micromegas_auth/

types.rs

use crate::groups::ADMINS_GROUP;
use anyhow::Result;
use chrono::{DateTime, Utc};
use std::sync::Arc;

/// A DB-backed auth provider (e.g. `DbApiKeyAuthProvider`) could not reach its
/// key store — distinguishes a store *outage* from a rejected credential all
/// the way out to the HTTP/gRPC response.
///
/// Wraps the underlying `anyhow::Error` rather than replacing it: callers that
/// only need to log or propagate the error keep using it as an `anyhow::Error`
/// (via `?`/`From`), while `MultiAuthProvider`, `auth_middleware`, and the gRPC
/// `AuthService` downcast (`anyhow::Error::downcast_ref`) to detect this specific
/// kind and map it to a retryable status (503 / `Status::unavailable`) instead of
/// the blanket "invalid credential" response every other error gets.
///
/// Per `rust/CLAUDE.md`'s anyhow-vs-thiserror rule, the retryable/terminal
/// distinction *is* modeled as an explicit type rather than an ad-hoc string —
/// that's the part of the rule this satisfies. What it doesn't satisfy: callers
/// still reach that type via `downcast_ref` instead of matching on it directly,
/// because `AuthProvider::validate_request` returns `anyhow::Result` and this
/// plan chose not to change that trait's public return type. Treat this as a
/// deliberate, scoped exception rather than a full application of the rule.
#[derive(thiserror::Error, Debug)]
#[error("auth provider unavailable: {0}")]
pub struct ProviderUnavailable(#[source] pub anyhow::Error);

/// Authentication type
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum AuthType {
    /// API key authentication
    ApiKey,
    /// OIDC authentication
    Oidc,
}

/// Authentication context containing user identity and metadata
#[derive(Debug, Clone)]
pub struct AuthContext {
    /// Unique subject identifier (e.g., user ID, service account ID)
    pub subject: String,
    /// Email address (if available)
    pub email: Option<String>,
    /// Issuer (for OIDC) or "api_key" for API key auth
    pub issuer: String,
    /// Audience that was matched during token validation
    /// - For OIDC access tokens: API audience (e.g., "<https://api.example.com>")
    /// - For OIDC ID tokens: client ID
    /// - For API key auth: None
    pub audience: Option<String>,
    /// Token expiration time (if applicable)
    pub expires_at: Option<DateTime<Utc>>,
    /// Authentication type
    pub auth_type: AuthType,
    /// Whether this authentication allows user delegation (acting on behalf of others)
    /// - OIDC user tokens: false (user cannot impersonate others)
    /// - Analytics API keys/service accounts: true (can act on behalf of users)
    /// - Ingestion API keys: false — a write credential is not a delegating service account, and
    ///   it can never reach the gRPC path this flag governs anyway (`ingestion_api_keys` never
    ///   crosses `flight_sql_service_impl.rs`)
    pub allow_delegation: bool,
    /// The write audience an ingestion key is immutably bound to. `Some(..)` for every ingestion
    /// API key (the `ingestion_api_keys.audience` column is `NOT NULL` as of migration v6);
    /// `None` for every other principal kind. Write-side only; never consulted by `ReadPolicy`.
    pub bound_audience: Option<String>,
    /// The set of audiences an analytics service-account key is granted read access to. Empty for
    /// every principal today — no analytics key provider populates it yet. Read-side only; folded
    /// into `AudienceReadPolicy::resolve`'s union but never into `AudienceMintPolicy`'s mintable
    /// set (a read grant confers no mint authority).
    pub read_audiences: Vec<String>,
    /// The caller's resolved, transitive local-group membership -- filled by
    /// [`crate::membership::MembershipProvider`] from a [`crate::groups::GroupGraph`] snapshot,
    /// **after** the inner provider authenticates the request. Empty until a
    /// `MembershipProvider` fills it (disabled-auth and maintenance contexts set this to
    /// `Arc::from([ADMINS_GROUP.to_string()])` directly instead). `AudienceReadPolicy`/
    /// `AudienceMintPolicy` match each entry against `group:<name>` grant-map *selectors* via
    /// [`crate::policy::caller_selectors`]/`selector_matches`.
    pub memberships: Arc<[String]>,
}

