Files
zeekayandHanzo Dev a17d70a0f5 gateway: the platform header comes from platform authority
THE LIVE ESCALATION, in the path that ships. `X-User-IsAdmin` is the fleet's
PLATFORM-authority header — cloud gates its cross-tenant surfaces on it and the
money gates read the bit-field beside it. This edge minted it from
claims.IsAdmin, which is IAM's ORG-ROLE bit: an org owner carries it inside their
own org. So every org owner reached the fleet as a platform admin.

I reported this fixed earlier. It was not. I patched iamauth.InjectIdentity,
which has ZERO non-test callers — the shipped KrakenD middleware and the ZAP
relay each carried their own inline mint, and both still read the org bit. Two
more statements of the same rule, and the one I fixed was the dead one.

Fixed where they run: the HTTP edge (auth_middleware.go) now applies
edge.Mint, and the relay (gate.go) sets f.IsAdmin — which forward re-emits as
X-User-IsAdmin — from PlatformSudo. X-User-IsOrgAdmin is minted for the first
time, so org-scoped self-service has its own header to read instead of borrowing
platform authority.

ONE DECISION. iamauth is DELETED (834 lines) along with the shim over it. What a
claim means, which org a request acts in, who pays, which headers get minted —
all of it is hanzoai/authz and hanzoai/authz/edge now, and net/http's own header
type satisfies edge.Headers, so applying it here is a loop rather than a second
implementation. What is left is the part genuinely this deployment's: package
token holds the issuer and the AUDIENCE ALLOWLIST (authz.Verify deliberately
does not check `aud`, because IAM sets it to the requesting CLIENT), and
identity.go holds the money bit vocabulary and the vendor-prefix strip.

ONE JWT LIBRARY on the identity path. Verification is golang-jwt/v5, the library
IAM SIGNS with, through authz.Verify + the edge's JWKS reader. go-jose is gone
from it, and the tests now mint with the same library they verify with — a test
signing with a different one is testing a signer the estate does not run. It also
makes `kid` mandatory, matching IAM (signClaims always stamps it).

THREE HEADERS DROPPED, because IAM never emitted the claims behind them: `roles`,
`permissions` and `phone` are absent from the signed claim set and from
claims_supported, so the three-shape parsers for the first two read a claim that
never arrived, and X-Roles / X-Phone-Number were always empty. All three names
STAY in the strip set, so a forged copy still never survives. Removing the
permissions parser also closes a latent grant: a token carrying that claim used
to be handed the bits it named.

The vendor-prefix backstop (X-IAM-*, X-HANZO-*) stays here rather than in the
estate's edge, because sweeping prefixes must ENUMERATE header names — which is
transport-specific, while edge.Headers is deliberately Get/Set/Del. It is folded
into one stripClaimed call with the exact-name strip, because two calls would be
an ordering trap that fails silently.

Falsified both ways: restoring `if cl.IsAdmin` in edge.Mint turns
TestOrgOwnerIsNotAPlatformAdmin and TestAdminOrgMachineGetsNeitherAdminHeader
red; granting the admin bit from the org role turns
TestOrgAdminNeverMintsPlatformAuthority and TestPermissions_OrgAdminGetsNoAdminBit
red. Green on both build tags, including the `legacy` tag production ships.
tests/ stays red on the KrakenD fixture suite — verified identical on a stashed
tree, so it is not from this change.

Co-authored-by: Hanzo Dev <[email protected]>
2026-07-29 21:47:50 -07:00

147 lines
3.6 KiB
Go

package influxdb
import (
"context"
"os"
"time"
"github.com/hanzoai/gateway/v2/internal/lura/config"
"github.com/hanzoai/gateway/v2/internal/lura/logging"
ginmetrics "github.com/hanzoai/gateway/v2/internal/plugin/metrics/gin"
"github.com/influxdata/influxdb/client/v2"
"github.com/hanzoai/gateway/v2/internal/plugin/influx/counter"
"github.com/hanzoai/gateway/v2/internal/plugin/influx/gauge"
"github.com/hanzoai/gateway/v2/internal/plugin/influx/histogram"
)
const Namespace = "github_com/letgoapp/krakend-influx"
const logPrefix = "[SERVICE: InfluxDB]"
type clientWrapper struct {
influxClient client.Client
collector *ginmetrics.Metrics
logger logging.Logger
db string
buf *Buffer
}
func New(ctx context.Context, extraConfig config.ExtraConfig, metricsCollector *ginmetrics.Metrics, logger logging.Logger) error {
cfg, err := configGetter(extraConfig)
if err != nil {
if err != ErrNoConfig {
logger.Error(logPrefix, "Parsing the configuration:", err.Error())
}
return err
}
logger.Debug(logPrefix, "Creating client")
influxdbClient, err := client.NewHTTPClient(client.HTTPConfig{
Addr: cfg.address,
Username: cfg.username,
Password: cfg.password,
Timeout: 10 * time.Second,
})
if err != nil {
logger.Error(logPrefix, "Client crashed:", err)
return err
}
go func() {
pingDuration, pingMsg, err := influxdbClient.Ping(time.Second)
if err != nil {
logger.Warning(logPrefix, "Unable to ping the InfluxDB server:", err.Error())
return
}
logger.Debug(logPrefix, "Ping results: duration =", pingDuration, "msg =", pingMsg)
}()
t := time.NewTicker(cfg.ttl)
cw := clientWrapper{
influxClient: influxdbClient,
collector: metricsCollector,
logger: logger,
db: cfg.database,
buf: NewBuffer(cfg.bufferSize),
}
go cw.keepUpdated(ctx, t.C)
logger.Debug(logPrefix, "Client up and running")
return nil
}
func (cw clientWrapper) keepUpdated(ctx context.Context, ticker <-chan time.Time) {
hostname, err := os.Hostname()
if err != nil {
cw.logger.Error(logPrefix, "Resolving the local hostname:", err.Error())
}
for {
select {
case <-ticker:
case <-ctx.Done():
return
}
cw.logger.Debug(logPrefix, "Preparing data points to send")
snapshot := cw.collector.Snapshot()
if len(snapshot.Counters) == 0 && len(snapshot.Gauges) == 0 {
cw.logger.Debug(logPrefix, "No metrics to send")
continue
}
bp, _ := client.NewBatchPoints(client.BatchPointsConfig{
Database: cw.db,
Precision: "s",
})
now := time.Unix(0, snapshot.Time)
for _, p := range counter.Points(hostname, now, snapshot.Counters, cw.logger) {
bp.AddPoint(p)
}
for _, p := range gauge.Points(hostname, now, snapshot.Gauges, cw.logger) {
bp.AddPoint(p)
}
for _, p := range histogram.Points(hostname, now, snapshot.Histograms, cw.logger) {
bp.AddPoint(p)
}
if err := cw.influxClient.Write(bp); err != nil {
cw.logger.Error(logPrefix, "Couldn't write to server:", err.Error())
cw.buf.Add(bp)
continue
}
cw.logger.Debug(logPrefix, len(bp.Points()), "datapoints sent")
pts := []*client.Point{}
bpPending := cw.buf.Elements()
for _, failedBP := range bpPending {
pts = append(pts, failedBP.Points()...)
}
if len(pts) < 1 {
continue
}
retryBatch, _ := client.NewBatchPoints(client.BatchPointsConfig{
Database: cw.db,
Precision: "s",
})
retryBatch.AddPoints(pts)
if err := cw.influxClient.Write(retryBatch); err != nil {
cw.logger.Error(logPrefix, "Couldn't write to server:", err.Error())
cw.buf.Add(bpPending...)
continue
}
}
}