mirror of
https://github.com/hanzoai/gateway.git
synced 2026-10-30 15:04:44 +00:00
zeekay
387fe26bcc
Extract edge IAM validation — JWKS cache, JWT validation, token extraction (Bearer + HTTP Basic password for go/.netrc + cookie), and the identity-header trust boundary — into package iamauth, the single implementation shared by the gin/KrakenD gateway middleware and the lightweight cmd/ingress host router. The gateway middleware delegates via auth_compat.go; behavior unchanged, security tests intact. cmd/ingress gains optional per-host "auth": true — validates a Hanzo IAM token, strips client identity headers, injects X-User-*, and drops the credential before proxying. Wire goproxy.hanzo.ai (Athens module proxy) as the first IAM-gated host; declare AUTH_* on the hanzo-ingress Deployment. iamauth has unit tests (extraction precedence, strip⊇mint contract, identity injection). go.sum gains the pinned go-jose/v4 v4.0.5 hash (completion, no bump).
36 lines
1.5 KiB
Go
36 lines
1.5 KiB
Go
package gateway
|
|
|
|
import (
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/hanzoai/gateway/iamauth"
|
|
)
|
|
|
|
// These shims keep the gin/KrakenD auth middleware (and its security tests)
|
|
// on the single edge-auth implementation in package iamauth. The middleware
|
|
// keeps its commerce-coupled glue (billing, permission bit-fields, role
|
|
// minting); everything below is delegated so there is exactly one copy of
|
|
// the JWKS cache, JWT validation, token extraction, and the identity-header
|
|
// trust boundary.
|
|
|
|
type jwksCache = iamauth.JWKSCache
|
|
type hanzoJWTClaims = iamauth.Claims
|
|
|
|
func newJWKSCache(url string, ttl time.Duration) *jwksCache { return iamauth.NewJWKSCache(url, ttl) }
|
|
|
|
func validateToken(raw string, cache *jwksCache, issuer, audience string) (*hanzoJWTClaims, error) {
|
|
return iamauth.ValidateToken(raw, cache, issuer, audience)
|
|
}
|
|
|
|
func stripIdentityHeaders(r *http.Request) { iamauth.StripIdentityHeaders(r) }
|
|
func isAPIKey(token string) bool { return iamauth.IsAPIKey(token) }
|
|
func extractBearerToken(r *http.Request) string { return iamauth.BearerToken(r) }
|
|
func extractTokenFromCookie(r *http.Request) string { return iamauth.CookieToken(r) }
|
|
|
|
// gatewayMintedIdentityHeaders is the authoritative list of identity headers
|
|
// the gateway may emit downstream; every entry MUST also be stripped on
|
|
// ingress (iamauth.StripIdentityHeaders). The contract test in
|
|
// auth_middleware_security_test.go enforces strip ⊇ mint.
|
|
var gatewayMintedIdentityHeaders = iamauth.MintedIdentityHeaders
|