47 lines
1.5 KiB
Go
47 lines
1.5 KiB
Go
|
package kmsvc
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
|
||
|
|
"google.golang.org/grpc"
|
||
|
|
"google.golang.org/grpc/metadata"
|
||
|
|
)
|
||
|
|
|
||
|
|
// TokenSource supplies a bearer token for each outgoing call. Implementations
|
||
|
|
// must be safe for concurrent use.
|
||
|
|
type TokenSource interface {
|
||
|
|
Token(ctx context.Context) (string, error)
|
||
|
|
}
|
||
|
|
|
||
|
|
// StaticToken is a TokenSource that always returns the same token. Useful for
|
||
|
|
// tests and one-off scripts; not suitable for long-lived processes since the
|
||
|
|
// token is never refreshed.
|
||
|
|
type StaticToken string
|
||
|
|
|
||
|
|
func (t StaticToken) Token(ctx context.Context) (string, error) {
|
||
|
|
return string(t), nil
|
||
|
|
}
|
||
|
|
|
||
|
|
// authUnaryInterceptor attaches the bearer token to outgoing gRPC metadata.
|
||
|
|
func authUnaryInterceptor(source TokenSource) grpc.UnaryClientInterceptor {
|
||
|
|
return func(ctx context.Context, method string, req, reply any, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
|
||
|
|
tok, err := source.Token(ctx)
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
ctx = metadata.AppendToOutgoingContext(ctx, "authorization", "Bearer "+tok)
|
||
|
|
return invoker(ctx, method, req, reply, cc, opts...)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func authStreamInterceptor(source TokenSource) grpc.StreamClientInterceptor {
|
||
|
|
return func(ctx context.Context, desc *grpc.StreamDesc, cc *grpc.ClientConn, method string, streamer grpc.Streamer, opts ...grpc.CallOption) (grpc.ClientStream, error) {
|
||
|
|
tok, err := source.Token(ctx)
|
||
|
|
if err != nil {
|
||
|
|
return nil, err
|
||
|
|
}
|
||
|
|
ctx = metadata.AppendToOutgoingContext(ctx, "authorization", "Bearer "+tok)
|
||
|
|
return streamer(ctx, desc, cc, method, opts...)
|
||
|
|
}
|
||
|
|
}
|