micromegas/servers/
tonic_auth_interceptor.rs

1use micromegas_auth::types::{AuthProvider, GrpcRequestParts, RequestParts};
2use micromegas_tracing::prelude::*;
3use std::sync::Arc;
4use tonic::{Request, Status};
5
6/// Checks the authentication of a Tonic request using an `AuthProvider`.
7///
8/// This function extracts request parts from the gRPC metadata
9/// and validates them using the provided authentication provider.
10pub async fn check_auth(
11    req: Request<()>,
12    auth_provider: &Arc<dyn AuthProvider>,
13) -> Result<Request<()>, Status> {
14    let metadata = req.metadata();
15
16    let parts = GrpcRequestParts {
17        metadata: metadata.clone(),
18    };
19
20    let auth_ctx = auth_provider
21        .validate_request(&parts as &dyn RequestParts)
22        .await
23        .map_err(|e| {
24            warn!("authentication failed: {e}");
25            Status::unauthenticated("invalid token")
26        })?;
27
28    info!(
29        "authenticated: subject={} email={:?} issuer={} admin={}",
30        auth_ctx.subject, auth_ctx.email, auth_ctx.issuer, auth_ctx.is_admin
31    );
32
33    let mut req = req;
34    req.extensions_mut().insert(auth_ctx);
35    Ok(req)
36}