nexarch/common/policyclient/policyclient.go

// Package policyclient fragt Core (RBAC-06, POST /authorize) nach der
// Rechteentscheidung; Fehler und Ausfall fuehren immer zur Ablehnung.
package policyclient

import (
	"bytes"
	"context"
	"encoding/json"
	"fmt"
	"net/http"
	"strings"
	"time"
)

type Client struct {
	BaseURL      string
	ServiceToken string
	HTTP         *http.Client
}

func New(baseURL, serviceToken string) *Client {
	return &Client{BaseURL: strings.TrimRight(baseURL, "/"), ServiceToken: serviceToken, HTTP: &http.Client{Timeout: 5 * time.Second}}
}

func (c *Client) Allowed(ctx context.Context, tenant, role, permission string) (bool, error) {
	body := map[string]string{"role": role, "permission": permission}
	if tenant != "" {
		body["tenant"] = tenant
	}
	payload, _ := json.Marshal(body)
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.BaseURL+"/authorize", bytes.NewReader(payload))
	if err != nil {
		return false, err
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("X-Service-Token", c.ServiceToken)
	resp, err := c.HTTP.Do(req)
	if err != nil {
		return false, err
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		return false, fmt.Errorf("policy: status %d", resp.StatusCode)
	}
	var out struct {
		Allowed *bool `json:"allowed"`
	}
	if err := json.NewDecoder(http.MaxBytesReader(nil, resp.Body, 1<<16)).Decode(&out); err != nil || out.Allowed == nil {
		return false, fmt.Errorf("policy: antwort ohne entscheidung")
	}
	return *out.Allowed, nil
}