micro/auth/jwt/jwt.go

197 lines
3.9 KiB
Go
Raw Normal View History

2020-04-29 09:21:17 +01:00
package jwt
import (
2020-04-29 13:21:51 +01:00
"sync"
2020-05-14 13:56:51 +01:00
"time"
2020-04-29 09:21:17 +01:00
"github.com/micro/go-micro/v2/auth"
"github.com/micro/go-micro/v2/auth/token"
jwtToken "github.com/micro/go-micro/v2/auth/token/jwt"
)
// NewAuth returns a new instance of the Auth service
func NewAuth(opts ...auth.Option) auth.Auth {
j := new(jwt)
j.Init(opts...)
return j
}
2020-04-29 13:21:51 +01:00
type rule struct {
role string
resource *auth.Resource
}
2020-04-29 09:21:17 +01:00
type jwt struct {
options auth.Options
jwt token.Provider
2020-04-29 13:21:51 +01:00
rules []*rule
sync.Mutex
2020-04-29 09:21:17 +01:00
}
func (j *jwt) String() string {
return "jwt"
}
func (j *jwt) Init(opts ...auth.Option) {
2020-04-29 13:21:51 +01:00
j.Lock()
defer j.Unlock()
2020-04-29 09:21:17 +01:00
for _, o := range opts {
o(&j.options)
}
2020-04-29 13:21:51 +01:00
if len(j.options.Namespace) == 0 {
j.options.Namespace = auth.DefaultNamespace
}
2020-04-29 09:21:17 +01:00
j.jwt = jwtToken.NewTokenProvider(
2020-04-29 09:38:39 +01:00
token.WithPrivateKey(j.options.PrivateKey),
2020-04-29 09:21:17 +01:00
token.WithPublicKey(j.options.PublicKey),
)
}
func (j *jwt) Options() auth.Options {
2020-04-29 13:21:51 +01:00
j.Lock()
defer j.Unlock()
2020-04-29 09:21:17 +01:00
return j.options
}
func (j *jwt) Generate(id string, opts ...auth.GenerateOption) (*auth.Account, error) {
2020-04-29 13:21:51 +01:00
options := auth.NewGenerateOptions(opts...)
account := &auth.Account{
ID: id,
Type: options.Type,
Roles: options.Roles,
Provider: options.Provider,
Metadata: options.Metadata,
Namespace: options.Namespace,
}
// generate a JWT secret which can be provided to the Token() method
// and exchanged for an access token
secret, err := j.jwt.Generate(account)
if err != nil {
return nil, err
}
account.Secret = secret.Token
// return the account
return account, nil
2020-04-29 09:21:17 +01:00
}
func (j *jwt) Grant(role string, res *auth.Resource) error {
2020-04-29 13:21:51 +01:00
j.Lock()
defer j.Unlock()
j.rules = append(j.rules, &rule{role, res})
return nil
2020-04-29 09:21:17 +01:00
}
func (j *jwt) Revoke(role string, res *auth.Resource) error {
2020-04-29 13:21:51 +01:00
j.Lock()
defer j.Unlock()
rules := make([]*rule, 0, len(j.rules))
var ruleFound bool
for _, r := range rules {
if r.role == role && r.resource == res {
ruleFound = true
} else {
rules = append(rules, r)
}
}
if !ruleFound {
return auth.ErrNotFound
}
j.rules = rules
return nil
2020-04-29 09:21:17 +01:00
}
func (j *jwt) Verify(acc *auth.Account, res *auth.Resource) error {
2020-04-29 13:21:51 +01:00
j.Lock()
if len(res.Namespace) == 0 {
res.Namespace = j.options.Namespace
2020-04-29 09:21:17 +01:00
}
2020-04-29 13:21:51 +01:00
rules := j.rules
j.Unlock()
for _, rule := range rules {
// validate the rule applies to the requested resource
if rule.resource.Namespace != "*" && rule.resource.Namespace != res.Namespace {
continue
}
if rule.resource.Type != "*" && rule.resource.Type != res.Type {
continue
}
if rule.resource.Name != "*" && rule.resource.Name != res.Name {
continue
}
if rule.resource.Endpoint != "*" && rule.resource.Endpoint != res.Endpoint {
continue
}
// a blank role indicates anyone can access the resource, even without an account
if rule.role == "" {
return nil
}
// all furter checks require an account
if acc == nil {
continue
}
// this rule allows any account access, allow the request
if rule.role == "*" {
return nil
}
// if the account has the necessary role, allow the request
for _, r := range acc.Roles {
if r == rule.role {
return nil
}
}
}
// no rules matched, forbid the request
return auth.ErrForbidden
2020-04-29 09:21:17 +01:00
}
func (j *jwt) Inspect(token string) (*auth.Account, error) {
return j.jwt.Inspect(token)
}
func (j *jwt) Token(opts ...auth.TokenOption) (*auth.Token, error) {
options := auth.NewTokenOptions(opts...)
2020-04-29 13:21:51 +01:00
secret := options.RefreshToken
if len(options.Secret) > 0 {
secret = options.Secret
}
account, err := j.jwt.Inspect(secret)
if err != nil {
return nil, err
2020-04-29 09:21:17 +01:00
}
2020-05-14 13:56:51 +01:00
access, err := j.jwt.Generate(account, token.WithExpiry(options.Expiry))
if err != nil {
return nil, err
}
refresh, err := j.jwt.Generate(account, token.WithExpiry(options.Expiry+time.Hour))
2020-04-29 09:21:17 +01:00
if err != nil {
return nil, err
}
return &auth.Token{
2020-05-14 13:56:51 +01:00
Created: access.Created,
Expiry: access.Expiry,
AccessToken: access.Token,
RefreshToken: refresh.Token,
2020-04-29 09:21:17 +01:00
}, nil
}