Jay Brown
85 lines
3.0 KiB
Go
85 lines
3.0 KiB
Go
package cognitoauth
|
|
|
|
import (
|
|
"fmt"
|
|
"log/slog"
|
|
"os"
|
|
"strings"
|
|
)
|
|
|
|
// ValidatePermitIOConfiguration validates PDP connectivity and API key at startup
|
|
// This function should be called during application startup to ensure configuration is correct
|
|
// before processing any real authorization requests.
|
|
//
|
|
// It makes a dummy permission check to verify the API key is valid and PDP is reachable.
|
|
//
|
|
// If DISABLE_AUTH=true, validation is skipped and function returns success.
|
|
// Returns an error if the check fails, which should cause the application to halt startup.
|
|
func ValidatePermitIOConfiguration() error {
|
|
// Skip validation if auth is disabled
|
|
disableAuth := os.Getenv("DISABLE_AUTH")
|
|
if strings.ToLower(disableAuth) == "true" {
|
|
fmt.Println("✓ Permit.io validation skipped (DISABLE_AUTH=true)")
|
|
return nil
|
|
}
|
|
|
|
pdpURL := strings.TrimSpace(os.Getenv("PERMIT_IO_PDP_URL"))
|
|
apiKey := strings.TrimSpace(os.Getenv("PERMIT_IO_API_KEY"))
|
|
|
|
// Apply default for PDP URL if not set or whitespace-only
|
|
if pdpURL == "" {
|
|
pdpURL = "http://localhost:7766"
|
|
}
|
|
|
|
if apiKey == "" {
|
|
return fmt.Errorf("PERMIT_IO_API_KEY environment variable must be set")
|
|
}
|
|
|
|
// Test API key validity and PDP connectivity with a dummy permission check
|
|
logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelWarn}))
|
|
permitClient := NewPermitIOClient(apiKey, pdpURL, logger)
|
|
|
|
// Use dummy test data that will likely be denied but should work with valid API key
|
|
testUser := "startup-validation-user-12345"
|
|
testAction := "read"
|
|
testResource := "startup-validation-resource"
|
|
|
|
_, err := permitClient.CheckPermission(testUser, testAction, testResource)
|
|
if err != nil {
|
|
// Check for specific error patterns to distinguish error types
|
|
errStr := err.Error()
|
|
|
|
if strings.Contains(errStr, "UnexpectedError") && (strings.Contains(errStr, "connection refused") || strings.Contains(errStr, "no such host")) {
|
|
return fmt.Errorf("Permit.io PDP connectivity failed with PDP_URL=%s: %v", pdpURL, err)
|
|
}
|
|
|
|
if strings.Contains(errStr, "Unauthorized") || strings.Contains(errStr, "Invalid PDP token") || strings.Contains(errStr, "api_error") {
|
|
return fmt.Errorf("Permit.io API key validation failed with API_KEY=%s and PDP_URL=%s: %v",
|
|
maskAPIKey(apiKey), pdpURL, err)
|
|
}
|
|
|
|
if strings.Contains(errStr, "UnprocessableEntityError") {
|
|
return fmt.Errorf("Permit.io API configuration error with API_KEY=%s and PDP_URL=%s: %v",
|
|
maskAPIKey(apiKey), pdpURL, err)
|
|
}
|
|
|
|
// Any other error is also a configuration problem
|
|
return fmt.Errorf("Permit.io validation failed with API_KEY=%s and PDP_URL=%s: %v",
|
|
maskAPIKey(apiKey), pdpURL, err)
|
|
}
|
|
|
|
// Success - both PDP connectivity and API key are valid
|
|
fmt.Printf("✓ Permit.io configuration validated successfully (PDP_URL=%s, API_KEY=%s)\n",
|
|
pdpURL, maskAPIKey(apiKey))
|
|
|
|
return nil
|
|
}
|
|
|
|
// maskAPIKey masks the API key for logging, showing only the first 8 characters
|
|
func maskAPIKey(apiKey string) string {
|
|
if len(apiKey) <= 8 {
|
|
return "***masked***"
|
|
}
|
|
return apiKey[:8] + "..."
|
|
}
|