mc/mcr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Migrate db, auth, and config to mcdsl

Browse Source 
- db.Open: delegate to mcdsl/db.Open
- db.Migrate: rewrite migrations as mcdsl/db.Migration SQL strings,
  delegate to mcdsl/db.Migrate; keep SchemaVersion via mcdsl
- auth: thin shim wrapping mcdsl/auth.Authenticator, keeps Claims
  type (with Subject, AccountType, Roles) for policy engine compat;
  delete cache.go (handled by mcdsl/auth); add ErrForbidden
- config: embed mcdsl/config.Base for standard sections (Server with
  Duration fields, Database, MCIAS, Log); keep StorageConfig and
  WebConfig as MCR-specific; use mcdsl/config.Load[T] + Validator
- WriteTimeout now defaults to 30s (mcdsl default, was 0)
- All existing tests pass (auth tests rewritten for new shim API,
  cache expiry test removed — caching tested in mcdsl)
- Net -464 lines

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kyle Isom
2026-03-25 17:10:46 -07:00
parent 593da3975d
commit 78f3eae651
11 changed files with 179 additions and 643 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
internal/auth/cache.go
View File

@@ -1,65 +0,0 @@
package auth
import (
"sync"
"time"
)
// cacheEntry holds a cached Claims value and its expiration time.
type cacheEntry struct {
claims *Claims
expiresAt time.Time
}
// validationCache provides a concurrency-safe, TTL-based cache for token
// validation results. Tokens are keyed by their SHA-256 hex digest.
type validationCache struct {
mu sync.RWMutex
entries map[string]cacheEntry
ttl time.Duration
now func() time.Time // injectable clock for testing
}
// newCache creates a validationCache with the given TTL.
func newCache(ttl time.Duration) *validationCache {
return &validationCache{
entries: make(map[string]cacheEntry),
ttl: ttl,
now: time.Now,
}
}
// get returns cached claims for the given token hash, or false if the
// entry is missing or expired. Expired entries are lazily evicted.
func (c *validationCache) get(tokenHash string) (*Claims, bool) {
c.mu.RLock()
entry, ok := c.entries[tokenHash]
c.mu.RUnlock()
if !ok {
return nil, false
}
if c.now().After(entry.expiresAt) {
// Lazy evict the expired entry.
c.mu.Lock()
// Re-check under write lock in case another goroutine already evicted.
if e, exists := c.entries[tokenHash]; exists && c.now().After(e.expiresAt) {
delete(c.entries, tokenHash)
}
c.mu.Unlock()
return nil, false
}
return entry.claims, true
}
// put stores claims in the cache with an expiration of now + TTL.
func (c *validationCache) put(tokenHash string, claims *Claims) {
c.mu.Lock()
c.entries[tokenHash] = cacheEntry{
claims: claims,
expiresAt: c.now().Add(c.ttl),
}
c.mu.Unlock()
}

71
internal/auth/cache_test.go
View File

@@ -1,71 +0,0 @@
package auth
import (
"sync"
"testing"
"time"
)
func TestCachePutGet(t *testing.T) {
t.Helper()
c := newCache(30 * time.Second)
claims := &Claims{Subject: "alice", AccountType: "user", Roles: []string{"reader"}}
c.put("abc123", claims)
got, ok := c.get("abc123")
if !ok {
t.Fatal("expected cache hit, got miss")
}
if got.Subject != "alice" {
t.Fatalf("subject: got %q, want %q", got.Subject, "alice")
}
}
func TestCacheTTLExpiry(t *testing.T) {
t.Helper()
now := time.Now()
c := newCache(30 * time.Second)
c.now = func() time.Time { return now }
claims := &Claims{Subject: "bob"}
c.put("def456", claims)
// Still within TTL.
got, ok := c.get("def456")
if !ok {
t.Fatal("expected cache hit before TTL expiry")
}
if got.Subject != "bob" {
t.Fatalf("subject: got %q, want %q", got.Subject, "bob")
}
// Advance clock past TTL.
c.now = func() time.Time { return now.Add(31 * time.Second) }
_, ok = c.get("def456")
if ok {
t.Fatal("expected cache miss after TTL expiry, got hit")
}
}
func TestCacheConcurrent(t *testing.T) {
t.Helper()
c := newCache(30 * time.Second)
var wg sync.WaitGroup
for i := range 100 {
wg.Add(2)
key := string(rune('A' + i%26))
go func() {
defer wg.Done()
c.put(key, &Claims{Subject: key})
}()
go func() {
defer wg.Done()
c.get(key) //nolint:gosec // result intentionally ignored in concurrency test
}()
}
wg.Wait()
// If we get here without a race detector complaint, the test passes.
}

