Skip to content

Commit bbbb66e

Browse files
jphorecjphorec
authored
Merge pull request #14 from benarena/benarena/update-rbac-model
update rbac model
2 parents 642cbc4 + b60db92 commit bbbb66e

File tree

6 files changed

+73
-100
lines changed

6 files changed

+73
-100
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# kong-wallet-jwt
22

3-
Adds an extra layer of security and functions as a role authority. This plugin takes in an `Authorization` header with a user signed JWT token. With a verified JWT this plugin can also function as a role authority and provide `x-roles` that belong to the associated account that signed the JWT.
3+
Adds an extra layer of security and functions as a role authority. This plugin takes in an `Authorization` header with a user signed JWT token. With a verified JWT this plugin can also function as a role authority and provide `x-wallet-access` that belong to the associated account that signed the JWT.
44

55
## Getting started
66

‎cmd/jwt-wallet/main_test.go‎

Lines changed: 17 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ func TestValidJwt(t *testing.T) {
133133
token := jwt.NewWithClaims(signing.NewSecp256k1Signer(), claims)
134134
sig, _ := token.SignedString(prvk)
135135

136-
r := ioutil.NopCloser(bytes.NewReader([]byte(grantsJSONString)))
136+
r := ioutil.NopCloser(bytes.NewReader([]byte(subjectJSONString)))
137137
GetDoFunc = func(*http.Request) (*http.Response, error) {
138138
return &http.Response{
139139
StatusCode: 200,
@@ -151,8 +151,8 @@ func TestValidJwt(t *testing.T) {
151151
env.DoHttp(config)
152152

153153
assert.Equal(t, 200, env.ClientRes.Status)
154-
assert.NotEmpty(t, env.ServiceReq.Headers.Get("x-roles"))
155-
assert.Equal(t, xRoles, env.ServiceReq.Headers.Get("x-roles"))
154+
assert.NotEmpty(t, env.ServiceReq.Headers.Get("x-wallet-access"))
155+
assert.Equal(t, xRoles, env.ServiceReq.Headers.Get("x-wallet-accessz"))
156156
}
157157

158158
func GenerateClaims(addr string, pubKey *secp256k1.PublicKey) *signing.Claims {
@@ -172,27 +172,25 @@ func GenerateClaims(addr string, pubKey *secp256k1.PublicKey) *signing.Claims {
172172
}
173173
}
174174

175-
var grantsJSONString = `
175+
var subjectJSONString = `
176176
{
177-
"account": {
178-
"address": "1337-wallet",
179-
"name": "jwt-wallet",
180-
"type": "ORGANIZATION"
181-
},
177+
"address": "1337-wallet",
178+
"name": "jwt-wallet",
182179
"grants": [
183180
{
184-
"org": {
185-
"address": "1337-wallet",
186-
"name": "jwt-wallet",
187-
"type": "ORGANIZATION"
188-
},
189-
"roles": [
190-
"1337_role"
191-
],
181+
"address": "1337-wallet",
182+
"name": "jwt-wallet",
192183
"authzGrants": [],
193-
"apps": []
184+
"applications": [
185+
{
186+
"name": "myapp",
187+
"permissions": [
188+
"1337_role"
189+
]
190+
}
191+
]
194192
}
195193
]
196194
}`
197195

198-
var xRoles = `{"orgs":[{"name":"jwt-wallet","roles":["1337_role"],"authzGrants":[]}]}`
196+
var xRoles = `[{"address":"1337-wallet","name":"jwt-wallet","authzGrants":[],"applications":[{"name":"myapp","permissions":["1337_role"]}]}]`

