jay brown
92 lines
2.6 KiB
Go
92 lines
2.6 KiB
Go
package rbac
|
|
|
|
import (
|
|
"fmt"
|
|
"log/slog"
|
|
|
|
"queryorchestration/internal/rbac"
|
|
)
|
|
|
|
// AuthConfig holds the RBAC configuration and KeyProvider
|
|
type AuthConfig struct {
|
|
AuthType string `env:"RBAC_PROVIDER" envDefault:"cognito"`
|
|
// Cognito Config
|
|
CognitoRegion string `env:"COGNITO_REGION" envDefault:"us-east-1"`
|
|
CognitoUserPoolID string `env:"COGNITO_USER_POOL_ID"`
|
|
// Local Key Config
|
|
PrivateKeyPath string `env:"RBAC_PRIVATE_KEY_PATH"`
|
|
PublicKeyPath string `env:"RBAC_PUBLIC_KEY_PATH"`
|
|
|
|
// Actual provider - can be either local or cognito
|
|
AuthProvider rbac.KeyProvider
|
|
}
|
|
|
|
// ConfigProvider interface defines the methods required for RBAC configuration
|
|
type ConfigProvider interface {
|
|
//Initialize() error
|
|
GetKeyProvider() rbac.KeyProvider
|
|
PrintConfig()
|
|
}
|
|
|
|
// GetKeyProvider returns the configured KeyProvider
|
|
func (r *AuthConfig) GetKeyProvider() rbac.KeyProvider {
|
|
return r.AuthProvider
|
|
}
|
|
|
|
func InitializeAuthProvider(config *AuthConfig) error {
|
|
return config.InitializeAuthProvider()
|
|
}
|
|
|
|
// InitializeAuthProvider initializes the appropriate KeyProvider based on configuration
|
|
func (r *AuthConfig) InitializeAuthProvider() error {
|
|
switch r.AuthType {
|
|
case "local":
|
|
if r.PrivateKeyPath == "" || r.PublicKeyPath == "" {
|
|
return fmt.Errorf("local key provider requires both private and public key paths")
|
|
}
|
|
r.AuthProvider = rbac.NewLocalKeyProvider(r.PrivateKeyPath, r.PublicKeyPath)
|
|
slog.Info("RBAC initialized with local key provider")
|
|
|
|
case "cognito":
|
|
if r.CognitoUserPoolID == "" {
|
|
return fmt.Errorf("cognito provider requires user pool ID")
|
|
}
|
|
r.AuthProvider = rbac.NewCognitoKeyProvider(r.CognitoRegion, r.CognitoUserPoolID)
|
|
slog.Info("RBAC initialized with Cognito key provider")
|
|
|
|
default:
|
|
return fmt.Errorf("unknown RBAC provider type: %s", r.AuthType)
|
|
}
|
|
r.PrintConfig()
|
|
|
|
return nil
|
|
}
|
|
|
|
// PrintConfig logs the current configuration, masking sensitive values
|
|
func (r *AuthConfig) PrintConfig() {
|
|
slog.Info("RBAC AuthConfig:",
|
|
"provider_type", r.AuthType,
|
|
"region", r.CognitoRegion,
|
|
"user_pool_id", r.CognitoUserPoolID,
|
|
"private_key_path", r.PrivateKeyPath,
|
|
"public_key_path", r.PublicKeyPath,
|
|
)
|
|
}
|
|
|
|
// Validate checks if the configuration is valid
|
|
func (r *AuthConfig) Validate() error {
|
|
switch r.AuthType {
|
|
case "local":
|
|
if r.PrivateKeyPath == "" || r.PublicKeyPath == "" {
|
|
return fmt.Errorf("local key provider requires both private and public key paths")
|
|
}
|
|
case "cognito":
|
|
if r.CognitoUserPoolID == "" {
|
|
return fmt.Errorf("cognito provider requires user pool ID")
|
|
}
|
|
default:
|
|
return fmt.Errorf("invalid provider type: %s", r.AuthType)
|
|
}
|
|
return nil
|
|
}
|