rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Split Config

Browse Source 
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2025-08-04 20:45:21 +02:00
parent 91e635eae5
commit 4ff71312f9
8 changed files with 154 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
pkg/server/api/api.go
View File

@@ -34,19 +34,30 @@ import (
)
type (
AuthConfig struct {
ConsoleAuthConfig struct {
CookieName string
CookieDomain string
SessionDuration time.Duration
CookieSecret string
}
TrustAuthConfig struct {
CookieName string
CookieDomain string
CookieDuration time.Duration
TokenDuration time.Duration
TokenSecret string
Scope string
TokenType string
}
Config struct {
AllowedOrigins []string
Probo *probo.Service
Usrmgr *usrmgr.Service
Trust *trust.Service
Auth AuthConfig
Auth ConsoleAuthConfig
TrustAuth TrustAuthConfig
ConnectorRegistry *connector.ConnectorRegistry
SafeRedirect *saferedirect.SafeRedirect
Logger *log.Logger
@@ -152,12 +163,21 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
s.cfg.Logger.Named("trust.v1"),
s.cfg.Usrmgr,
s.cfg.Trust,
trust_v1.AuthConfig{
console_v1.AuthConfig{
CookieName: s.cfg.Auth.CookieName,
CookieDomain: s.cfg.Auth.CookieDomain,
SessionDuration: s.cfg.Auth.SessionDuration,
CookieSecret: s.cfg.Auth.CookieSecret,
},
trust_v1.TrustAuthConfig{
CookieName: s.cfg.TrustAuth.CookieName,
CookieDomain: s.cfg.TrustAuth.CookieDomain,
CookieDuration: s.cfg.TrustAuth.CookieDuration,
TokenDuration: s.cfg.TrustAuth.TokenDuration,
TokenSecret: s.cfg.TrustAuth.TokenSecret,
Scope: s.cfg.TrustAuth.Scope,
TokenType: s.cfg.TrustAuth.TokenType,
},
),
)

