From bd3100a8867c968ae5ec27e569e292230b3c814e Mon Sep 17 00:00:00 2001 From: jay brown Date: Fri, 21 Mar 2025 16:57:28 -0700 Subject: [PATCH] docs --- cmd/cognito_test/cognitotest/readme.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/cmd/cognito_test/cognitotest/readme.md b/cmd/cognito_test/cognitotest/readme.md index 9911a981..0c37d74c 100644 --- a/cmd/cognito_test/cognitotest/readme.md +++ b/cmd/cognito_test/cognitotest/readme.md @@ -103,6 +103,21 @@ curl -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..." http://localhost:8080/us | /query | exporters | | /api/inventory/update | exporters, uploaders | +Note. If you want to change the RBAC requirements for the server they are completely table driven. +The code where they are defined (in main()) looks like this. Feel free to change them and rerun. +```go + routePermissions := map[string][]string{ + "/users": {"exporters"}, + "/users/:id": {"exporters", "querybuilders"}, + "/orders": {"exporters", "exporters"}, + "/reports/sales": {"exporters", "uploaders", "querybuilders"}, + "/settings": {"exporters"}, + "/query": {"exporters", "querybuilders"}, // Only exporters can access /query + "/api/inventory/update": {"exporters", "uploaders"}, + } + +``` + 4. If your user doesn't have the required group for an endpoint, you'll receive a 403 Forbidden response: ```json @@ -124,6 +139,7 @@ curl -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..." http://localhost:8080/us 3. **Token Exchange**: The server exchanges this code for OAuth tokens by calling Cognito's token endpoint 4. **Token Verification**: The server verifies the JWT token signature using Cognito's JWKS 5. **Group Verification**: The server checks if the user belongs to the required groups for the `/query` endpoint + 6. Note that /query is just a placeholder and will be changes to something like /login or /login/callback in the api server. This setting is set in cognito on the user pool. 6. **Response**: If authorized, the server returns the tokens and user information; if not, it returns a 403 error ### Subsequent API Requests