jay brown
136 lines
3.5 KiB
Markdown
136 lines
3.5 KiB
Markdown
# RBAC (Role-Based Access Control) Package
|
|
|
|
This package provides authentication and authorization functionality for the application, with a specific focus on AWS Cognito integration and role-based access control (RBAC).
|
|
|
|
## Overview
|
|
|
|
The RBAC package handles all aspects of authentication and authorization, including:
|
|
|
|
- JWT token validation and verification
|
|
- AWS Cognito integration with JWKS (JSON Web Key Set) support
|
|
- Role-based access control through Cognito groups
|
|
- Echo middleware for protecting routes based on user roles
|
|
|
|
## Components
|
|
|
|
### Cognito Integration (`cognito.go`)
|
|
|
|
The package provides robust AWS Cognito integration with features including:
|
|
|
|
- JWT token validation using Cognito's JWKS endpoint
|
|
- Automatic key rotation and caching
|
|
- Group-based authorization checks
|
|
- Token details extraction and validation
|
|
|
|
Key components include:
|
|
|
|
- `CognitoKeyProvider`: Manages JWT validation keys from Cognito's JWKS endpoint
|
|
- `LocalKeyProvider`: Provides local key management for testing
|
|
- `TokenDetails`: Contains extracted JWT token information
|
|
- Various helper functions for group membership verification
|
|
|
|
## Usage
|
|
|
|
### Setting up Cognito Key Provider
|
|
|
|
```go
|
|
keyProvider := rbac.NewCognitoKeyProvider(
|
|
"us-east-1", // AWS Region
|
|
"your-user-pool-id" // Cognito User Pool ID / add to config
|
|
)
|
|
```
|
|
|
|
### Validating JWT Tokens
|
|
|
|
```go
|
|
tokenString := "your.jwt.token"
|
|
token, claims, err := rbac.ValidateJWT(tokenString, keyProvider)
|
|
if err != nil {
|
|
// Handle validation error
|
|
}
|
|
```
|
|
|
|
### Checking Group Membership
|
|
|
|
```go
|
|
// Check for a single group
|
|
if rbac.HasGroup(claims, "admin") {
|
|
// User is an admin
|
|
}
|
|
|
|
// Check for any of multiple groups
|
|
if rbac.HasAnyGroup(claims, []string{"admin", "editor"}) {
|
|
// User has at least one of the required roles
|
|
}
|
|
|
|
// Check for all required groups
|
|
if rbac.HasAllGroups(claims, []string{"editor", "reviewer"}) {
|
|
// User has all required roles
|
|
}
|
|
```
|
|
|
|
## Echo Middleware
|
|
|
|
The package includes middleware for the Echo web framework (coming soon) that will provide:
|
|
|
|
- Automatic JWT token validation
|
|
- Role-based route protection
|
|
- User context injection
|
|
|
|
### Example middleware usage
|
|
This is not tested yet.
|
|
```go
|
|
import ...
|
|
|
|
// Create the key provider once at startup
|
|
keyProvider := rbac.NewCognitoKeyProvider("us-east-1", "us-east-1_XXXXXXXX")
|
|
|
|
// Use in middleware
|
|
func authMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
|
|
return func(c echo.Context) error {
|
|
tokenString := extractTokenFromRequest(c)
|
|
|
|
_, claims, err := rbac.ValidateJWT(tokenString, keyProvider)
|
|
if err != nil {
|
|
return echo.NewHTTPError(http.StatusUnauthorized, "Invalid token")
|
|
}
|
|
|
|
if !rbac.HasAnyGroup(claims, []string{"admin", "editor"}) {
|
|
return echo.NewHTTPError(http.StatusForbidden, "Insufficient permissions")
|
|
}
|
|
|
|
return next(c)
|
|
}
|
|
}
|
|
```
|
|
|
|
## Security Considerations
|
|
|
|
- All JWKS endpoints must use HTTPS
|
|
- Only trusted Cognito domains are allowed
|
|
- JWT tokens are thoroughly validated including:
|
|
- Signature verification
|
|
- Expiration checking
|
|
- Required claims validation
|
|
- Group membership verification
|
|
|
|
## Testing
|
|
|
|
The package includes support for generating mock JWT tokens for testing purposes using the `LocalKeyProvider`:
|
|
|
|
```go
|
|
keyProvider := rbac.NewLocalKeyProvider(
|
|
"path/to/private.pem",
|
|
"path/to/public.pem"
|
|
)
|
|
|
|
token, err := rbac.GenerateMockJWT(
|
|
keyProvider,
|
|
"user123",
|
|
"user@example.com",
|
|
[]string{"admin", "editor"}
|
|
)
|
|
```
|
|
|
|
|