security

func CheckGlobalRequest ¶

func CheckGlobalRequest(c *fiber.Ctx, bCtx *BusinessContext) (allow bool)

CheckGlobalRequest performs access checks for global requests Global requests are requests are all requests that do not have a direct resource reference e.g. requests for to list resource `GET /api/v1/foos`

func CheckNamespacedRequest ¶

func CheckNamespacedRequest(c *fiber.Ctx, params map[string]string, templates map[ClientType]ComparisonTemplates, bCtx *BusinessContext) (allow bool, err error)

CheckNamespacedRequest performs access checks for namespaced requests Namespaced requests are requests that have a direct resource reference e.g. requests for a specific resource `GET /api/v1/foos/<namespace>/<name>` It does to by matching the prefix of the namespace with the client's context and checking if the client has the required access rights

func ConfigureSecurity ¶

func ConfigureSecurity(router fiber.Router, opts SecurityOpts) fiber.Handler

ConfigureSecurity configures the security middlewares This is a convenience function that configures the JWT middleware and the business context middleware It also returns the check access middleware that should be configured on the route level

func DecodeValue ¶

func DecodeValue(decoders map[string]ValueDecoder, claims map[string]any, key string) (string, problems.Problem)

DecodeValue decodes a value from the claims map using a custom decoder if available If not, it will try to get the value directly from the claims map

func IsMock ¶

func IsMock(opts []Option[*JWTOpts]) bool

IsMock checks if the security middleware is mocked If the trusted issuers are not set, the middleware is considered mocked

func IsObfuscated ¶

func IsObfuscated(ctx context.Context) bool

func IsReadyOnlyRequest ¶

func IsReadyOnlyRequest(c *fiber.Ctx) bool

func NewBusinessCtxMiddleware ¶

func NewBusinessCtxMiddleware(mwOpts BusinessContextOpts) fiber.Handler

NewBusinessCtxMiddleware is a convencience function. See NewBusinessCtxMiddlewareWithOpts

func NewBusinessCtxMiddlewareWithOpts ¶

func NewBusinessCtxMiddlewareWithOpts(opts ...Option[*BusinessContextOpts]) fiber.Handler

NewBusinessCtxMiddlewareWithOpts creates a new middleware that extracts the business context from the JWT token The business context is used to determine the client type and access type The client type is used to determine which resources this client is allowed to see The access type is used to determine if the client has read or write access The actual check if the client is allowed to see a resource is done in `check_access.go`

Example of the JWT token structure:

{
	"env": "dev",
	"clientId": "group--team--user",
	"scopes": "group:team:read group:team:write",

	# These are used by the JWT middleware
	"operation": "GET",
	"requestPath": "/api/v1/resource",
}

func NewCheckAccessMiddlewareWithOpts ¶

func NewCheckAccessMiddlewareWithOpts(opts ...Option[*CheckAccessOpts]) fiber.Handler

NewCheckAccessMiddlewareWithOpts creates a new middleware that checks if the client has access to the requested resource

It is expected that `business_context` middleware is executed before this middleware ¶

The middleware checks the client's context and access rights to determine if the client has access to the requested resource.

As this middleware depends on path-params it has to be configured on the route level ```go app.Get("/api/v1/foos/:namespace/:name", NewCheckAccessMiddlewareWithOpts(), handler) ```

func NewJWT ¶

func NewJWT(opts JWTOpts) fiber.Handler

NewJWT creates a new JWT middleware This middleware will validate the JWT token and perform the Last-Mile-Security(LMS)-Check The LMS-Check is performed by checking the operation and requestPath claims

func NewJWTWithOpts ¶

func NewJWTWithOpts(opts ...Option[*JWTOpts]) fiber.Handler

func ToContext ¶

func ToContext(ctx context.Context, bCtx *BusinessContext) context.Context