c93932f026
Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared OAuth2 scope→action registry used by the authorizer, OAuth2 service, and Connect API. Registration stays open until probod calls Freeze(); read paths (RegisteredScopes, Allows, ValidateScopes) panic before that. Drop the leaky APIScopes surface and AllowedAPIScopes on manual access-token creation in favor of registry.ValidateScopes. Metadata, protected-resource metadata, and CIMD scope lists are built from RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose oauth2ScopesSupported as an OAuth2Scope GraphQL scalar. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
56 lines
2.0 KiB
Go
56 lines
2.0 KiB
Go
// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
package connect_v1
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"go.gearno.de/kit/log"
|
|
"go.probo.inc/probo/pkg/baseurl"
|
|
"go.probo.inc/probo/pkg/filemanager"
|
|
"go.probo.inc/probo/pkg/iam"
|
|
"go.probo.inc/probo/pkg/securecookie"
|
|
"go.probo.inc/probo/pkg/server/api/authn"
|
|
"go.probo.inc/probo/pkg/server/api/authz"
|
|
"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
|
|
"go.probo.inc/probo/pkg/server/gqlutils"
|
|
"go.probo.inc/probo/pkg/server/gqlutils/directives/authentication"
|
|
"go.probo.inc/probo/pkg/server/gqlutils/directives/session"
|
|
)
|
|
|
|
func NewGraphQLHandler(svc *iam.Service, logger *log.Logger, fileManagerSvc *filemanager.Service, baseURL *baseurl.BaseURL, cookieConfig securecookie.Config) http.Handler {
|
|
config := schema.Config{
|
|
Resolvers: &Resolver{
|
|
authorize: authz.NewAuthorizeFunc(svc, logger),
|
|
batchAuthorize: authz.NewBatchAuthorizeFunc(svc, logger),
|
|
logger: logger,
|
|
iam: svc,
|
|
scopeRegistry: svc.OAuth2ScopeRegistry,
|
|
fileManager: fileManagerSvc,
|
|
baseURL: baseURL,
|
|
sessionCookie: authn.NewCookie(&cookieConfig),
|
|
},
|
|
Directives: schema.DirectiveRoot{
|
|
Authentication: authentication.Directive,
|
|
SessionOnly: session.Directive,
|
|
},
|
|
}
|
|
|
|
es := schema.NewExecutableSchema(config)
|
|
gqlh := gqlutils.NewHandler(es, logger)
|
|
|
|
return gqlh
|
|
}
|