Kyle Isom
f9635578e0
Replace the CoreDNS precursor with a purpose-built authoritative DNS server. Zones and records (A, AAAA, CNAME) are stored in SQLite and managed via synchronized gRPC + REST APIs authenticated through MCIAS. Non-authoritative queries are forwarded to upstream resolvers with in-memory caching. Key components: - DNS server (miekg/dns) with authoritative zone handling and forwarding - gRPC + REST management APIs with MCIAS auth (mcdsl integration) - SQLite storage with CNAME exclusivity enforcement and auto SOA serials - 30 tests covering database CRUD, DNS resolution, and caching Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
39 lines
1.1 KiB
Go
39 lines
1.1 KiB
Go
package grpcserver
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
|
|
pb "git.wntrmute.dev/kyle/mcns/gen/mcns/v1"
|
|
)
|
|
|
|
type authService struct {
|
|
pb.UnimplementedAuthServiceServer
|
|
auth *mcdslauth.Authenticator
|
|
}
|
|
|
|
func (s *authService) Login(_ context.Context, req *pb.LoginRequest) (*pb.LoginResponse, error) {
|
|
token, _, err := s.auth.Login(req.Username, req.Password, req.TotpCode)
|
|
if err != nil {
|
|
if errors.Is(err, mcdslauth.ErrInvalidCredentials) {
|
|
return nil, status.Error(codes.Unauthenticated, "invalid credentials")
|
|
}
|
|
if errors.Is(err, mcdslauth.ErrForbidden) {
|
|
return nil, status.Error(codes.PermissionDenied, "access denied by login policy")
|
|
}
|
|
return nil, status.Error(codes.Unavailable, "authentication service unavailable")
|
|
}
|
|
return &pb.LoginResponse{Token: token}, nil
|
|
}
|
|
|
|
func (s *authService) Logout(_ context.Context, req *pb.LogoutRequest) (*pb.LogoutResponse, error) {
|
|
if err := s.auth.Logout(req.Token); err != nil {
|
|
return nil, status.Error(codes.Internal, "logout failed")
|
|
}
|
|
return &pb.LogoutResponse{}, nil
|
|
}
|