mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
Alex ShtinandGitHub
8e8f1b0f7c
## What changed?
<!-- Describe what has changed in this PR -->
Remove license header from every file. Because it is really hard to
follow in this PR here is the summary:
1. License header is removed from all `.go` and `.proto` files
:fireworks::fireworks:🎆.
2. `LICENSE` file in the root directory has only Temporal and Uber
copyrights.
3. 5 other `LICENSE` files added to the packages which have copyrights
different from Temporal and Uber: Datadog, Xargin, "Mat Ryer, Tyler
Bunnell and contributors".
4. `license_file` flag is removed from all code generation tools.
5. `copyright_file` flag is removed from `go:generate mockgen`
directive.
6. All copyright related targets are removed from `Makefile`.
7. Updated Temporal copyright year to 2025 everywhere.
## Why?
<!-- Tell your future self why have you made these changes -->
I double checked with legal department that it is not needed to have
license header in every file. One file per repo is enough. I put all
copyrights to the root `LICENSE` file and removed header from all other
files. Also updated tools and `Makefile`.
71 lines
2.0 KiB
Go
71 lines
2.0 KiB
Go
//go:generate mockgen -package $GOPACKAGE -source $GOFILE -destination claim_mapper_mock.go
|
|
|
|
package authorization
|
|
|
|
import (
|
|
"crypto/x509/pkix"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"go.temporal.io/server/common/config"
|
|
"go.temporal.io/server/common/log"
|
|
"google.golang.org/grpc/credentials"
|
|
)
|
|
|
|
// @@@SNIPSTART temporal-common-authorization-authinfo
|
|
// Authentication information from subject's JWT token or/and mTLS certificate
|
|
type AuthInfo struct {
|
|
AuthToken string
|
|
TLSSubject *pkix.Name
|
|
TLSConnection *credentials.TLSInfo
|
|
ExtraData string
|
|
Audience string
|
|
}
|
|
|
|
// @@@SNIPEND
|
|
|
|
// @@@SNIPSTART temporal-common-authorization-claimmapper-interface
|
|
// ClaimMapper converts authorization info of a subject into Temporal claims (permissions) for authorization
|
|
type ClaimMapper interface {
|
|
GetClaims(authInfo *AuthInfo) (*Claims, error)
|
|
}
|
|
|
|
// @@@SNIPEND
|
|
|
|
// Normally, GetClaims will never be called without either an auth token or TLS metadata set in
|
|
// AuthInfo. However, if you want your ClaimMapper to be called in all cases, you can implement
|
|
// this additional interface and return false.
|
|
type ClaimMapperWithAuthInfoRequired interface {
|
|
AuthInfoRequired() bool
|
|
}
|
|
|
|
// No-op claim mapper that gives system level admin permission to everybody
|
|
type noopClaimMapper struct{}
|
|
|
|
var _ ClaimMapper = (*noopClaimMapper)(nil)
|
|
var _ ClaimMapperWithAuthInfoRequired = (*noopClaimMapper)(nil)
|
|
|
|
func NewNoopClaimMapper() ClaimMapper {
|
|
return &noopClaimMapper{}
|
|
}
|
|
|
|
func (*noopClaimMapper) GetClaims(_ *AuthInfo) (*Claims, error) {
|
|
return &Claims{System: RoleAdmin}, nil
|
|
}
|
|
|
|
// This implementation can run even without auth info.
|
|
func (*noopClaimMapper) AuthInfoRequired() bool {
|
|
return false
|
|
}
|
|
|
|
func GetClaimMapperFromConfig(config *config.Authorization, logger log.Logger) (ClaimMapper, error) {
|
|
|
|
switch strings.ToLower(config.ClaimMapper) {
|
|
case "":
|
|
return NewNoopClaimMapper(), nil
|
|
case "default":
|
|
return NewDefaultJWTClaimMapper(NewDefaultTokenKeyProvider(config, logger), config, logger), nil
|
|
}
|
|
return nil, fmt.Errorf("unknown claim mapper: %s", config.ClaimMapper)
|
|
}
|