Ilia Denisov
67 lines
2.1 KiB
Go
67 lines
2.1 KiB
Go
package grpcapi
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
"galaxy/gateway/authn"
|
|
gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
|
|
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
)
|
|
|
|
// payloadHashVerifyingService applies payload-hash verification after session
|
|
// lookup and before any later auth or routing step runs.
|
|
type payloadHashVerifyingService struct {
|
|
gatewayv1.UnimplementedEdgeGatewayServer
|
|
|
|
delegate gatewayv1.EdgeGatewayServer
|
|
}
|
|
|
|
// ExecuteCommand verifies req payload integrity before delegating to the
|
|
// configured service implementation.
|
|
func (s payloadHashVerifyingService) ExecuteCommand(ctx context.Context, req *gatewayv1.ExecuteCommandRequest) (*gatewayv1.ExecuteCommandResponse, error) {
|
|
if err := verifyPayloadHash(ctx); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return s.delegate.ExecuteCommand(ctx, req)
|
|
}
|
|
|
|
// SubscribeEvents verifies req payload integrity before delegating to the
|
|
// configured service implementation.
|
|
func (s payloadHashVerifyingService) SubscribeEvents(req *gatewayv1.SubscribeEventsRequest, stream grpc.ServerStreamingServer[gatewayv1.GatewayEvent]) error {
|
|
if err := verifyPayloadHash(stream.Context()); err != nil {
|
|
return err
|
|
}
|
|
|
|
return s.delegate.SubscribeEvents(req, stream)
|
|
}
|
|
|
|
// newPayloadHashVerifyingService wraps delegate with the payload-hash
|
|
// verification gate.
|
|
func newPayloadHashVerifyingService(delegate gatewayv1.EdgeGatewayServer) gatewayv1.EdgeGatewayServer {
|
|
return payloadHashVerifyingService{delegate: delegate}
|
|
}
|
|
|
|
func verifyPayloadHash(ctx context.Context) error {
|
|
envelope, ok := parsedEnvelopeFromContext(ctx)
|
|
if !ok {
|
|
return status.Error(codes.Internal, "authenticated request context is incomplete")
|
|
}
|
|
|
|
err := authn.VerifyPayloadHash(envelope.PayloadBytes, envelope.PayloadHash)
|
|
switch {
|
|
case err == nil:
|
|
return nil
|
|
case errors.Is(err, authn.ErrInvalidPayloadHash), errors.Is(err, authn.ErrPayloadHashMismatch):
|
|
return status.Error(codes.InvalidArgument, err.Error())
|
|
default:
|
|
return status.Error(codes.Internal, "payload hash verification failed")
|
|
}
|
|
}
|
|
|
|
var _ gatewayv1.EdgeGatewayServer = payloadHashVerifyingService{}
|