Jay Brown
90 lines
2.6 KiB
Go
90 lines
2.6 KiB
Go
// identityHandlers.go implements the identity API handler for user role discovery.
|
|
// This handler allows authenticated users to discover their assigned roles and
|
|
// the permissions granted by those roles from Permit.io.
|
|
package queryapi
|
|
|
|
import (
|
|
"net/http"
|
|
"time"
|
|
|
|
"queryorchestration/internal/cognitoauth"
|
|
"queryorchestration/internal/usermanagement"
|
|
|
|
"github.com/labstack/echo/v4"
|
|
)
|
|
|
|
// GetIdentity returns the currently authenticated user's roles and permissions from Permit.io.
|
|
// GET /identity
|
|
//
|
|
// This endpoint requires authentication but no authorization - any authenticated
|
|
// user can retrieve their own roles and the permissions granted by those roles.
|
|
//
|
|
// Returns:
|
|
// - 200: IdentityResponse with roles array including permissions
|
|
// - 401: Unauthorized if user is not authenticated
|
|
// - 502: Bad gateway if Permit.io call fails
|
|
func (ctrl *Controllers) GetIdentity(ctx echo.Context) error {
|
|
// Extract user subject ID from JWT token
|
|
userSubject, ok := cognitoauth.GetUserSubject(ctx)
|
|
if !ok {
|
|
return ctx.JSON(http.StatusUnauthorized, ErrorMessage{
|
|
Message: "Could not identify user from token",
|
|
})
|
|
}
|
|
|
|
// Get role keys from Permit.io
|
|
httpClient := &http.Client{Timeout: 10 * time.Second}
|
|
permitConfig := ctrl.getPermitConfig()
|
|
|
|
roleKeys, err := usermanagement.GetPermitUserRoles(httpClient, permitConfig, userSubject)
|
|
if err != nil {
|
|
ctrl.cfg.GetAuthLogger().Error("Failed to get user roles from Permit.io",
|
|
"error", err,
|
|
"user_subject", userSubject)
|
|
return ctx.JSON(http.StatusBadGateway, ErrorMessage{
|
|
Message: "Failed to retrieve roles from authorization service",
|
|
})
|
|
}
|
|
|
|
// Build response with role details
|
|
roles := make([]IdentityRole, 0, len(roleKeys))
|
|
|
|
for _, roleKey := range roleKeys {
|
|
// Get role details including permissions
|
|
roleDetails, err := usermanagement.GetRoleDetails(httpClient, permitConfig, roleKey)
|
|
if err != nil {
|
|
ctrl.cfg.GetAuthLogger().Warn("Failed to get role details from Permit.io",
|
|
"error", err,
|
|
"role_key", roleKey)
|
|
// Include role with empty permissions if details fetch fails
|
|
roles = append(roles, IdentityRole{
|
|
Key: roleKey,
|
|
Name: roleKey,
|
|
Permissions: []string{},
|
|
})
|
|
continue
|
|
}
|
|
|
|
permissions := roleDetails.Permissions
|
|
if permissions == nil {
|
|
permissions = []string{}
|
|
}
|
|
|
|
var description *string
|
|
if roleDetails.Description != "" {
|
|
description = &roleDetails.Description
|
|
}
|
|
|
|
roles = append(roles, IdentityRole{
|
|
Key: roleDetails.Key,
|
|
Name: roleDetails.Name,
|
|
Description: description,
|
|
Permissions: permissions,
|
|
})
|
|
}
|
|
|
|
return ctx.JSON(http.StatusOK, IdentityResponse{
|
|
Roles: roles,
|
|
})
|
|
}
|