mirror of
https://github.com/hanzozt/zt.git
synced 2026-10-30 15:04:55 +00:00
zeekay
241625e7d9
- Repo names: ziti-* → zt-* - Go modules: github.com/hanzozt/ziti → github.com/hanzozt/zt - Docker images: hanzozt/ziti-* → hanzozt/zt-* - C/Java/JS symbols: ziti_* → zt_* - File and directory names updated
106 lines
2.7 KiB
Go
106 lines
2.7 KiB
Go
package routes
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
|
|
"github.com/go-openapi/runtime/middleware"
|
|
"github.com/golang-jwt/jwt/v5"
|
|
"github.com/google/uuid"
|
|
"github.com/michaelquigley/pfxlog"
|
|
enrollment_client "github.com/hanzozt/edge-api/rest_client_api_server/operations/enrollment"
|
|
enrollment_management "github.com/hanzozt/edge-api/rest_management_api_server/operations/enrollment"
|
|
"github.com/hanzozt/edge-api/rest_model"
|
|
"github.com/hanzozt/sdk-golang/zt"
|
|
"github.com/hanzozt/zt/v2/controller/env"
|
|
"github.com/hanzozt/zt/v2/controller/permissions"
|
|
"github.com/hanzozt/zt/v2/controller/response"
|
|
)
|
|
|
|
func init() {
|
|
r := NewNetworkJwtRouter()
|
|
env.AddRouter(r)
|
|
}
|
|
|
|
const (
|
|
EntityNameNetworkJwt = "network-jwts"
|
|
|
|
EnrollmentMethodNetwork = "network"
|
|
|
|
DefaultNetworkJwtName = "default"
|
|
)
|
|
|
|
type NetworkJwtRoute struct {
|
|
BasePath string
|
|
}
|
|
|
|
func NewNetworkJwtRouter() *NetworkJwtRoute {
|
|
return &NetworkJwtRoute{
|
|
BasePath: "/" + EntityNameNetworkJwt,
|
|
}
|
|
}
|
|
|
|
func (r *NetworkJwtRoute) Register(ae *env.AppEnv) {
|
|
|
|
ae.ManagementApi.EnrollmentListNetworkJWTsHandler = enrollment_management.ListNetworkJWTsHandlerFunc(func(params enrollment_management.ListNetworkJWTsParams) middleware.Responder {
|
|
return ae.IsAllowed(r.List, params.HTTPRequest, "", "", permissions.Always())
|
|
})
|
|
|
|
ae.ClientApi.EnrollmentListNetworkJWTsHandler = enrollment_client.ListNetworkJWTsHandlerFunc(func(params enrollment_client.ListNetworkJWTsParams) middleware.Responder {
|
|
return ae.IsAllowed(r.List, params.HTTPRequest, "", "", permissions.Always())
|
|
})
|
|
|
|
}
|
|
|
|
var networkJwt string
|
|
|
|
func (r *NetworkJwtRoute) List(ae *env.AppEnv, rc *response.RequestContext) {
|
|
|
|
if networkJwt == "" {
|
|
issuer := fmt.Sprintf(`https://%s/`, ae.GetConfig().Edge.Api.Address)
|
|
|
|
claims := &zt.EnrollmentClaims{
|
|
EnrollmentMethod: EnrollmentMethodNetwork,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
Audience: jwt.ClaimStrings{env.JwtAudEnrollment},
|
|
Issuer: issuer,
|
|
Subject: issuer,
|
|
ID: uuid.NewString(),
|
|
},
|
|
}
|
|
|
|
signer, err := ae.GetEnrollmentJwtSigner()
|
|
|
|
if err != nil {
|
|
pfxlog.Logger().WithError(err).Error("could not get enrollment signer to generate a network JWT")
|
|
rc.RespondWithError(errors.New("could not determine signer"))
|
|
return
|
|
}
|
|
|
|
jwtStr, genErr := signer.Generate(claims)
|
|
|
|
if genErr != nil {
|
|
networkJwt = ""
|
|
pfxlog.Logger().WithError(genErr).Error("could not sign network JWT")
|
|
rc.RespondWithError(errors.New("could not generate claims"))
|
|
return
|
|
}
|
|
|
|
networkJwt = jwtStr
|
|
}
|
|
|
|
name := DefaultNetworkJwtName
|
|
resp := rest_model.ListNetworkJWTsEnvelope{
|
|
Data: rest_model.NetworkJWTList{
|
|
&rest_model.NetworkJWT{
|
|
Name: &name,
|
|
Token: &networkJwt,
|
|
},
|
|
},
|
|
Meta: &rest_model.Meta{},
|
|
}
|
|
|
|
rc.Respond(resp, http.StatusOK)
|
|
}
|