jay brown
110 lines
2.6 KiB
Go
110 lines
2.6 KiB
Go
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
|
|
"queryorchestration/internal/rbac"
|
|
"queryorchestration/internal/serviceconfig"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
func setupConfig() (*serviceconfig.BaseConfig, error) {
|
|
cfg := &serviceconfig.BaseConfig{}
|
|
if err := serviceconfig.InitializeConfig(cfg); err != nil {
|
|
return nil, fmt.Errorf("failed to initialize config: %w", err)
|
|
}
|
|
|
|
if err := cfg.InitializeAuthProvider(); err != nil {
|
|
return nil, fmt.Errorf("failed to initialize auth provider: %w", err)
|
|
}
|
|
|
|
cfg.PrintConfig("secret")
|
|
if cfg.AuthProvider == nil {
|
|
return nil, fmt.Errorf("auth provider is nil")
|
|
}
|
|
|
|
return cfg, nil
|
|
}
|
|
|
|
func generateAndValidateToken(localProvider *rbac.LocalKeyProvider) (*rbac.TokenDetails, error) {
|
|
groups := []string{"admins", "developers", "querybuilders", "uploaders", "exporters"}
|
|
tokenString, err := rbac.GenerateTestJWT(localProvider, "test-user-id", "test@example.com", groups)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("error generating token: %w", err)
|
|
}
|
|
|
|
fmt.Printf("raw token: %s\n", tokenString)
|
|
|
|
token, claims, err := rbac.ValidateJWT(tokenString, localProvider)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("token validation failed: %w", err)
|
|
}
|
|
|
|
if !token.Valid {
|
|
return nil, fmt.Errorf("invalid token")
|
|
}
|
|
|
|
return rbac.ExtractTokenDetails(token, claims), nil
|
|
}
|
|
|
|
func checkUserGroups(claims jwt.MapClaims) {
|
|
groupsInterface, ok := claims["cognito:groups"]
|
|
if !ok {
|
|
fmt.Println("No groups found in token.")
|
|
return
|
|
}
|
|
|
|
groups, ok := groupsInterface.([]interface{})
|
|
if !ok {
|
|
fmt.Println("Invalid groups format in token.")
|
|
return
|
|
}
|
|
|
|
if len(groups) > 0 {
|
|
fmt.Println("User Groups:")
|
|
for _, group := range groups {
|
|
if groupStr, ok := group.(string); ok {
|
|
fmt.Println("-", groupStr)
|
|
}
|
|
}
|
|
} else {
|
|
fmt.Println("No groups found in token.")
|
|
}
|
|
|
|
if rbac.HasGroup(claims, "admins") {
|
|
fmt.Println("User is an admin.")
|
|
}
|
|
|
|
if rbac.HasAnyGroup(claims, []string{"developers", "querybuilders"}) {
|
|
fmt.Println("User can modify or query data.")
|
|
}
|
|
|
|
if rbac.HasAllGroups(claims, []string{"uploaders", "exporters"}) {
|
|
fmt.Println("User can both upload and export data.")
|
|
}
|
|
}
|
|
|
|
// for testing run like `LOG_LEVEL=INFO go run main.go`
|
|
func main() {
|
|
_, err := setupConfig()
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
|
|
localProvider := rbac.NewLocalKeyProvider("private_key.pem", "public_key.pem")
|
|
|
|
details, err := generateAndValidateToken(localProvider)
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
|
|
fmt.Println("Token is valid.")
|
|
fmt.Println("User ID:", details.UserID)
|
|
fmt.Println("Email:", details.Email)
|
|
fmt.Println("Expires:", details.Expiration)
|
|
|
|
checkUserGroups(details.Claims)
|
|
}
|