mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
## What changed? Adds JWT to server-to-server connections. Frontend already had support for reading auth so this focuses on getting a token and injecting it. ## Why? s2s is currently a gap in the auth abilities. This provides more flexibility for users based on their auth requirements. ## How did you test it? - [x] built - [x] run locally and tested manually - [x] covered by existing tests - [x] added new unit test(s) - [x] added new functional test(s) ## Potential risks Need to get auth right. Main risk is a user believing they are secure when they are not.
138 lines
3.9 KiB
Go
138 lines
3.9 KiB
Go
package temporal
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"slices"
|
|
|
|
"go.temporal.io/server/client"
|
|
"go.temporal.io/server/common/archiver/provider"
|
|
"go.temporal.io/server/common/authorization"
|
|
"go.temporal.io/server/common/config"
|
|
"go.temporal.io/server/common/dynamicconfig"
|
|
"go.temporal.io/server/common/log"
|
|
"go.temporal.io/server/common/membership/static"
|
|
"go.temporal.io/server/common/metrics"
|
|
persistenceClient "go.temporal.io/server/common/persistence/client"
|
|
"go.temporal.io/server/common/persistence/visibility"
|
|
"go.temporal.io/server/common/primitives"
|
|
"go.temporal.io/server/common/resolver"
|
|
"go.temporal.io/server/common/rpc/auth"
|
|
"go.temporal.io/server/common/rpc/encryption"
|
|
"go.temporal.io/server/common/searchattribute"
|
|
"google.golang.org/grpc"
|
|
)
|
|
|
|
type (
|
|
synchronizationModeParams struct {
|
|
blockingStart bool
|
|
interruptCh <-chan any
|
|
}
|
|
|
|
serverOptions struct {
|
|
serviceNames map[primitives.ServiceName]struct{}
|
|
|
|
config *config.Config
|
|
configDir string
|
|
env string
|
|
zone string
|
|
configFilePath string
|
|
hostsByService map[primitives.ServiceName]static.Hosts
|
|
|
|
startupSynchronizationMode synchronizationModeParams
|
|
|
|
logger log.Logger
|
|
namespaceLogger log.Logger
|
|
authorizer authorization.Authorizer
|
|
tlsConfigProvider encryption.TLSConfigProvider
|
|
claimMapper authorization.ClaimMapper
|
|
audienceGetter authorization.JWTAudienceMapper
|
|
persistenceServiceResolver resolver.ServiceResolver
|
|
elasticsearchHttpClient *http.Client //nolint:staticcheck // should be elasticsearchHTTPClient
|
|
dynamicConfigClient dynamicconfig.Client
|
|
customDataStoreFactory persistenceClient.AbstractDataStoreFactory
|
|
customVisibilityStoreFactory visibility.VisibilityStoreFactory
|
|
customHistoryArchiverFactory provider.CustomHistoryArchiverFactory
|
|
customVisibilityArchiverFactory provider.CustomVisibilityArchiverFactory
|
|
clientFactoryProvider client.FactoryProvider
|
|
searchAttributesMapper searchattribute.Mapper
|
|
customFrontendInterceptors []grpc.UnaryServerInterceptor
|
|
metricHandler metrics.Handler
|
|
tokenProvider auth.TokenProvider
|
|
}
|
|
)
|
|
|
|
func newServerOptions(opts []ServerOption) *serverOptions {
|
|
so := &serverOptions{
|
|
// Set defaults here.
|
|
persistenceServiceResolver: resolver.NewNoopResolver(),
|
|
}
|
|
for _, opt := range opts {
|
|
opt.apply(so)
|
|
}
|
|
|
|
return so
|
|
}
|
|
|
|
func (so *serverOptions) loadAndValidate() error {
|
|
for serviceName := range so.serviceNames {
|
|
if !slices.Contains(Services, string(serviceName)) {
|
|
return fmt.Errorf("invalid service %q in service list %v", serviceName, so.serviceNames)
|
|
}
|
|
}
|
|
|
|
if so.config == nil {
|
|
err := so.loadConfig()
|
|
if err != nil {
|
|
return fmt.Errorf("unable to load config: %w", err)
|
|
}
|
|
}
|
|
|
|
err := so.validateConfig()
|
|
if err != nil {
|
|
return fmt.Errorf("config validation error: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (so *serverOptions) loadConfig() error {
|
|
if so.configFilePath != "" {
|
|
if so.env != "" || so.configDir != "" || so.zone != "" {
|
|
return errors.New("env, config, zone can not be set if configFilePath is set")
|
|
}
|
|
cfg, err := config.Load(
|
|
config.WithConfigFile(so.configFilePath),
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("could not load config file: %w", err)
|
|
}
|
|
so.config = cfg
|
|
return nil
|
|
}
|
|
cfg, err := config.Load(
|
|
config.WithEnv(so.env),
|
|
config.WithConfigDir(so.configDir),
|
|
config.WithZone(so.zone),
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("could not load config file: %w", err)
|
|
}
|
|
so.config = cfg
|
|
return nil
|
|
}
|
|
|
|
func (so *serverOptions) validateConfig() error {
|
|
if err := so.config.Validate(); err != nil {
|
|
return err
|
|
}
|
|
|
|
for name := range so.serviceNames {
|
|
if _, ok := so.config.Services[string(name)]; !ok {
|
|
return fmt.Errorf("%q service is missing in config", name)
|
|
}
|
|
}
|
|
return nil
|
|
}
|