diff options
| author | mo khan <mo@mokhan.ca> | 2025-05-24 00:53:06 -0600 |
|---|---|---|
| committer | mo khan <mo@mokhan.ca> | 2025-05-24 00:53:06 -0600 |
| commit | 8eb64aec1fc89a900dd2f3decaff86bf9097986c (patch) | |
| tree | 5139fca4cb5c7564e9071f9432f5b721814d0b8d /pkg/authz | |
| parent | e0517f3ce78415ab55cdb1921487c57cbee3d55e (diff) | |
refactor: do not make rpc call from authzd
Diffstat (limited to 'pkg/authz')
| -rw-r--r-- | pkg/authz/check_service.go | 25 | ||||
| -rw-r--r-- | pkg/authz/server.go | 9 |
2 files changed, 3 insertions, 31 deletions
diff --git a/pkg/authz/check_service.go b/pkg/authz/check_service.go index 13b4017..bb2e960 100644 --- a/pkg/authz/check_service.go +++ b/pkg/authz/check_service.go @@ -8,10 +8,8 @@ import ( core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3" auth "github.com/envoyproxy/go-control-plane/envoy/service/auth/v3" types "github.com/envoyproxy/go-control-plane/envoy/type/v3" - "github.com/xlgmokha/x/pkg/env" "github.com/xlgmokha/x/pkg/log" "github.com/xlgmokha/x/pkg/x" - "gitlab.com/gitlab-org/software-supply-chain-security/authorization/authzd.git/pkg/rpc" "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/pls" status "google.golang.org/genproto/googleapis/rpc/status" "google.golang.org/grpc/codes" @@ -43,13 +41,10 @@ var permissions map[string]string = map[string]string{ type CheckService struct { auth.UnimplementedAuthorizationServer - ability rpc.Ability } -func NewCheckService(ability rpc.Ability) *CheckService { - return &CheckService{ - ability: ability, - } +func NewCheckService() *CheckService { + return &CheckService{} } func (svc *CheckService) Check(ctx context.Context, request *auth.CheckRequest) (*auth.CheckResponse, error) { @@ -107,22 +102,6 @@ func (svc *CheckService) isLoggedIn(ctx context.Context, r *auth.CheckRequest) b if x.IsZero(idToken) { return false } - - if env.Fetch("APP_ENV", "") == "development" { - permission := svc.permissionFor(r.Attributes.Request.Http) - if x.IsPresent(permission) { - reply, err := svc.ability.Allowed(ctx, &rpc.AllowRequest{ - Subject: idToken.Subject, - Permission: permission, - Resource: "gid://sparkled/" + r.Attributes.Request.Http.Path, - }) - if err != nil { - pls.LogError(ctx, err) - return false - } - return reply.Result - } - } return true } return false diff --git a/pkg/authz/server.go b/pkg/authz/server.go index b890387..e1b0669 100644 --- a/pkg/authz/server.go +++ b/pkg/authz/server.go @@ -2,15 +2,11 @@ package authz import ( "context" - "net/http" auth "github.com/envoyproxy/go-control-plane/envoy/service/auth/v3" - "github.com/xlgmokha/x/pkg/env" "github.com/xlgmokha/x/pkg/log" "github.com/xlgmokha/x/pkg/x" - "gitlab.com/gitlab-org/software-supply-chain-security/authorization/authzd.git/pkg/rpc" "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/pls" - "gitlab.com/gitlab-org/software-supply-chain-security/authorization/sparkled/pkg/web" "google.golang.org/grpc" "google.golang.org/grpc/reflection" ) @@ -27,10 +23,7 @@ func New(ctx context.Context, options ...grpc.ServerOption) *Server { grpc.UnaryInterceptor(pls.LogGRPC(logger)), grpc.StreamInterceptor(pls.LogGRPCStream(logger)), )...) - auth.RegisterAuthorizationServer(server, NewCheckService(rpc.NewAbilityProtobufClient( - env.Fetch("AUTHZD_HOST", "https://authzd.staging.runway.gitlab.net"), - &http.Client{Transport: &web.Transport{Logger: logger}}, - ))) + auth.RegisterAuthorizationServer(server, NewCheckService()) reflection.Register(server) return &Server{ |