‎config.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ services:
88
plugins:
99
- name: jwt-wallet
1010
config:
11-
# rbac: http://localhost:8888/api/v1/rbac/account/{addr}/grants # Running RBAC Service
12-
# rbac: http://docker.for.mac.host.internal:8888/{addr}/index.html # Use when running `make http` on Mac
13-
rbac: http://localhost:8888/{addr}/index.html # Use when running `make http` on Linux
11+
# rbac: http://docker.for.mac.host.internal:8069/rbac/api/v1/subjects/{addr}/grants # Running RBAC Service on Mac
12+
rbac: http://localhost:8069/rbac/api/v1/subjects/{addr}/grants # Running RBAC Service on Linux
13+
# rbac: http://docker.for.mac.host.internal:8888/{addr}/index.html # Use when running `make http` on Mac
14+
# rbac: http://localhost:8888/{addr}/index.html # Use when running `make http` on Linux

‎grants/grants.go‎

Lines changed: 20 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -8,32 +8,20 @@ import (
88
"strings"
99
)
1010

11-
type RoleResponse struct {
12-
Account struct {
13-
Address string `json:"address"`
14-
Name string `json:"name"`
15-
Type string `json:"type"`
16-
} `json:"account"`
17-
Grants []struct {
18-
Org struct {
19-
Address string `json:"address"`
20-
Name string `json:"name"`
21-
Type string `json:"type"`
22-
} `json:"org"`
23-
Roles []string `json:"roles"`
24-
AuthzGrants []string `json:"authzGrants"`
25-
Apps []interface{} `json:"apps"`
26-
} `json:"grants"`
11+
type SubjectResponse struct {
12+
Address string `json:"address"`
13+
Name string `json:"name"`
14+
Grants []GrantedAccess `json:"grants"`
2715
}
2816

29-
type Grants struct {
30-
Orgs []Org `json:"orgs"`
31-
}
32-
33-
type Org struct {
34-
Name string `json:"name"`
35-
Roles []string `json:"roles"`
36-
AuthzGrants []string `json:"authzGrants"`
17+
type GrantedAccess struct {
18+
Address string `json:"address"`
19+
Name string `json:"name"`
20+
AuthzGrants []string `json:"authzGrants"`
21+
Applications []struct {
22+
Name string `json:"name"`
23+
Permissions []string `json:"permissions"`
24+
} `json:"applications"`
3725
}
3826

3927
var (
@@ -48,15 +36,15 @@ func init() {
4836
Client = &http.Client{}
4937
}
5038

51-
func GetGrants(grantsURL string, address string, apiKey string) (*Grants, error) {
39+
func GetGrants(grantsURL string, address string, apiKey string) (*[]GrantedAccess, error) {
5240
uri := strings.ReplaceAll(grantsURL, "{addr}", address)
53-
roleReq, _ := http.NewRequest("GET", uri, nil)
54-
roleReq.Header.Add("x-sender", address)
41+
request, _ := http.NewRequest("GET", uri, nil)
42+
request.Header.Add("x-sender", address)
5543
// Add apikey if supplied.
5644
if apiKey != "" {
57-
roleReq.Header.Add("apikey", apiKey)
45+
request.Header.Add("apikey", apiKey)
5846
}
59-
resp, err := Client.Do(roleReq)
47+
resp, err := Client.Do(request)
6048
if err != nil {
6149
return nil, err
6250
}
@@ -67,21 +55,11 @@ func GetGrants(grantsURL string, address string, apiKey string) (*Grants, error)
6755
return nil, err
6856
}
6957

70-
var roleResponse RoleResponse
71-
if err := json.Unmarshal(body, &roleResponse); err != nil {
58+
var response SubjectResponse
59+
if err := json.Unmarshal(body, &response); err != nil {
7260
fmt.Println("Can not unmarshal JSON")
7361
return nil, err
7462
}
7563

76-
var grants Grants
77-
for _, grant := range roleResponse.Grants {
78-
org := Org{
79-
Name: grant.Org.Name,
80-
Roles: grant.Roles,
81-
AuthzGrants: grant.AuthzGrants,
82-
}
83-
84-
grants.Orgs = append(grants.Orgs, org)
85-
}
86-
return &grants, nil
64+
return &response.Grants, nil
8765
}