62
pkg/server/api/trust/v1/resolver.go
View File

@@ -31,6 +31,7 @@ import (
"github.com/getprobo/probo/pkg/gid"
"github.com/getprobo/probo/pkg/probo"
"github.com/getprobo/probo/pkg/securecookie"
console_v1 "github.com/getprobo/probo/pkg/server/api/console/v1"
"github.com/getprobo/probo/pkg/server/api/trust/v1/auth"
"github.com/getprobo/probo/pkg/server/api/trust/v1/schema"
"github.com/getprobo/probo/pkg/statelesstoken"
@@ -42,26 +43,25 @@ import (
)
type (
AuthConfig struct {
CookieName string
CookieDomain string
SessionDuration time.Duration
CookieSecret string
TrustAuthConfig struct {
CookieName string
CookieDomain string
CookieDuration time.Duration
TokenDuration time.Duration
TokenSecret string
Scope string
TokenType string
}
Resolver struct {
trustCenterSvc *trust.Service
authCfg AuthConfig
authCfg console_v1.AuthConfig
trustAuthCfg TrustAuthConfig
}
ctxKey struct{ name string }
)
const (
TokenScopeTrustCenterReadOnly = "trust_center_readonly"
TokenCookieName = "trust_center_token"
)
var (
sessionContextKey = &ctxKey{name: "session"}
userContextKey = &ctxKey{name: "user"}
@@ -98,22 +98,24 @@ func NewMux(
logger *log.Logger,
usrmgrSvc *usrmgr.Service,
trustSvc *trust.Service,
authCfg AuthConfig,
authCfg console_v1.AuthConfig,
trustAuthCfg TrustAuthConfig,
) *chi.Mux {
r := chi.NewMux()
r.Handle("/graphql", graphqlHandler(logger, usrmgrSvc, trustSvc, authCfg))
r.Handle("/graphql", graphqlHandler(logger, usrmgrSvc, trustSvc, authCfg, trustAuthCfg))
r.Post("/auth/authenticate", authTokenHandler(trustSvc, authCfg))
r.Delete("/auth/logout", trustCenterLogoutHandler(authCfg))
r.Post("/auth/authenticate", authTokenHandler(trustSvc, trustAuthCfg))
r.Delete("/auth/logout", trustCenterLogoutHandler(trustAuthCfg))
return r
}
func graphqlHandler(logger *log.Logger, usrmgrSvc *usrmgr.Service, trustSvc *trust.Service, authCfg AuthConfig) http.HandlerFunc {
func graphqlHandler(logger *log.Logger, usrmgrSvc *usrmgr.Service, trustSvc *trust.Service, authCfg console_v1.AuthConfig, trustAuthCfg TrustAuthConfig) http.HandlerFunc {
resolver := &Resolver{
trustCenterSvc: trustSvc,
authCfg: authCfg,
trustAuthCfg: trustAuthCfg,
}
c := schema.Config{
@@ -139,7 +141,7 @@ func graphqlHandler(logger *log.Logger, usrmgrSvc *usrmgr.Service, trustSvc *tru
return errors.New("internal server error")
})
return WithSession(usrmgrSvc, trustSvc, authCfg, srv.ServeHTTP)
return WithSession(usrmgrSvc, trustSvc, authCfg, trustAuthCfg, srv.ServeHTTP)
}
// TrustService returns a trust service scoped to the given tenant
@@ -152,11 +154,11 @@ func (r *Resolver) GetTenantService(ctx context.Context, tenantID gid.TenantID)
return r.trustCenterSvc.WithTenant(tenantID)
}
func WithSession(usrmgrSvc *usrmgr.Service, trustSvc *trust.Service, authCfg AuthConfig, next http.HandlerFunc) http.HandlerFunc {
func WithSession(usrmgrSvc *usrmgr.Service, trustSvc *trust.Service, authCfg console_v1.AuthConfig, trustAuthCfg TrustAuthConfig, next http.HandlerFunc) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
if authCtx := tryTokenAuth(ctx, w, r, trustSvc, authCfg); authCtx != nil {
if authCtx := tryTokenAuth(ctx, w, r, trustSvc, trustAuthCfg); authCtx != nil {
next(w, r.WithContext(authCtx))
return
}
@@ -171,7 +173,7 @@ func WithSession(usrmgrSvc *usrmgr.Service, trustSvc *trust.Service, authCfg Aut
}
}
func trySessionAuth(ctx context.Context, w http.ResponseWriter, r *http.Request, usrmgrSvc *usrmgr.Service, authCfg AuthConfig) context.Context {
func trySessionAuth(ctx context.Context, w http.ResponseWriter, r *http.Request, usrmgrSvc *usrmgr.Service, authCfg console_v1.AuthConfig) context.Context {
cookieValue, err := securecookie.Get(r, securecookie.DefaultConfig(
authCfg.CookieName,
authCfg.CookieSecret,
@@ -211,19 +213,19 @@ func trySessionAuth(ctx context.Context, w http.ResponseWriter, r *http.Request,
return ctx
}
func tryTokenAuth(ctx context.Context, w http.ResponseWriter, r *http.Request, trustSvc *trust.Service, authCfg AuthConfig) context.Context {
cookie, err := r.Cookie(TokenCookieName)
func tryTokenAuth(ctx context.Context, w http.ResponseWriter, r *http.Request, trustSvc *trust.Service, trustAuthCfg TrustAuthConfig) context.Context {
cookie, err := r.Cookie(trustAuthCfg.CookieName)
if err != nil {
return nil
}
payload, err := statelesstoken.ValidateToken[probo.TrustCenterAccessData](
authCfg.CookieSecret,
probo.TokenTypeTrustCenterAccess,
trustAuthCfg.TokenSecret,
trustAuthCfg.TokenType,
cookie.Value,
)
if err != nil {
clearTokenCookie(w, authCfg)
clearTokenCookie(w, trustAuthCfg)
return nil
}
@@ -233,24 +235,24 @@ func tryTokenAuth(ctx context.Context, w http.ResponseWriter, r *http.Request, t
TrustCenterID: payload.Data.TrustCenterID,
Email: payload.Data.Email,
TenantID: tenantID,
Scope: TokenScopeTrustCenterReadOnly,
Scope: trustAuthCfg.Scope,
}
return context.WithValue(ctx, tokenAccessContextKey, tokenAccess)
}
func clearSessionCookie(w http.ResponseWriter, authCfg AuthConfig) {
func clearSessionCookie(w http.ResponseWriter, authCfg console_v1.AuthConfig) {
securecookie.Clear(w, securecookie.DefaultConfig(
authCfg.CookieName,
authCfg.CookieSecret,
))
}
func clearTokenCookie(w http.ResponseWriter, authCfg AuthConfig) {
func clearTokenCookie(w http.ResponseWriter, trustAuthCfg TrustAuthConfig) {
http.SetCookie(w, &http.Cookie{
Name: TokenCookieName,
Name: trustAuthCfg.CookieName,
Value: "",
Domain: authCfg.CookieDomain,
Domain: trustAuthCfg.CookieDomain,
Path: "/",
MaxAge: -1,
Secure: true,

