mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-30 10:56:28 +02:00
5edfa7b03f
- telemetry/tace: add traces throughout code - telemetry/metrics: nest metrics and trace under telemetry - telemetry/tace: add service name span to HTTPMetricsHandler. - telemetry/metrics: removed chain dependency middleware_tests. - telemetry/metrics: wrap and encapsulate variatic view registration. - telemetry/tace: add jaeger support for tracing. - cmd/pomerium: move `parseOptions` to internal/config. - cmd/pomerium: offload server handling to httputil and sub pkgs. - httputil: standardize creation/shutdown of http listeners. - httputil: prefer curve X25519 to P256 when negotiating TLS. - fileutil: use standardized Getw Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
38 lines
1.2 KiB
Go
38 lines
1.2 KiB
Go
//go:generate protoc -I ../proto/authorize --go_out=plugins=grpc:../proto/authorize ../proto/authorize/authorize.proto
|
|
|
|
package authorize // import "github.com/pomerium/pomerium/authorize"
|
|
import (
|
|
"context"
|
|
|
|
"github.com/pomerium/pomerium/internal/telemetry/trace"
|
|
pb "github.com/pomerium/pomerium/proto/authorize"
|
|
)
|
|
|
|
// Authorize validates the user identity, device, and context of a request for
|
|
// a given route. Currently only checks identity.
|
|
func (a *Authorize) Authorize(ctx context.Context, in *pb.Identity) (*pb.AuthorizeReply, error) {
|
|
_, span := trace.StartSpan(ctx, "authorize.grpc.Authorize")
|
|
defer span.End()
|
|
|
|
ok := a.ValidIdentity(in.Route,
|
|
&Identity{
|
|
User: in.User,
|
|
Email: in.Email,
|
|
Groups: in.Groups,
|
|
ImpersonateEmail: in.ImpersonateEmail,
|
|
ImpersonateGroups: in.ImpersonateGroups,
|
|
})
|
|
return &pb.AuthorizeReply{IsValid: ok}, nil
|
|
}
|
|
|
|
// IsAdmin validates the user is an administrative user.
|
|
func (a *Authorize) IsAdmin(ctx context.Context, in *pb.Identity) (*pb.IsAdminReply, error) {
|
|
_, span := trace.StartSpan(ctx, "authorize.grpc.IsAdmin")
|
|
defer span.End()
|
|
ok := a.identityAccess.IsAdmin(
|
|
&Identity{
|
|
Email: in.Email,
|
|
Groups: in.Groups,
|
|
})
|
|
return &pb.IsAdminReply{IsAdmin: ok}, nil
|
|
}
|