‎http/tp1uz5g72pvfrdnm9qnjpyvsnwc64d4wygyqanx2t/index.html‎

Lines changed: 24 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,30 @@
11
{
2-
"account": {
3-
"address": "tp1uz5g72pvfrdnm9qnjpyvsnwc64d4wygyqanx2t",
4-
"name": "jwt-wallet",
5-
"type": "ORGANIZATION"
6-
},
2+
"address": "tp1uz5g72pvfrdnm9qnjpyvsnwc64d4wygyqanx2t",
3+
"name": "jwt-wallet"
74
"grants": [
85
{
9-
"org": {
10-
"address": "tp1uz5g72pvfrdnm9qnjpyvsnwc64d4wygyqanx2t",
11-
"name": "jwt-wallet",
12-
"type": "ORGANIZATION"
13-
},
14-
"roles": [
15-
"role_read_org",
16-
"role_read_account",
17-
"role_read_account_grants",
18-
"role_write_account",
19-
"role_create_app",
20-
"role_read_app",
21-
"role_delete_app",
22-
"role_create_org_role",
23-
"role_read_org_role",
24-
"role_delete_org_role",
25-
"role_create_group",
26-
"role_read_group",
27-
"role_delete_group",
28-
"role_write_group"
29-
],
6+
"address": "tp1uz5g72pvfrdnm9qnjpyvsnwc64d4wygyqanx2t",
7+
"name": "jwt-wallet",
308
"authzGrants": [],
31-
"apps": []
9+
"applications": [
10+
{
11+
"name": "my_app",
12+
"permissions": [
13+
"create_subject",
14+
"read_subject",
15+
"update_subject",
16+
"delete_subject",
17+
"create_permission",
18+
"read_permission",
19+
"update_permission",
20+
"delete_permission",
21+
"create_role",
22+
"read_role",
23+
"update_role",
24+
"delete_role"
25+
]
26+
}
27+
]
3228
}
3329
]
34-
}
30+
}

‎jwt-wallet.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -60,36 +60,36 @@ func (conf Config) Access(kong *pdk.PDK) {
6060
return
6161
}
6262

63-
grants, err := handleRoles(tok, conf.RBAC, conf.APIKey)
63+
access, err := handleGrantedAccess(tok, conf.RBAC, conf.APIKey)
6464
if err != nil {
6565
kong.Log.Warn("err: " + err.Error())
6666
kong.Response.Exit(400, "account does not exist", x)
6767
return
6868
}
6969

70-
grantsJson, err := json.Marshal(grants)
70+
accessJson, err := json.Marshal(access)
7171
if err != nil {
72-
kong.Response.Exit(500, "someting went wrong", x)
72+
kong.Response.Exit(500, "something went wrong", x)
7373
return
7474
}
75-
kong.ServiceRequest.AddHeader("x-roles", string(grantsJson))
75+
kong.ServiceRequest.AddHeader("x-wallet-access", string(accessJson))
7676

7777
kong.Log.Warn(tok)
7878

7979
}
8080

8181
var parser = jwt.NewParser()
8282

83-
func handleRoles(token *jwt.Token, url string, apiKey string) (*grants.Grants, error) {
83+
func handleGrantedAccess(token *jwt.Token, url string, apiKey string) (*[]grants.GrantedAccess, error) {
8484
if claims, ok := token.Claims.(*signing.Claims); ok {
8585
if claims.Addr == "" {
8686
return nil, fmt.Errorf("missing addr claim")
8787
}
88-
grants, err := grants.GetGrants(url, claims.Addr, apiKey) // temporary interpolation until better configuration solutions
88+
grantedAccess, err := grants.GetGrants(url, claims.Addr, apiKey)
8989
if err != nil {
9090
return nil, err
9191
}
92-
return grants, nil
92+
return grantedAccess, nil
9393
}
9494
return nil, fmt.Errorf("malformed claims")
9595
}

0 commit comments

Comments
 (0)