mirror of
https://github.com/hanzoai/tasks.git
synced 2026-11-03 03:56:04 +00:00
zeekay
5a601d081b
Full module path rebrand from Temporal to Hanzo Tasks: - go.mod module: github.com/hanzoai/tasks - All internal Go imports updated (1906 files) - cmd/server renamed to cmd/tasksd - Binary name: tasksd (was temporal-server) - Docker images: hanzoai/tasks (was temporalio/server) - README rewritten with Hanzo Tasks branding - LLM.md created with integration notes - Makefile, goreleaser, CI workflows updated - go.temporal.io/sdk and go.temporal.io/api imports preserved (separate repos) Fork of Temporal.io (MIT license).
71 lines
2.0 KiB
Go
71 lines
2.0 KiB
Go
//go:generate mockgen -package $GOPACKAGE -source $GOFILE -destination claim_mapper_mock.go
|
|
|
|
package authorization
|
|
|
|
import (
|
|
"crypto/x509/pkix"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/hanzoai/tasks/common/config"
|
|
"github.com/hanzoai/tasks/common/log"
|
|
"google.golang.org/grpc/credentials"
|
|
)
|
|
|
|
// @@@SNIPSTART temporal-common-authorization-authinfo
|
|
// Authentication information from subject's JWT token or/and mTLS certificate
|
|
type AuthInfo struct {
|
|
AuthToken string
|
|
TLSSubject *pkix.Name
|
|
TLSConnection *credentials.TLSInfo
|
|
ExtraData string
|
|
Audience string
|
|
}
|
|
|
|
// @@@SNIPEND
|
|
|
|
// @@@SNIPSTART temporal-common-authorization-claimmapper-interface
|
|
// ClaimMapper converts authorization info of a subject into Temporal claims (permissions) for authorization
|
|
type ClaimMapper interface {
|
|
GetClaims(authInfo *AuthInfo) (*Claims, error)
|
|
}
|
|
|
|
// @@@SNIPEND
|
|
|
|
// Normally, GetClaims will never be called without either an auth token or TLS metadata set in
|
|
// AuthInfo. However, if you want your ClaimMapper to be called in all cases, you can implement
|
|
// this additional interface and return false.
|
|
type ClaimMapperWithAuthInfoRequired interface {
|
|
AuthInfoRequired() bool
|
|
}
|
|
|
|
// No-op claim mapper that gives system level admin permission to everybody
|
|
type noopClaimMapper struct{}
|
|
|
|
var _ ClaimMapper = (*noopClaimMapper)(nil)
|
|
var _ ClaimMapperWithAuthInfoRequired = (*noopClaimMapper)(nil)
|
|
|
|
func NewNoopClaimMapper() ClaimMapper {
|
|
return &noopClaimMapper{}
|
|
}
|
|
|
|
func (*noopClaimMapper) GetClaims(_ *AuthInfo) (*Claims, error) {
|
|
return &Claims{System: RoleAdmin}, nil
|
|
}
|
|
|
|
// This implementation can run even without auth info.
|
|
func (*noopClaimMapper) AuthInfoRequired() bool {
|
|
return false
|
|
}
|
|
|
|
func GetClaimMapperFromConfig(config *config.Authorization, logger log.Logger) (ClaimMapper, error) {
|
|
|
|
switch strings.ToLower(config.ClaimMapper) {
|
|
case "":
|
|
return NewNoopClaimMapper(), nil
|
|
case "default":
|
|
return NewDefaultJWTClaimMapper(NewDefaultTokenKeyProvider(config, logger), config, logger), nil
|
|
}
|
|
return nil, fmt.Errorf("unknown claim mapper: %s", config.ClaimMapper)
|
|
}
|