32
pkg/server/api/trust/v1/trust_center_access_handler.go
View File

@@ -39,7 +39,7 @@ type (
}
)
func authTokenHandler(trustSvc *trust.Service, authCfg AuthConfig) http.HandlerFunc {
func authTokenHandler(trustSvc *trust.Service, trustAuthCfg TrustAuthConfig) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
var req AuthTokenRequest
// Limit request body size to 1KB to prevent DoS attacks
@@ -57,7 +57,7 @@ func authTokenHandler(trustSvc *trust.Service, authCfg AuthConfig) http.HandlerF
return
}
accessData, err := validateTrustCenterAccessToken(r.Context(), trustSvc, authCfg, req.Token)
accessData, err := validateTrustCenterAccessToken(r.Context(), trustSvc, trustAuthCfg, req.Token)
if err != nil {
httpserver.RenderJSON(w, http.StatusUnauthorized, AuthTokenResponse{
Success: false,
@@ -67,9 +67,9 @@ func authTokenHandler(trustSvc *trust.Service, authCfg AuthConfig) http.HandlerF
}
tokenString, err := statelesstoken.NewToken(
authCfg.CookieSecret,
probo.TokenTypeTrustCenterAccess,
24*time.Hour,
trustAuthCfg.TokenSecret,
trustAuthCfg.TokenType,
trustAuthCfg.TokenDuration,
*accessData,
)
if err != nil {
@@ -78,11 +78,11 @@ func authTokenHandler(trustSvc *trust.Service, authCfg AuthConfig) http.HandlerF
}
cookie := &http.Cookie{
Name: TokenCookieName,
Name: trustAuthCfg.CookieName,
Value: tokenString,
Domain: authCfg.CookieDomain,
Domain: trustAuthCfg.CookieDomain,
Path: "/",
MaxAge: int(24 * time.Hour / time.Second), // 24 hours
MaxAge: int(trustAuthCfg.CookieDuration / time.Second),
Secure: true,
HttpOnly: true,
SameSite: http.SameSiteStrictMode,
@@ -97,10 +97,10 @@ func authTokenHandler(trustSvc *trust.Service, authCfg AuthConfig) http.HandlerF
}
}
func validateTrustCenterAccessToken(ctx context.Context, trustSvc *trust.Service, authCfg AuthConfig, tokenString string) (*probo.TrustCenterAccessData, error) {
func validateTrustCenterAccessToken(ctx context.Context, trustSvc *trust.Service, trustAuthCfg TrustAuthConfig, tokenString string) (*probo.TrustCenterAccessData, error) {
token, err := statelesstoken.ValidateToken[probo.TrustCenterAccessData](
trustSvc.GetTokenSecret(),
probo.TokenTypeTrustCenterAccess,
trustAuthCfg.TokenType,
tokenString,
)
if err != nil {
@@ -113,13 +113,13 @@ func validateTrustCenterAccessToken(ctx context.Context, trustSvc *trust.Service
return tenantSvc.TrustCenterAccesses.ValidateToken(ctx, tokenString)
}
func trustCenterLogoutHandler(authCfg AuthConfig) http.HandlerFunc {
func trustCenterLogoutHandler(trustAuthCfg TrustAuthConfig) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
// Clear cookie directly
http.SetCookie(w, &http.Cookie{
Name: TokenCookieName,
Name: trustAuthCfg.CookieName,
Value: "",
Domain: authCfg.CookieDomain,
Domain: trustAuthCfg.CookieDomain,
Path: "/",
MaxAge: -1,
Secure: true,
@@ -127,8 +127,8 @@ func trustCenterLogoutHandler(authCfg AuthConfig) http.HandlerFunc {
SameSite: http.SameSiteStrictMode,
})
w.Header().Set("Clear-Site-Data", "*")
httpserver.RenderJSON(w, http.StatusOK, map[string]bool{"success": true})
httpserver.RenderJSON(w, http.StatusOK, map[string]string{
"message": "Logged out successfully",
})
}
}