mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
zeekay
40351cce6f
Goes from 135 MB binary with 1153 files importing go.temporal.io and 224
importing google.golang.org/grpc to a 10 MB native binary with ZERO of
either.
Deleted:
- tasks/, tasktests/, service/, chasm/, client/, api/, proto/, tools/
- cmd/tools/, components/, docker/
- schema/{cassandra,elasticsearch,mysql,postgresql,sqlite}/
- 40 tainted common/ subdirs + 7 top-level common files
- tests/testutils (no longer referenced after surviving deps drop common)
New cmd/tasksd (~100 lines) boots tasks.Embed (zap.Node) + http.Server.
New pkg/tasks/embed.go registers ZAP handlers for the SDK opcode surface
(0x0060-0x00A5). Workflow handlers return a 501 "not yet implemented"
envelope; native engine lands behind this contract.
Build: go build ./cmd/tasksd → 10 MB
Vet: go vet ./... → clean
Boot: tasksd --zap-port 9999 --http :7243
Probes: /healthz, /v1/tasks/health → 200
UI: /_/tasks/, / → 200 (embedded Vite bundle)
ZAP: _tasks._tcp on :9999 (mDNS disabled; direct connect)
go.mod: tidy. No go.temporal.io. No google.golang.org/grpc.
78 lines
2.2 KiB
Go
78 lines
2.2 KiB
Go
package authorization
|
|
|
|
import (
|
|
"context"
|
|
|
|
commonpb "go.temporal.io/api/common/v1"
|
|
"go.temporal.io/server/common/api"
|
|
)
|
|
|
|
type (
|
|
defaultAuthorizer struct {
|
|
}
|
|
)
|
|
|
|
var _ Authorizer = (*defaultAuthorizer)(nil)
|
|
|
|
// NewDefaultAuthorizer creates a default authorizer
|
|
func NewDefaultAuthorizer() Authorizer {
|
|
return &defaultAuthorizer{}
|
|
}
|
|
|
|
var resultAllow = Result{Decision: DecisionAllow}
|
|
var resultDeny = Result{Decision: DecisionDeny}
|
|
|
|
// Authorize determines if an API call by given claims should be allowed or denied.
|
|
// Rules:
|
|
//
|
|
// Health check APIs are allowed to everyone.
|
|
// System Admin is allowed to access all APIs on all namespaces and cluster-level.
|
|
// System Writer is allowed to access non admin APIs on all namespaces and cluster-level.
|
|
// System Reader is allowed to access readonly APIs on all namespaces and cluster-level.
|
|
// Namespace Admin is allowed to access all APIs on their namespaces.
|
|
// Namespace Writer is allowed to access non admin APIs on their namespaces.
|
|
// Namespace Reader is allowed to access non admin readonly APIs on their namespaces.
|
|
func (a *defaultAuthorizer) Authorize(_ context.Context, claims *Claims, target *CallTarget) (Result, error) {
|
|
// APIs that are essentially read-only health checks with no sensitive information are
|
|
// always allowed
|
|
if IsHealthCheckAPI(target.APIName) {
|
|
return resultAllow, nil
|
|
}
|
|
if claims == nil {
|
|
return resultDeny, nil
|
|
}
|
|
|
|
metadata := api.GetMethodMetadata(target.APIName)
|
|
|
|
var hasRole Role
|
|
switch metadata.Scope {
|
|
case api.ScopeCluster:
|
|
hasRole = claims.System
|
|
case api.ScopeNamespace:
|
|
// Note: system-level claims apply across all namespaces.
|
|
// Note: if claims.Namespace is nil or target.Namespace is not found, the lookup will return zero.
|
|
hasRole = claims.System | claims.Namespaces[target.Namespace]
|
|
default:
|
|
return resultDeny, nil
|
|
}
|
|
|
|
if hasRole >= getRequiredRole(metadata.Access) {
|
|
result := Result{Decision: DecisionAllow}
|
|
result.Principal = &commonpb.Principal{Type: claims.AuthType, Name: claims.Subject}
|
|
return result, nil
|
|
}
|
|
return resultDeny, nil
|
|
}
|
|
|
|
// Convert from api.Access to Role
|
|
func getRequiredRole(access api.Access) Role {
|
|
switch access {
|
|
case api.AccessReadOnly:
|
|
return RoleReader
|
|
case api.AccessWrite:
|
|
return RoleWriter
|
|
default:
|
|
return RoleAdmin
|
|
}
|
|
}
|