194
internal/auth/client.go
View File

@@ -1,179 +1,63 @@
package auth
import (
"bytes"
"crypto/sha256"
"crypto/tls"
"crypto/x509"
"encoding/hex"
"encoding/json"
"fmt"
"net/http"
"os"
"strings"
"time"
"errors"
"log/slog"
mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
)
const cacheTTL = 30 * time.Second
// Client communicates with an MCIAS server for authentication and token
// validation. It caches successful validation results for 30 seconds.
// validation. It delegates to mcdsl/auth.Authenticator and adapts the
// results to MCR's Claims type (which includes AccountType for the policy
// engine).
type Client struct {
httpClient *http.Client
baseURL string
serviceName string
tags []string
cache *validationCache
auth *mcdslauth.Authenticator
}
// NewClient creates an auth Client that talks to the MCIAS server at
// serverURL. If caCert is non-empty, it is loaded as a PEM file and
// used as the only trusted root CA. TLS 1.3 is required for all HTTPS
// connections.
//
// For plain HTTP URLs (used in tests), TLS configuration is skipped.
// serverURL. If caCert is non-empty, it is used as a custom CA cert.
// TLS 1.3 is required for all HTTPS connections.
func NewClient(serverURL, caCert, serviceName string, tags []string) (*Client, error) {
transport := &http.Transport{}
if !strings.HasPrefix(serverURL, "http://") {
tlsCfg := &tls.Config{
MinVersion: tls.VersionTLS13,
}
if caCert != "" {
pem, err := os.ReadFile(caCert) //nolint:gosec // CA cert path is operator-supplied
if err != nil {
return nil, fmt.Errorf("auth: read CA cert %s: %w", caCert, err)
}
pool := x509.NewCertPool()
if !pool.AppendCertsFromPEM(pem) {
return nil, fmt.Errorf("auth: no valid certificates in %s", caCert)
}
tlsCfg.RootCAs = pool
}
transport.TLSClientConfig = tlsCfg
a, err := mcdslauth.New(mcdslauth.Config{
ServerURL: serverURL,
CACert: caCert,
ServiceName: serviceName,
Tags: tags,
}, slog.Default())
if err != nil {
return nil, err
}
return &Client{
httpClient: &http.Client{
Transport: transport,
Timeout: 10 * time.Second,
},
baseURL: strings.TrimRight(serverURL, "/"),
serviceName: serviceName,
tags: tags,
cache: newCache(cacheTTL),
}, nil
}
// loginRequest is the JSON body sent to MCIAS /v1/auth/login.
type loginRequest struct {
Username string `json:"username"`
Password string `json:"password"`
ServiceName string `json:"service_name"`
Tags []string `json:"tags,omitempty"`
}
// loginResponse is the JSON body returned by MCIAS /v1/auth/login.
type loginResponse struct {
Token string `json:"token"`
ExpiresIn int `json:"expires_in"`
return &Client{auth: a}, nil
}
// Login authenticates a user against MCIAS and returns a bearer token.
func (c *Client) Login(username, password string) (token string, expiresIn int, err error) {
body, err := json.Marshal(loginRequest{ //nolint:gosec // G117: password is intentionally sent to MCIAS for authentication
Username: username,
Password: password,
ServiceName: c.serviceName,
Tags: c.tags,
})
if err != nil {
return "", 0, fmt.Errorf("auth: marshal login request: %w", err)
tok, _, loginErr := c.auth.Login(username, password, "")
if loginErr != nil {
if errors.Is(loginErr, mcdslauth.ErrForbidden) {
return "", 0, ErrForbidden
}
if errors.Is(loginErr, mcdslauth.ErrInvalidCredentials) {
return "", 0, ErrUnauthorized
}
return "", 0, loginErr
}
resp, err := c.httpClient.Post(
c.baseURL+"/v1/auth/login",
"application/json",
bytes.NewReader(body),
)
if err != nil {
return "", 0, fmt.Errorf("auth: MCIAS login: %w", ErrMCIASUnavailable)
}
defer func() { _ = resp.Body.Close() }()
if resp.StatusCode != http.StatusOK {
return "", 0, ErrUnauthorized
}
var lr loginResponse
if err := json.NewDecoder(resp.Body).Decode(&lr); err != nil {
return "", 0, fmt.Errorf("auth: decode login response: %w", err)
}
return lr.Token, lr.ExpiresIn, nil
}
// validateRequest is the JSON body sent to MCIAS /v1/token/validate.
type validateRequest struct {
Token string `json:"token"`
}
// validateResponse is the JSON body returned by MCIAS /v1/token/validate.
type validateResponse struct {
Valid bool `json:"valid"`
Claims struct {
Subject string `json:"subject"`
AccountType string `json:"account_type"`
Roles []string `json:"roles"`
} `json:"claims"`
return tok, 0, nil
}
// ValidateToken checks a bearer token against MCIAS. Results are cached
// by SHA-256 hash for 30 seconds.
// by SHA-256 hash for 30 seconds (handled by mcdsl/auth).
func (c *Client) ValidateToken(token string) (*Claims, error) {
h := sha256.Sum256([]byte(token))
tokenHash := hex.EncodeToString(h[:])
if claims, ok := c.cache.get(tokenHash); ok {
return claims, nil
}
body, err := json.Marshal(validateRequest{Token: token})
info, err := c.auth.ValidateToken(token)
if err != nil {
return nil, fmt.Errorf("auth: marshal validate request: %w", err)
if errors.Is(err, mcdslauth.ErrInvalidToken) {
return nil, ErrUnauthorized
}
return nil, ErrMCIASUnavailable
}
resp, err := c.httpClient.Post(
c.baseURL+"/v1/token/validate",
"application/json",
bytes.NewReader(body),
)
if err != nil {
return nil, fmt.Errorf("auth: MCIAS validate: %w", ErrMCIASUnavailable)
}
defer func() { _ = resp.Body.Close() }()
if resp.StatusCode != http.StatusOK {
return nil, ErrUnauthorized
}
var vr validateResponse
if err := json.NewDecoder(resp.Body).Decode(&vr); err != nil {
return nil, fmt.Errorf("auth: decode validate response: %w", err)
}
if !vr.Valid {
return nil, ErrUnauthorized
}
claims := &Claims{
Subject: vr.Claims.Subject,
AccountType: vr.Claims.AccountType,
Roles: vr.Claims.Roles,
}
c.cache.put(tokenHash, claims)
return claims, nil
return &Claims{
Subject: info.Username,
Roles: info.Roles,
}, nil
}

