vault refactor: move request authorization into gw handler#21688
vault refactor: move request authorization into gw handler#21688prashantkumar1982 merged 6 commits intodevelopfrom
Conversation
|
✅ No conflicts with other open PRs targeting |
prashantkumar1982
changed the title
| func (h *GatewayHandler) handleSecretsCreate(ctx context.Context, gatewayID string, req *jsonrpc.Request[json.RawMessage]) *jsonrpc.Response[json.RawMessage] { | ||
| func (h *GatewayHandler) authorizeAndPrefixRequest(ctx context.Context, req *jsonrpc.Request[json.RawMessage]) (string, error) { | ||
| if h.requestAuthorizer == nil { | ||
| return "", errors.New("request authorizer is nil") |
There was a problem hiding this comment.
Add an error log here
product-security-plaid-production
bot
requested review from
archseer,
patrickhuie19 and
silaslenihan
| } | ||
|
|
||
| func (h *GatewayHandler) handleSecretsList(ctx context.Context, gatewayID string, req *jsonrpc.Request[json.RawMessage]) *jsonrpc.Response[json.RawMessage] { | ||
| func (h *GatewayHandler) handleSecretsList(ctx context.Context, gatewayID string, req *jsonrpc.Request[json.RawMessage], owner string) *jsonrpc.Response[json.RawMessage] { |
There was a problem hiding this comment.
Is there an explainer on the propagation of this field? Would just want to make sure the gateway can't make up an arbitrary owner field and make up secrets.
There was a problem hiding this comment.
This section talks about what gw_handler will do for old and new auth flows: https://docs.google.com/document/d/1NATmKRcTnlMfyDaXwB8hlasOFJz_D7n3IYhYRPq6BUg/edit?tab=t.ryzdzwuy1ylp#heading=h.cnrwnnpd4wxa
In summary, gateway is untrusted. We lookup owner from our auth flows. So the owner will be trusted field after successful auth.
This code is going to be significantly refactored with both old and new flows. But for now, this owner field is derived from our RequestAuthorizer, which validates this owner from the onchain allowlist.
prashantkumar1982
dismissed stale reviews from vreff and cedric-cordenier
via
fe5b15f
|
4 participants
Summary
This refactors Vault node-side request authorization so the gateway handler owns authorization for incoming gateway requests, while the Vault capability stops depending on
RequestAuthorizer.This is so that we can consolidate all auth under a fixed place inside Vault node. After this change, the new jwt auth will also attach at same place, making the auth design cleaner.
What changed
RequestAuthorizerinto the Vault nodegw_handlerand authorize create/update/delete/list requests theregw_handlerafter authorization and enforce owner consistency before calling the secrets serviceRequestAuthorizerplumbing and auth checks from the Vault capability