Role Binding#

servicePath 的組成 /<proto_package>.<proto_service>/，<proto_package> 和 <proto_service> 分別寫在 proto spec （users/proto/users.proto） 當中。定義 service_path + service_name 對應值 {<role_1>, <role_2>...} 的存取角色。

func serviceRoles() map[string][]string {
	const servicePath = "/users.UserService/"

	return map[string][]string{
		servicePath + "GetUser":           {"admin", "user"},
		servicePath + "GetAllUsers":       {"admin"},
		servicePath + "UpdateUser":        {"admin", "user"},
		servicePath + "DeleteUser":        {"admin", "user"},
		servicePath + "AddUserAccount":    {"admin", "user"},
		servicePath + "GetUserAccounts":   {"admin", "user"},
		servicePath + "DeleteUserAccount": {"admin", "user"},
		servicePath + "Logout":            {"admin", "user"},
	}
}

Authorization#

在下面的 authorize func 中，分別執行以下事項：

1. 確認目前 call 的服務方法（service_name）是否有定義在 serviceRoles() 中，取得服務方法的存取角色列表
2. 確認目前的傳輸上下文中含有 metadata
3. 確認 metadata 是否有包含 authorization，類似於 HTTP/1.1 中的 Header
4. 取得 JWT token
5. 驗證 JWT token
6. 確認該 token 有這個服務方法的存取權限

func (a *AuthInterceptor) authorize(ctx context.Context, method string) error {
	accessibleRoles, ok := a.serviceRoles[method]
	if !ok {
		return nil
	}

	md, ok := metadata.FromIncomingContext(ctx)
	if !ok {
		return status.Errorf(codes.Unauthenticated, "metadata is not provided")
	}

	values := md["authorization"]
	if len(values) == 0 {
		return status.Errorf(codes.Unauthenticated, "authorization token is not provided")
	}

	accessToken := values[0]
	claims, err := a.jwtManager.Verify(accessToken)
	if err != nil {
		return status.Errorf(codes.Unauthenticated, "access token is invalid: %v", err)
	}

	for _, role := range accessibleRoles {
		if role == claims.Role {
			return nil
		}
	}

	return status.Error(codes.PermissionDenied, "no permission to access this RPC")
}

套用 Interceptor#

func (a *AuthInterceptor) Unary() grpc.UnaryServerInterceptor {
	return func(
		ctx context.Context,
		req interface{},
		info *grpc.UnaryServerInfo,
		handler grpc.UnaryHandler,
	) (interface{}, error) {
		err := a.authorize(ctx, info.FullMethod)
		if err != nil {
			return nil, err
		}

		return handler(ctx, req)
	}
}

func (a *AuthInterceptor) Stream() grpc.StreamServerInterceptor {
	return func(
		srv interface{},
		stream grpc.ServerStream,
		info *grpc.StreamServerInfo,
		handler grpc.StreamHandler,
	) error {
		err := a.authorize(stream.Context(), info.FullMethod)
		if err != nil {
			return err
		}

		return handler(srv, stream)
	}
}

func NewGrpcServer(tlsConfig *tls.Config, logger *zap.Logger, jwtManager *utils.JWTManager) *GrpcServer {
	creds := credentials.NewTLS(tlsConfig)
	authInterceptor := NewAuthInterceptor(jwtManager)

	server := grpc.NewServer(
		grpc.ChainUnaryInterceptor(
			authInterceptor.Unary(),
		),
		grpc.ChainStreamInterceptor(
			authInterceptor.Stream(),
		),
		grpc.Creds(creds),
		grpc.ConnectionTimeout(utils.TIMEOUT),
	)

	reflection.Register(server)
	return &GrpcServer{
		server: server,
		logger: logger,
	}
}

Token Verify#

與生成 JWT token 的 UserService 不同，RecordService 這裡強調 token 的驗證，所以這裡放上 Verify 的程式碼片段。

在解析完得到 JWTClaims 之後，需要檢查 Audience 列表中是否有包含此服務的 proto_package。

func (j *JWTManager) Verify(tokenString string) (*UserJWTClaims, error) {
	token, err := jwt.ParseWithClaims(
		tokenString,
		&UserJWTClaims{},
		func(token *jwt.Token) (interface{}, error) {
			_, ok := token.Method.(*jwt.SigningMethodHMAC)
			if !ok {
				return nil, NewRecordError(ErrTokenAlg)
			}
			return j.secretKey, nil

		}, jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),
	)

	if err != nil {
		return nil, err
	}

	claims, ok := token.Claims.(*UserJWTClaims)
	if !ok {
		return nil, NewRecordError(ErrTokenInvalid)
	}

	audienceValid := false
	for _, aud := range claims.Audience {
		if aud == "records" {
			audienceValid = true
			break
		}
	}
	if !audienceValid {
		return nil, NewRecordError(ErrTokenInvalid)
	}

	if claims.ExpiresAt.Time.Unix() < time.Now().Unix() {
		return nil, NewRecordError(ErrTokenInvalid)
	}

	return claims, nil
}

Access Service#

1. 啟動 RecordService，攜帶從 UserService 登入取得的 JWT token 並發送請求

   # cd finance-manager-v2/records
   # go run cmd/main.go
   #
   # (Open another terminal, then nativate to finance-manager-v2/records)
   curl -X GET https://localhost:8444/v1/records/user\?user_id\=1 \
        -H "authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJyb2xlIjoidXNlciIsImlzcyI6InVzZXJzIiwiYXVkIjpbInVzZXJzIiwicmVjb3JkcyIsInJlY29yZHNfYmFuayJdLCJleHAiOjE3NDMxNTkzMjUsImlhdCI6MTc0MzA3MjkyNX0.4p41Y3msmCSCm0XosFEjb7TZ3lqZXVGFsI9EfbtkL08" \
        --cacert certs/cert.pem

2. 成功取得回傳訊息

   {"result":{"record":{"id":"1","userId":"1","amount":45.67,"transactionDate":"1677628800","recordType":"INCOME","detail":"","createdAt":"1742832795","updatedAt":"1742832795"}}}
   {"result":{"record":{"id":"2","userId":"1","amount":30,"transactionDate":"1742860800","recordType":"INCOME","detail":"","createdAt":"1742835020","updatedAt":"1742835020"}}}
   {"result":{"record":{"id":"3","userId":"1","amount":45.67,"transactionDate":"1677628800","recordType":"INCOME","detail":"","createdAt":"1743010174","updatedAt":"1743010174"}}}