116
internal/auth/client_test.go
View File

@@ -7,19 +7,17 @@ import (
"net/http/httptest"
"sync/atomic"
"testing"
"time"
)
// newTestServer starts an httptest.Server that routes MCIAS endpoints.
// The handler functions are pluggable per test.
func newTestServer(t *testing.T, loginHandler, validateHandler http.HandlerFunc) *httptest.Server {
t.Helper()
mux := http.NewServeMux()
if loginHandler != nil {
mux.HandleFunc("/v1/auth/login", loginHandler)
mux.HandleFunc("POST /v1/auth/login", loginHandler)
}
if validateHandler != nil {
mux.HandleFunc("/v1/token/validate", validateHandler)
mux.HandleFunc("POST /v1/token/validate", validateHandler)
}
srv := httptest.NewServer(mux)
t.Cleanup(srv.Close)
@@ -36,35 +34,28 @@ func newTestClient(t *testing.T, serverURL string) *Client {
}
func TestLoginSuccess(t *testing.T) {
srv := newTestServer(t, func(w http.ResponseWriter, r *http.Request) {
var req loginRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
http.Error(w, "bad request", http.StatusBadRequest)
return
}
srv := newTestServer(t, func(w http.ResponseWriter, _ *http.Request) {
w.Header().Set("Content-Type", "application/json")
_ = json.NewEncoder(w).Encode(loginResponse{
Token: "tok-abc",
ExpiresIn: 3600,
_ = json.NewEncoder(w).Encode(map[string]interface{}{
"token": "tok-abc",
"expires_at": "2099-01-01T00:00:00Z",
})
}, nil)
c := newTestClient(t, srv.URL)
token, expiresIn, err := c.Login("alice", "secret")
token, _, err := c.Login("alice", "secret")
if err != nil {
t.Fatalf("Login: %v", err)
}
if token != "tok-abc" {
t.Fatalf("token: got %q, want %q", token, "tok-abc")
}
if expiresIn != 3600 {
t.Fatalf("expiresIn: got %d, want %d", expiresIn, 3600)
}
}
func TestLoginFailure(t *testing.T) {
srv := newTestServer(t, func(w http.ResponseWriter, _ *http.Request) {
w.WriteHeader(http.StatusUnauthorized)
_, _ = w.Write([]byte(`{"error":"invalid credentials"}`))
}, nil)
c := newTestClient(t, srv.URL)
@@ -77,17 +68,10 @@ func TestLoginFailure(t *testing.T) {
func TestValidateSuccess(t *testing.T) {
srv := newTestServer(t, nil, func(w http.ResponseWriter, _ *http.Request) {
w.Header().Set("Content-Type", "application/json")
_ = json.NewEncoder(w).Encode(validateResponse{
Valid: true,
Claims: struct {
Subject string `json:"subject"`
AccountType string `json:"account_type"`
Roles []string `json:"roles"`
}{
Subject: "alice",
AccountType: "user",
Roles: []string{"reader", "writer"},
},
_ = json.NewEncoder(w).Encode(map[string]interface{}{
"valid": true,
"username": "alice",
"roles": []string{"reader", "writer"},
})
})
@@ -99,9 +83,6 @@ func TestValidateSuccess(t *testing.T) {
if claims.Subject != "alice" {
t.Fatalf("subject: got %q, want %q", claims.Subject, "alice")
}
if claims.AccountType != "user" {
t.Fatalf("account_type: got %q, want %q", claims.AccountType, "user")
}
if len(claims.Roles) != 2 || claims.Roles[0] != "reader" || claims.Roles[1] != "writer" {
t.Fatalf("roles: got %v, want [reader writer]", claims.Roles)
}
@@ -110,7 +91,7 @@ func TestValidateSuccess(t *testing.T) {
func TestValidateRevoked(t *testing.T) {
srv := newTestServer(t, nil, func(w http.ResponseWriter, _ *http.Request) {
w.Header().Set("Content-Type", "application/json")
