query-orchestration/internal/rbac

RBAC (Role-Based Access Control) Package

This package provides authentication and authorization functionality for the application, with a specific focus on AWS Cognito integration and role-based access control (RBAC).

Overview

The RBAC package handles all aspects of authentication and authorization, including:

• JWT token validation and verification
• AWS Cognito integration with JWKS (JSON Web Key Set) support
• Role-based access control through Cognito groups
• Echo middleware for protecting routes based on user roles

Components

Cognito Integration (cognito.go)

The package provides robust AWS Cognito integration with features including:

• JWT token validation using Cognito's JWKS endpoint
• Automatic key rotation and caching
• Group-based authorization checks
• Token details extraction and validation

Key components include:

• CognitoKeyProvider: Manages JWT validation keys from Cognito's JWKS endpoint
• LocalKeyProvider: Provides local key management for testing
• TokenDetails: Contains extracted JWT token information
• Various helper functions for group membership verification

Usage

Setting up Cognito Key Provider

keyProvider := rbac.NewCognitoKeyProvider(
    "us-east-1",           // AWS Region
    "your-user-pool-id"    // Cognito User Pool ID / add to config
)

Validating JWT Tokens

tokenString := "your.jwt.token"
token, claims, err := rbac.ValidateJWT(tokenString, keyProvider)
if err != nil {
    // Handle validation error
}

Checking Group Membership

// Check for a single group
if rbac.HasGroup(claims, "admin") {
    // User is an admin
}

// Check for any of multiple groups
if rbac.HasAnyGroup(claims, []string{"admin", "editor"}) {
    // User has at least one of the required roles
}

// Check for all required groups
if rbac.HasAllGroups(claims, []string{"editor", "reviewer"}) {
    // User has all required roles
}

Echo Middleware

The package includes middleware for the Echo web framework (coming soon) that will provide:

• Automatic JWT token validation
• Role-based route protection
• User context injection

Example middleware usage

This is not tested yet.

import  ...

// Create the key provider once at startup
keyProvider := rbac.NewCognitoKeyProvider("us-east-1", "us-east-1_XXXXXXXX")

// Use in middleware
func authMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
    return func(c echo.Context) error {
        tokenString := extractTokenFromRequest(c)
        
        _, claims, err := rbac.ValidateJWT(tokenString, keyProvider)
        if err != nil {
            return echo.NewHTTPError(http.StatusUnauthorized, "Invalid token")
        }
        
        if !rbac.HasAnyGroup(claims, []string{"admin", "editor"}) {
            return echo.NewHTTPError(http.StatusForbidden, "Insufficient permissions")
        }
        
        return next(c)
    }
}

Security Considerations

• All JWKS endpoints must use HTTPS
• Only trusted Cognito domains are allowed
• JWT tokens are thoroughly validated including:
  • Signature verification
  • Expiration checking
  • Required claims validation
  • Group membership verification

Testing

The package includes support for generating mock JWT tokens for testing purposes using the LocalKeyProvider:

keyProvider := rbac.NewLocalKeyProvider(
    "path/to/private.pem",
    "path/to/public.pem"
)

token, err := rbac.GenerateMockJWT(
    keyProvider,
    "user123",
    "user@example.com",
    []string{"admin", "editor"}
)