initial commit

backend/go-loose/client/client.go

@@ -0,0 +1,141 @@
+// Package client provides fail-closed API-key authorization middleware for Go services.
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+)
+
+const DefaultHeader = "X-API-Key"
+
+type Config struct {
+	BaseURL     string
+	Tenant      string
+	Application string
+	Header      string
+	HTTPClient  *http.Client
+}
+
+type Client struct {
+	baseURL     string
+	tenant      string
+	application string
+	header      string
+	httpClient  *http.Client
+}
+
+type Principal struct {
+	TenantID        string `json:"tenant_id"`
+	TenantSlug      string `json:"tenant_slug"`
+	ApplicationID   string `json:"application_id"`
+	ApplicationSlug string `json:"application_slug"`
+	APIKeyID        string `json:"api_key_id"`
+	APIKeyName      string `json:"api_key_name"`
+}
+
+type authorizationResponse struct {
+	Allowed bool   `json:"allowed"`
+	Reason  string `json:"reason"`
+	Principal
+}
+
+const XTenantId = "X-Tenant-Id"
+
+type contextKey struct{}
+
+func New(cfg Config) (*Client, error) {
+	if strings.TrimSpace(cfg.BaseURL) == "" || strings.TrimSpace(cfg.Application) == "" {
+		return nil, errors.New("go-loose client requires BaseURL and Application")
+	}
+	if cfg.Header == "" {
+		cfg.Header = DefaultHeader
+	}
+	if cfg.HTTPClient == nil {
+		cfg.HTTPClient = &http.Client{Timeout: 3 * time.Second}
+	}
+	return &Client{
+		baseURL: strings.TrimRight(cfg.BaseURL, "/"), tenant: cfg.Tenant,
+		application: cfg.Application, header: cfg.Header, httpClient: cfg.HTTPClient,
+	}, nil
+}
+
+func (c *Client) Authorize(ctx context.Context, apiKey, method, requestPath, host string) (Principal, error) {
+	payload, err := json.Marshal(map[string]string{
+		"tenant": c.tenant, "application": c.application, "method": method,
+		"path": requestPath, "host": stripPort(host),
+	})
+	if err != nil {
+		return Principal{}, fmt.Errorf("encode authorization request: %w", err)
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+"/api/v1/authorize", bytes.NewReader(payload))
+	if err != nil {
+		return Principal{}, fmt.Errorf("create authorization request: %w", err)
+	}
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set(c.header, apiKey)
+	response, err := c.httpClient.Do(request)
+	if err != nil {
+		return Principal{}, fmt.Errorf("authorize with Go Loose: %w", err)
+	}
+	defer response.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(response.Body, 1<<20))
+	if err != nil {
+		return Principal{}, fmt.Errorf("read authorization response: %w", err)
+	}
+	var result authorizationResponse
+	if err := json.Unmarshal(body, &result); err != nil {
+		return Principal{}, fmt.Errorf("decode authorization response (HTTP %d): %w", response.StatusCode, err)
+	}
+	if response.StatusCode != http.StatusOK || !result.Allowed {
+		if result.Reason == "" {
+			result.Reason = http.StatusText(response.StatusCode)
+		}
+		return Principal{}, fmt.Errorf("request denied by Go Loose: %s", result.Reason)
+	}
+	return result.Principal, nil
+}
+
+// Middleware rejects missing, invalid, or unverifiable keys and places the
+// authorized Principal in the request context.
+func (c *Client) Middleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		apiKey := strings.TrimSpace(r.Header.Get(c.header))
+		if apiKey == "" {
+			writeMiddlewareError(w, http.StatusUnauthorized, "missing API key")
+			return
+		}
+		principal, err := c.Authorize(r.Context(), apiKey, r.Method, r.URL.Path, r.Host)
+		if err != nil {
+			writeMiddlewareError(w, http.StatusForbidden, "API key not authorized")
+			return
+		}
+		r.Header.Del(c.header)
+		next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), contextKey{}, principal)))
+	})
+}
+
+func PrincipalFromContext(ctx context.Context) (Principal, bool) {
+	principal, ok := ctx.Value(contextKey{}).(Principal)
+	return principal, ok
+}
+
+func stripPort(host string) string {
+	if parsed, _, err := net.SplitHostPort(host); err == nil {
+		return strings.ToLower(parsed)
+	}
+	return strings.ToLower(host)
+}
+
+func writeMiddlewareError(w http.ResponseWriter, status int, message string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
+}