_ = json.NewEncoder(w).Encode(validateResponse{Valid: false})
_ = json.NewEncoder(w).Encode(map[string]interface{}{"valid": false})
})
c := newTestClient(t, srv.URL)
@@ -126,17 +107,10 @@ func TestValidateCacheHit(t *testing.T) {
srv := newTestServer(t, nil, func(w http.ResponseWriter, _ *http.Request) {
callCount.Add(1)
w.Header().Set("Content-Type", "application/json")
_ = json.NewEncoder(w).Encode(validateResponse{
Valid: true,
Claims: struct {
Subject string `json:"subject"`
AccountType string `json:"account_type"`
Roles []string `json:"roles"`
}{
Subject: "bob",
AccountType: "service",
Roles: []string{"admin"},
},
_ = json.NewEncoder(w).Encode(map[string]interface{}{
"valid": true,
"username": "bob",
"roles": []string{"admin"},
})
})
@@ -151,7 +125,7 @@ func TestValidateCacheHit(t *testing.T) {
t.Fatalf("expected 1 server call after first validate, got %d", callCount.Load())
}
// Second call — should come from cache.
// Second call — should come from cache (mcdsl/auth handles this).
claims2, err := c.ValidateToken("cached-token")
if err != nil {
t.Fatalf("second ValidateToken: %v", err)
@@ -164,57 +138,3 @@ func TestValidateCacheHit(t *testing.T) {
t.Fatalf("cached claims mismatch: %q vs %q", claims1.Subject, claims2.Subject)
}
}
func TestValidateCacheExpiry(t *testing.T) {
var callCount atomic.Int64
srv := newTestServer(t, nil, func(w http.ResponseWriter, _ *http.Request) {
callCount.Add(1)
w.Header().Set("Content-Type", "application/json")
_ = json.NewEncoder(w).Encode(validateResponse{
Valid: true,
Claims: struct {
Subject string `json:"subject"`
AccountType string `json:"account_type"`
Roles []string `json:"roles"`
}{
Subject: "charlie",
AccountType: "user",
Roles: nil,
},
})
})
c := newTestClient(t, srv.URL)
// Inject a controllable clock.
now := time.Now()
c.cache.now = func() time.Time { return now }
// First call.
if _, err := c.ValidateToken("expiry-token"); err != nil {
t.Fatalf("first ValidateToken: %v", err)
}
if callCount.Load() != 1 {
t.Fatalf("expected 1 server call, got %d", callCount.Load())
}
// Second call within TTL — cache hit.
if _, err := c.ValidateToken("expiry-token"); err != nil {
t.Fatalf("second ValidateToken: %v", err)
}
if callCount.Load() != 1 {
t.Fatalf("expected 1 server call (cache hit), got %d", callCount.Load())
}
// Advance clock past the 30s TTL.
c.cache.now = func() time.Time { return now.Add(31 * time.Second) }
// Third call — cache miss, should hit server again.
if _, err := c.ValidateToken("expiry-token"); err != nil {
t.Fatalf("third ValidateToken: %v", err)
}
if callCount.Load() != 2 {
t.Fatalf("expected 2 server calls after cache expiry, got %d", callCount.Load())
}
}

8
internal/auth/errors.go
View File

@@ -3,6 +3,12 @@ package auth
import "errors"
var (
ErrUnauthorized = errors.New("auth: unauthorized")
// ErrUnauthorized indicates the token is invalid or expired.
ErrUnauthorized = errors.New("auth: unauthorized")
// ErrForbidden indicates login was denied by MCIAS policy.
ErrForbidden = errors.New("auth: forbidden by policy")
// ErrMCIASUnavailable indicates MCIAS could not be reached.
ErrMCIASUnavailable = errors.New("auth: MCIAS unavailable")
)