mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-15 20:38:00 +00:00
4980cd6a0c
* define roles and permissions * support system user memberships * don't limit system users * cleanup permissions * restrict memberships to aggregates * default to SYSTEM_OWNER * update unit tests * test: system user token test (#6778) * update unit tests * refactor: make authz testable * move session constants * cleanup * comment * comment * decode member type string to enum (#6780) * decode member type string to enum * handle all membership types * decode enums where necessary * decode member type in steps config * update system api docs * add technical advisory * tweak docs a bit * comment in comment * lint * extract token from Bearer header prefix * review changes * fix tests * fix: add fix for activityhandler * add isSystemUser * remove IsSystemUser from activity info * fix: add fix for activityhandler --------- Co-authored-by: Stefan Benz <stefan@caos.ch>
80 lines
2.5 KiB
Go
80 lines
2.5 KiB
Go
package middleware
|
|
|
|
import (
|
|
"context"
|
|
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
|
|
"github.com/zitadel/zitadel/internal/api/authz"
|
|
grpc_util "github.com/zitadel/zitadel/internal/api/grpc"
|
|
"github.com/zitadel/zitadel/internal/api/http"
|
|
"github.com/zitadel/zitadel/internal/telemetry/tracing"
|
|
)
|
|
|
|
func AuthorizationInterceptor(verifier authz.APITokenVerifier, authConfig authz.Config) grpc.UnaryServerInterceptor {
|
|
return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
|
|
return authorize(ctx, req, info, handler, verifier, authConfig)
|
|
}
|
|
}
|
|
|
|
func authorize(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler, verifier authz.APITokenVerifier, authConfig authz.Config) (_ interface{}, err error) {
|
|
authOpt, needsToken := verifier.CheckAuthMethod(info.FullMethod)
|
|
if !needsToken {
|
|
return handler(ctx, req)
|
|
}
|
|
|
|
authCtx, span := tracing.NewServerInterceptorSpan(ctx)
|
|
defer func() { span.EndWithError(err) }()
|
|
|
|
authToken := grpc_util.GetAuthorizationHeader(authCtx)
|
|
if authToken == "" {
|
|
return nil, status.Error(codes.Unauthenticated, "auth header missing")
|
|
}
|
|
|
|
orgID, orgDomain := orgIDAndDomainFromRequest(authCtx, req)
|
|
ctxSetter, err := authz.CheckUserAuthorization(authCtx, req, authToken, orgID, orgDomain, verifier, authConfig, authOpt, info.FullMethod)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
span.End()
|
|
return handler(ctxSetter(ctx), req)
|
|
}
|
|
|
|
func orgIDAndDomainFromRequest(ctx context.Context, req interface{}) (id, domain string) {
|
|
orgID := grpc_util.GetHeader(ctx, http.ZitadelOrgID)
|
|
o, ok := req.(OrganizationFromRequest)
|
|
if !ok {
|
|
return orgID, ""
|
|
}
|
|
id = o.OrganizationFromRequest().ID
|
|
domain = o.OrganizationFromRequest().Domain
|
|
if id != "" || domain != "" {
|
|
return id, domain
|
|
}
|
|
// check if the deprecated organisation is used.
|
|
// to be removed before going GA (https://github.com/zitadel/zitadel/issues/6718)
|
|
id = o.OrganisationFromRequest().ID
|
|
domain = o.OrganisationFromRequest().Domain
|
|
if id != "" || domain != "" {
|
|
return id, domain
|
|
}
|
|
return orgID, domain
|
|
}
|
|
|
|
// Deprecated: will be removed in favor of OrganizationFromRequest (https://github.com/zitadel/zitadel/issues/6718)
|
|
type OrganisationFromRequest interface {
|
|
OrganisationFromRequest() *Organization
|
|
}
|
|
|
|
type Organization struct {
|
|
ID string
|
|
Domain string
|
|
}
|
|
|
|
type OrganizationFromRequest interface {
|
|
OrganizationFromRequest() *Organization
|
|
OrganisationFromRequest
|
|
}
|