connect_v1.APIKeyFromContext(ctx)
session := authn.SessionFromContext(ctx)
apiKey := authn.APIKeyFromContext(ctx)
var viewerID gid.GID
if session != nil {
@@ -7020,7 +7020,7 @@ func (r *signableDocumentResolver) Signed(ctx context.Context, obj *types.Signab
return false, err
}
identity := connect_v1.IdentityFromContext(ctx)
identity := authn.IdentityFromContext(ctx)
prb := r.ProboService(ctx, obj.ID.TenantID())
@@ -7053,7 +7053,7 @@ func (r *signableDocumentResolver) Versions(ctx context.Context, obj *types.Sign
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
user := connect_v1.IdentityFromContext(ctx)
user := authn.IdentityFromContext(ctx)
versionFilter := coredata.NewDocumentVersionFilter().WithUserEmail(&user.EmailAddress)
@@ -8350,7 +8350,7 @@ func (r *viewerResolver) SignableDocuments(ctx context.Context, obj *types.Viewe
cursor := types.NewCursor(first, after, last, before, pageOrderBy)
identity := connect_v1.IdentityFromContext(ctx)
identity := authn.IdentityFromContext(ctx)
documentFilter := coredata.NewDocumentFilter(nil).WithUserEmail(&identity.EmailAddress)
@@ -8384,7 +8384,7 @@ func (r *viewerResolver) SignableDocument(ctx context.Context, obj *types.Viewer
prb := r.ProboService(ctx, id.TenantID())
identity := connect_v1.IdentityFromContext(ctx)
identity := authn.IdentityFromContext(ctx)
documentFilter := coredata.NewDocumentFilter(nil).WithUserEmail(&identity.EmailAddress)
document, err := prb.Documents.GetWithFilter(ctx, id, documentFilter)