mc/metacrypt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Checkpoint: auth, engine, seal, server, grpc updates

Browse Source 
Co-authored-by: Junie <junie@jetbrains.com>
This commit is contained in:
Kyle Isom
2026-03-15 09:54:04 -07:00
parent 33beb33a13
commit 44e5e6e174
21 changed files with 185 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
internal/server/middleware.go
View File

@@ -42,9 +42,11 @@ func (s *Server) requireUnseal(next http.HandlerFunc) http.HandlerFunc {
state := s.seal.State()
switch state {
case seal.StateUninitialized:
s.logger.Debug("request rejected: service uninitialized", "path", r.URL.Path)
http.Error(w, `{"error":"not initialized"}`, http.StatusPreconditionFailed)
return
case seal.StateSealed, seal.StateInitializing:
s.logger.Debug("request rejected: service sealed", "path", r.URL.Path)
http.Error(w, `{"error":"sealed"}`, http.StatusServiceUnavailable)
return
}
@@ -57,16 +59,19 @@ func (s *Server) requireAuth(next http.HandlerFunc) http.HandlerFunc {
return s.requireUnseal(func(w http.ResponseWriter, r *http.Request) {
token := extractToken(r)
if token == "" {
s.logger.Debug("request rejected: missing token", "path", r.URL.Path)
http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
return
}
info, err := s.auth.ValidateToken(token)
if err != nil {
s.logger.Debug("request rejected: invalid token", "path", r.URL.Path, "error", err)
http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
return
}
s.logger.Debug("request authenticated", "path", r.URL.Path, "username", info.Username)
ctx := context.WithValue(r.Context(), tokenInfoKey, info)
next(w, r.WithContext(ctx))
})
@@ -77,9 +82,11 @@ func (s *Server) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
return s.requireAuth(func(w http.ResponseWriter, r *http.Request) {
info := TokenInfoFromContext(r.Context())
if info == nil || !info.IsAdmin {
s.logger.Debug("request rejected: admin required", "path", r.URL.Path)
http.Error(w, `{"error":"forbidden"}`, http.StatusForbidden)
return
}
s.logger.Debug("admin request authorized", "path", r.URL.Path, "username", info.Username)
next(w, r)
})
}

6
internal/server/server_test.go
View File

@@ -36,14 +36,14 @@ func setupTestServer(t *testing.T) (*Server, *seal.Manager, chi.Router) {
db.Migrate(database)
b := barrier.NewAESGCMBarrier(database)
sealMgr := seal.NewManager(database, b)
sealMgr := seal.NewManager(database, b, slog.Default())
sealMgr.CheckInitialized()
// Auth requires MCIAS client which we can't create in tests easily,
// so we pass nil and avoid auth-dependent routes in these tests.
authenticator := auth.NewAuthenticator(nil)
authenticator := auth.NewAuthenticator(nil, slog.Default())
policyEngine := policy.NewEngine(b)
engineRegistry := engine.NewRegistry(b)
engineRegistry := engine.NewRegistry(b, slog.Default())
cfg := &config.Config{
Server: config.ServerConfig{