77 lines
2.3 KiB
Go
77 lines
2.3 KiB
Go
// policy-api ist der Aufrufpunkt fuer RBAC-06: stellt Core RBAC-02s
|
|
// Enforcer.Authorize als HTTP-Endpunkt fuer andere, physisch getrennte
|
|
// Module (DMS, Mail, Archive) bereit. Getrennt von cmd/core aus
|
|
// demselben Grund wie die anderen *-devserver.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"log"
|
|
"net/http"
|
|
"os"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
|
|
"gitea.perlbach24.de/scripte/nexarch/internal/flag"
|
|
"gitea.perlbach24.de/scripte/nexarch/internal/httpharden"
|
|
"gitea.perlbach24.de/scripte/nexarch/internal/policy"
|
|
"gitea.perlbach24.de/scripte/nexarch/internal/policyapi"
|
|
)
|
|
|
|
func main() {
|
|
dsn := os.Getenv("NEXARCH_POLICY_ADMIN_DSN")
|
|
if dsn == "" {
|
|
log.Fatal("NEXARCH_POLICY_ADMIN_DSN muss gesetzt sein")
|
|
}
|
|
serviceToken := os.Getenv("NEXARCH_POLICY_SERVICE_TOKEN")
|
|
if serviceToken == "" {
|
|
log.Fatal("NEXARCH_POLICY_SERVICE_TOKEN muss gesetzt sein")
|
|
}
|
|
addr := os.Getenv("NEXARCH_POLICY_API_LISTEN_ADDR")
|
|
if addr == "" {
|
|
addr = "127.0.0.1:8093"
|
|
}
|
|
|
|
ctx := context.Background()
|
|
pool, err := pgxpool.New(ctx, dsn)
|
|
if err != nil {
|
|
log.Fatalf("datenbankverbindung: %v", err)
|
|
}
|
|
defer pool.Close()
|
|
|
|
enforcer := policy.NewEnforcer(policy.NewStore(pool))
|
|
flagTTL := flag.DefaultCacheTTL
|
|
if raw := os.Getenv("NEXARCH_POLICY_FLAG_CACHE_TTL_SECONDS"); raw != "" {
|
|
seconds, err := strconv.Atoi(raw)
|
|
if err != nil || seconds < 1 || seconds > 300 {
|
|
log.Fatal("NEXARCH_POLICY_FLAG_CACHE_TTL_SECONDS muss zwischen 1 und 300 liegen")
|
|
}
|
|
flagTTL = time.Duration(seconds) * time.Second
|
|
}
|
|
flags := flag.NewService(flag.NewStore(pool), flagTTL)
|
|
|
|
var opts []policyapi.Option
|
|
if raw := os.Getenv("NEXARCH_POLICY_ALLOWED_TENANTS"); raw != "" {
|
|
var slugs []string
|
|
for _, slug := range strings.Split(raw, ",") {
|
|
if slug = strings.TrimSpace(slug); slug != "" {
|
|
slugs = append(slugs, slug)
|
|
}
|
|
}
|
|
opts = append(opts, policyapi.WithAllowedTenants(slugs))
|
|
log.Printf("policy-api: service-token auf %d mandanten beschraenkt", len(slugs))
|
|
}
|
|
|
|
mux := http.NewServeMux()
|
|
policyapi.Mount(mux, enforcer, flags, serviceToken, opts...)
|
|
mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })
|
|
|
|
log.Printf("policy-api: listening on %s", addr)
|
|
if err := httpharden.ListenAndServe(addr, mux); err != nil {
|
|
log.Fatalf("http server: %v", err)
|
|
}
|
|
}
|