package service import ( "context" "strings" "sync" "time" "github.com/micro/go-micro/v2/auth" "github.com/micro/go-micro/v2/auth/rules" pb "github.com/micro/go-micro/v2/auth/service/proto" "github.com/micro/go-micro/v2/auth/token" "github.com/micro/go-micro/v2/auth/token/jwt" "github.com/micro/go-micro/v2/client" log "github.com/micro/go-micro/v2/logger" "github.com/micro/go-micro/v2/metadata" "github.com/micro/go-micro/v2/util/jitter" ) // svc is the service implementation of the Auth interface type svc struct { options auth.Options auth pb.AuthService rule pb.RulesService jwt token.Provider rules map[string][]*auth.Rule sync.Mutex } func (s *svc) String() string { return "service" } func (s *svc) Init(opts ...auth.Option) { for _, o := range opts { o(&s.options) } if s.options.Client == nil { s.options.Client = client.DefaultClient } s.auth = pb.NewAuthService("go.micro.auth", s.options.Client) s.rule = pb.NewRulesService("go.micro.auth", s.options.Client) // if we have a JWT public key passed as an option, // we can decode tokens with the type "JWT" locally // and not have to make an RPC call if key := s.options.PublicKey; len(key) > 0 { s.jwt = jwt.NewTokenProvider(token.WithPublicKey(key)) } } func (s *svc) Options() auth.Options { s.Lock() defer s.Unlock() return s.options } // Generate a new account func (s *svc) Generate(id string, opts ...auth.GenerateOption) (*auth.Account, error) { options := auth.NewGenerateOptions(opts...) rsp, err := s.auth.Generate(context.TODO(), &pb.GenerateRequest{ Id: id, Type: options.Type, Secret: options.Secret, Scopes: options.Scopes, Metadata: options.Metadata, Provider: options.Provider, }) if err != nil { return nil, err } return serializeAccount(rsp.Account), nil } // Grant access to a resource func (s *svc) Grant(rule *auth.Rule) error { access := pb.Access_UNKNOWN if rule.Access == auth.AccessGranted { access = pb.Access_GRANTED } else if rule.Access == auth.AccessDenied { access = pb.Access_DENIED } _, err := s.rule.Create(context.TODO(), &pb.CreateRequest{ Rule: &pb.Rule{ Id: rule.ID, Scope: rule.Scope, Priority: rule.Priority, Access: access, Resource: &pb.Resource{ Type: rule.Resource.Type, Name: rule.Resource.Name, Endpoint: rule.Resource.Endpoint, }, }, }) go s.loadRules(s.options.Namespace) return err } // Revoke access to a resource func (s *svc) Revoke(rule *auth.Rule) error { _, err := s.rule.Delete(context.TODO(), &pb.DeleteRequest{ Id: rule.ID, }) go s.loadRules(s.options.Namespace) return err } func (s *svc) Rules() ([]*auth.Rule, error) { return s.rules[s.options.Namespace], nil } // Verify an account has access to a resource func (s *svc) Verify(acc *auth.Account, res *auth.Resource, opts ...auth.VerifyOption) error { var options auth.VerifyOptions for _, o := range opts { o(&options) } if len(options.Namespace) == 0 { options.Namespace = s.options.Namespace } // load the rules if none are loaded s.loadRulesIfEmpty(options.Namespace) // verify the request using the rules return rules.Verify(s.rules[options.Namespace], acc, res) } // Inspect a token func (s *svc) Inspect(token string) (*auth.Account, error) { // try to decode JWT locally and fall back to srv if an error occurs if len(strings.Split(token, ".")) == 3 && s.jwt != nil { return s.jwt.Inspect(token) } // the token is not a JWT or we do not have the keys to decode it, // fall back to the auth service rsp, err := s.auth.Inspect(context.TODO(), &pb.InspectRequest{Token: token}) if err != nil { return nil, err } return serializeAccount(rsp.Account), nil } // Token generation using an account ID and secret func (s *svc) Token(opts ...auth.TokenOption) (*auth.Token, error) { options := auth.NewTokenOptions(opts...) rsp, err := s.auth.Token(context.Background(), &pb.TokenRequest{ Id: options.ID, Secret: options.Secret, RefreshToken: options.RefreshToken, TokenExpiry: int64(options.Expiry.Seconds()), }) if err != nil { return nil, err } return serializeToken(rsp.Token), nil } // loadRules retrieves the rules from the auth service. Since this implementation is used by micro // clients, which support muti-tenancy we may have to persist rules in multiple namespaces. func (s *svc) loadRules(namespace string) { ctx := metadata.Set(context.TODO(), "Micro-Namespace", namespace) rsp, err := s.rule.List(ctx, &pb.ListRequest{}) if err != nil { log.Errorf("Error listing rules: %v", err) return } rules := make([]*auth.Rule, 0, len(rsp.Rules)) for _, r := range rsp.Rules { var access auth.Access if r.Access == pb.Access_GRANTED { access = auth.AccessGranted } else { access = auth.AccessDenied } rules = append(rules, &auth.Rule{ ID: r.Id, Scope: r.Scope, Access: access, Priority: r.Priority, Resource: &auth.Resource{ Type: r.Resource.Type, Name: r.Resource.Name, Endpoint: r.Resource.Endpoint, }, }) } s.Lock() s.rules[namespace] = rules s.Unlock() } func (s *svc) loadRulesIfEmpty(namespace string) { s.Lock() rules := s.rules s.Unlock() if _, ok := rules[namespace]; !ok { s.loadRules(namespace) } } func serializeToken(t *pb.Token) *auth.Token { return &auth.Token{ AccessToken: t.AccessToken, RefreshToken: t.RefreshToken, Created: time.Unix(t.Created, 0), Expiry: time.Unix(t.Expiry, 0), } } func serializeAccount(a *pb.Account) *auth.Account { return &auth.Account{ ID: a.Id, Secret: a.Secret, Issuer: a.Issuer, Metadata: a.Metadata, Scopes: a.Scopes, } } // NewAuth returns a new instance of the Auth service func NewAuth(opts ...auth.Option) auth.Auth { options := auth.NewOptions(opts...) if options.Client == nil { options.Client = client.DefaultClient } service := &svc{ auth: pb.NewAuthService("go.micro.auth", options.Client), rule: pb.NewRulesService("go.micro.auth", options.Client), rules: make(map[string][]*auth.Rule), options: options, } // load rules periodically from the auth service go func() { ruleTimer := time.NewTicker(time.Second * 30) for { <-ruleTimer.C time.Sleep(jitter.Do(time.Second * 5)) for ns := range service.rules { service.loadRules(ns) } } }() return service }