package auth import ( "context" "crypto/subtle" grpc_auth "github.com/grpc-ecosystem/go-grpc-middleware/auth" "google.golang.org/grpc" "google.golang.org/grpc/codes" "google.golang.org/grpc/status" "go.linka.cloud/grpc/interceptors" ) func ChainedAuthFuncs(fn ...grpc_auth.AuthFunc) grpc_auth.AuthFunc { return func(ctx context.Context) (context.Context, error) { code := codes.Unauthenticated for _, v := range fn { ctx2, err := v(ctx) if err == nil { return ctx2, nil } s, ok := status.FromError(err) if !ok { return ctx2, err } if s.Code() == codes.PermissionDenied { code = codes.PermissionDenied } } return ctx, status.Error(code, code.String()) } } func NewServerInterceptors(opts ...Option) interceptors.ServerInterceptors { o := options{} for _, v := range opts { v(&o) } return &interceptor{o: o, authFn: ChainedAuthFuncs(o.authFns...)} } type interceptor struct { o options authFn grpc_auth.AuthFunc } func (i *interceptor) UnaryServerInterceptor() grpc.UnaryServerInterceptor { a := grpc_auth.UnaryServerInterceptor(i.authFn) return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp interface{}, err error) { if i.isNotProtected(info.FullMethod) { return handler(ctx, req) } return a(ctx, req, info, handler) } } func (i *interceptor) StreamServerInterceptor() grpc.StreamServerInterceptor { a := grpc_auth.StreamServerInterceptor(i.authFn) return func(srv interface{}, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error { if i.isNotProtected(info.FullMethod) { return handler(srv, ss) } return a(srv, ss, info, handler) } } func (i *interceptor) isNotProtected(endpoint string) bool { // default to not ignored if len(i.o.ignoredMethods) == 0 && len(i.o.methods) == 0 { return false } for _, v := range i.o.ignoredMethods { if v == endpoint { return true } } if len(i.o.methods) == 0 { return false } for _, v := range i.o.methods { if v == endpoint { return false } } return true } func Equals(s1, s2 string) bool { return subtle.ConstantTimeCompare([]byte(s1), []byte(s2)) == 1 }