impl AuthContext {
    /// `true` iff `memberships` contains [`ADMINS_GROUP`] -- a method, not a field, so no
    /// construction site can set it inconsistently with `memberships`.
    pub fn is_admin(&self) -> bool {
        self.memberships.iter().any(|g| g == ADMINS_GROUP)
    }
}

/// Trait for extracting authentication-relevant data from requests
pub trait RequestParts: Send + Sync {
    /// Extract Authorization header as string
    fn authorization_header(&self) -> Option<&str>;

    /// Extract Bearer token from Authorization header
    fn bearer_token(&self) -> Option<&str> {
        self.authorization_header()
            .and_then(|h| h.strip_prefix("Bearer "))
    }

    /// Get custom header value by name
    fn get_header(&self, name: &str) -> Option<&str>;

    /// Get request method (if applicable)
    fn method(&self) -> Option<&str>;

    /// Get request URI (if applicable)
    fn uri(&self) -> Option<&str>;

    /// The resolved client IP, `None` when nothing resolves (see
    /// [`crate::client_ip::resolve_client_ip`]). This is what
    /// [`crate::ip_allowlist::IpAllowlist::allows`] checks a restricted key's request against;
    /// `None` never satisfies a non-empty allowlist.
    fn client_ip(&self) -> Option<std::net::IpAddr>;
}

/// HTTP request validation input
pub struct HttpRequestParts {
    /// HTTP headers
    pub headers: http::HeaderMap,
    /// HTTP method
    pub method: http::Method,
    /// Request URI
    pub uri: http::Uri,
    /// The resolved client IP, computed once by the caller (see
    /// [`crate::client_ip::resolve_client_ip`]) before this struct is built.
    pub client_ip: Option<std::net::IpAddr>,
}

impl RequestParts for HttpRequestParts {
    fn authorization_header(&self) -> Option<&str> {
        self.headers
            .get(http::header::AUTHORIZATION)
            .and_then(|h| h.to_str().ok())
    }

    fn get_header(&self, name: &str) -> Option<&str> {
        self.headers.get(name).and_then(|h| h.to_str().ok())
    }

    fn method(&self) -> Option<&str> {
        Some(self.method.as_str())
    }

    fn uri(&self) -> Option<&str> {
        Some(self.uri.path())
    }

    fn client_ip(&self) -> Option<std::net::IpAddr> {
        self.client_ip
    }
}

/// gRPC request validation input (tonic metadata)
pub struct GrpcRequestParts {
    /// gRPC metadata map
    pub metadata: tonic::metadata::MetadataMap,
    /// The resolved client IP, computed once by the caller (see
    /// [`crate::client_ip::resolve_client_ip`]) before this struct is built.
    pub client_ip: Option<std::net::IpAddr>,
}

impl RequestParts for GrpcRequestParts {
    fn authorization_header(&self) -> Option<&str> {
        self.metadata
            .get("authorization")
            .and_then(|h| h.to_str().ok())
    }

    fn get_header(&self, name: &str) -> Option<&str> {
        self.metadata.get(name).and_then(|h| h.to_str().ok())
    }

    fn method(&self) -> Option<&str> {
        None
    }

    fn uri(&self) -> Option<&str> {
        None
    }

    fn client_ip(&self) -> Option<std::net::IpAddr> {
        self.client_ip
    }
}

/// Trait for authentication providers
#[async_trait::async_trait]
pub trait AuthProvider: Send + Sync {
    /// Validate a request and return authentication context
    async fn validate_request(&self, parts: &dyn RequestParts) -> Result<AuthContext>;
}