warkanum
d7c0205c50
CI / build-and-test (push) Successful in 2m46s
* Introduce Superadmin field in OAuthClient configuration * Implement IsSuperadmin method in OAuthRegistry * Update identityAdmin to check superadmin status via OAuthRegistry * Add tests for OAuthRegistry superadmin functionality
49 lines
1.2 KiB
Go
49 lines
1.2 KiB
Go
package auth
|
|
|
|
import (
|
|
"crypto/subtle"
|
|
"fmt"
|
|
|
|
"git.warky.dev/wdevs/amcs/internal/config"
|
|
)
|
|
|
|
type OAuthRegistry struct {
|
|
clients []config.OAuthClient
|
|
}
|
|
|
|
func NewOAuthRegistry(clients []config.OAuthClient) (*OAuthRegistry, error) {
|
|
if len(clients) == 0 {
|
|
return nil, fmt.Errorf("oauth registry requires at least one client")
|
|
}
|
|
|
|
return &OAuthRegistry{clients: append([]config.OAuthClient(nil), clients...)}, nil
|
|
}
|
|
|
|
func (o *OAuthRegistry) Lookup(clientID string, clientSecret string) (string, bool) {
|
|
for _, client := range o.clients {
|
|
if subtle.ConstantTimeCompare([]byte(client.ClientID), []byte(clientID)) == 1 &&
|
|
subtle.ConstantTimeCompare([]byte(client.ClientSecret), []byte(clientSecret)) == 1 {
|
|
if client.ID != "" {
|
|
return client.ID, true
|
|
}
|
|
return client.ClientID, true
|
|
}
|
|
}
|
|
return "", false
|
|
}
|
|
|
|
// IsSuperadmin reports whether keyID (as returned by Lookup) belongs to an
|
|
// OAuth client configured with superadmin: true.
|
|
func (o *OAuthRegistry) IsSuperadmin(keyID string) bool {
|
|
for _, client := range o.clients {
|
|
id := client.ID
|
|
if id == "" {
|
|
id = client.ClientID
|
|
}
|
|
if id == keyID {
|
|
return client.Superadmin
|
|
}
|
|
}
|
|
return false
|
|
}
|