mirror of
https://git.mirrors.martin98.com/https://github.com/SigNoz/signoz
synced 2025-08-04 09:00:35 +08:00
9c4521b34a
* feat: added license manager and feature flags * feat: completed org domain api * chore: checking in saml auth handler code * feat: added signup with sso * feat: added login support for admins * feat: added pem support for certificate * ci(build-workflow): 👷 include EE query-service * fix: 🐛 update package name * chore(ee): 🔧 LD_FLAGS related changes Signed-off-by: Prashant Shahi <prashant@signoz.io> Co-authored-by: Prashant Shahi <prashant@signoz.io> Co-authored-by: nityanandagohain <nityanandagohain@gmail.com>
95 lines
2.5 KiB
Go
95 lines
2.5 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net/http"
|
|
"regexp"
|
|
|
|
"github.com/pkg/errors"
|
|
"go.signoz.io/signoz/pkg/query-service/constants"
|
|
"go.signoz.io/signoz/pkg/query-service/dao"
|
|
"go.signoz.io/signoz/pkg/query-service/model"
|
|
)
|
|
|
|
type Group struct {
|
|
GroupID string
|
|
GroupName string
|
|
}
|
|
|
|
type AuthCache struct {
|
|
AdminGroupId string
|
|
EditorGroupId string
|
|
ViewerGroupId string
|
|
}
|
|
|
|
var AuthCacheObj AuthCache
|
|
|
|
// InitAuthCache reads the DB and initialize the auth cache.
|
|
func InitAuthCache(ctx context.Context) error {
|
|
|
|
setGroupId := func(groupName string, dest *string) error {
|
|
group, err := dao.DB().GetGroupByName(ctx, groupName)
|
|
if err != nil {
|
|
return errors.Wrapf(err.Err, "failed to get group %s", groupName)
|
|
}
|
|
*dest = group.Id
|
|
return nil
|
|
}
|
|
|
|
if err := setGroupId(constants.AdminGroup, &AuthCacheObj.AdminGroupId); err != nil {
|
|
return err
|
|
}
|
|
if err := setGroupId(constants.EditorGroup, &AuthCacheObj.EditorGroupId); err != nil {
|
|
return err
|
|
}
|
|
if err := setGroupId(constants.ViewerGroup, &AuthCacheObj.ViewerGroupId); err != nil {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func GetUserFromRequest(r *http.Request) (*model.UserPayload, error) {
|
|
accessJwt, err := ExtractJwtFromRequest(r)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
user, err := validateUser(accessJwt)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return user, nil
|
|
}
|
|
|
|
func IsSelfAccessRequest(user *model.UserPayload, id string) bool { return user.Id == id }
|
|
|
|
func IsViewer(user *model.UserPayload) bool { return user.GroupId == AuthCacheObj.ViewerGroupId }
|
|
func IsEditor(user *model.UserPayload) bool { return user.GroupId == AuthCacheObj.EditorGroupId }
|
|
func IsAdmin(user *model.UserPayload) bool { return user.GroupId == AuthCacheObj.AdminGroupId }
|
|
|
|
func ValidatePassword(password string) error {
|
|
if len(password) < minimumPasswordLength {
|
|
return errors.Errorf("Password should be atleast %d characters.", minimumPasswordLength)
|
|
}
|
|
|
|
num := `[0-9]{1}`
|
|
lower := `[a-z]{1}`
|
|
upper := `[A-Z]{1}`
|
|
symbol := `[!@#$&*]{1}`
|
|
if b, err := regexp.MatchString(num, password); !b || err != nil {
|
|
return fmt.Errorf("password should have atleast one number")
|
|
}
|
|
if b, err := regexp.MatchString(lower, password); !b || err != nil {
|
|
return fmt.Errorf("password should have atleast one lower case letter")
|
|
}
|
|
if b, err := regexp.MatchString(upper, password); !b || err != nil {
|
|
return fmt.Errorf("password should have atleast one upper case letter")
|
|
}
|
|
if b, err := regexp.MatchString(symbol, password); !b || err != nil {
|
|
return fmt.Errorf("password should have atleast one special character from !@#$&* ")
|
|
}
|
|
return nil
|
|
}
|