private sharing handler (#99, #109)

controller/edge.go

@@ -3,17 +3,45 @@ package controller
 import (
 	"context"
 	"fmt"
+	"github.com/openziti-test-kitchen/zrok/build"
+	"github.com/openziti-test-kitchen/zrok/model"
 	"github.com/openziti/edge/rest_management_api_client"
 	"github.com/openziti/edge/rest_management_api_client/config"
 	"github.com/openziti/edge/rest_management_api_client/edge_router_policy"
 	identity_edge "github.com/openziti/edge/rest_management_api_client/identity"
 	"github.com/openziti/edge/rest_management_api_client/service"
+	edge_service "github.com/openziti/edge/rest_management_api_client/service"
 	"github.com/openziti/edge/rest_management_api_client/service_edge_router_policy"
 	"github.com/openziti/edge/rest_management_api_client/service_policy"
+	"github.com/openziti/edge/rest_model"
 	"github.com/sirupsen/logrus"
 	"time"
 )
 
+func createServiceEdgeRouterPolicy(envZId, svcName, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+	edgeRouterRoles := []string{"#all"}
+	semantic := rest_model.SemanticAllOf
+	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
+	serp := &rest_model.ServiceEdgeRouterPolicyCreate{
+		EdgeRouterRoles: edgeRouterRoles,
+		Name:            &svcName,
+		Semantic:        &semantic,
+		ServiceRoles:    serviceRoles,
+		Tags:            zrokTags(svcName),
+	}
+	serpParams := &service_edge_router_policy.CreateServiceEdgeRouterPolicyParams{
+		Policy:  serp,
+		Context: context.Background(),
+	}
+	serpParams.SetTimeout(30 * time.Second)
+	resp, err := edge.ServiceEdgeRouterPolicy.CreateServiceEdgeRouterPolicy(serpParams, nil)
+	if err != nil {
+		return err
+	}
+	logrus.Infof("created service edge router policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
+	return nil
+}
+
 func deleteServiceEdgeRouterPolicy(envZId, svcName string, edge *rest_management_api_client.ZitiEdgeManagement) error {
 	filter := fmt.Sprintf("tags.zrokServiceName=\"%v\"", svcName)
 	limit := int64(1)
@@ -47,11 +75,73 @@ func deleteServiceEdgeRouterPolicy(envZId, svcName string, edge *rest_management
 	return nil
 }
 
+func createServicePolicyBind(envZId, svcName, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+	semantic := rest_model.SemanticAllOf
+	identityRoles := []string{fmt.Sprintf("@%v", envZId)}
+	name := fmt.Sprintf("%v-backend", svcName)
+	var postureCheckRoles []string
+	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
+	dialBind := rest_model.DialBindBind
+	svcp := &rest_model.ServicePolicyCreate{
+		IdentityRoles:     identityRoles,
+		Name:              &name,
+		PostureCheckRoles: postureCheckRoles,
+		Semantic:          &semantic,
+		ServiceRoles:      serviceRoles,
+		Type:              &dialBind,
+		Tags:              zrokTags(svcName),
+	}
+	req := &service_policy.CreateServicePolicyParams{
+		Policy:  svcp,
+		Context: context.Background(),
+	}
+	req.SetTimeout(30 * time.Second)
+	resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
+	if err != nil {
+		return err
+	}
+	logrus.Infof("created bind service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
+	return nil
+}
+
 func deleteServicePolicyBind(envZId, svcName string, edge *rest_management_api_client.ZitiEdgeManagement) error {
 	// type=2 == "Bind"
 	return deleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceName=\"%v\" and type=2", svcName), edge)
 }
 
+func createServicePolicyDial(envZId, svcName, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+	var identityRoles []string
+	for _, proxyIdentity := range cfg.Proxy.Identities {
+		identityRoles = append(identityRoles, "@"+proxyIdentity)
+		logrus.Infof("added proxy identity role '%v'", proxyIdentity)
+	}
+	name := fmt.Sprintf("%v-dial", svcName)
+	var postureCheckRoles []string
+	semantic := rest_model.SemanticAllOf
+	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
+	dialBind := rest_model.DialBindDial
+	svcp := &rest_model.ServicePolicyCreate{
+		IdentityRoles:     identityRoles,
+		Name:              &name,
+		PostureCheckRoles: postureCheckRoles,
+		Semantic:          &semantic,
+		ServiceRoles:      serviceRoles,
+		Type:              &dialBind,
+		Tags:              zrokTags(svcName),
+	}
+	req := &service_policy.CreateServicePolicyParams{
+		Policy:  svcp,
+		Context: context.Background(),
+	}
+	req.SetTimeout(30 * time.Second)
+	resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
+	if err != nil {
+		return err
+	}
+	logrus.Infof("created dial service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
+	return nil
+}
+
 func deleteServicePolicyDial(envZId, svcName string, edge *rest_management_api_client.ZitiEdgeManagement) error {
 	// type=1 == "Dial"
 	return deleteServicePolicy(envZId, fmt.Sprintf("tags.zrokServiceName=\"%v\" and type=1", svcName), edge)
@@ -89,6 +179,39 @@ func deleteServicePolicy(envZId, filter string, edge *rest_management_api_client
 	return nil
 }
 
+func createConfig(envZId, svcName string, authSchemeStr string, authUsers []*model.AuthUser, edge *rest_management_api_client.ZitiEdgeManagement) (cfgID string, err error) {
+	authScheme, err := model.ParseAuthScheme(authSchemeStr)
+	if err != nil {
+		return "", err
+	}
+	cfg := &model.ProxyConfig{
+		AuthScheme: authScheme,
+	}
+	if cfg.AuthScheme == model.Basic {
+		cfg.BasicAuth = &model.BasicAuth{}
+		for _, authUser := range authUsers {
+			cfg.BasicAuth.Users = append(cfg.BasicAuth.Users, &model.AuthUser{Username: authUser.Username, Password: authUser.Password})
+		}
+	}
+	cfgCrt := &rest_model.ConfigCreate{
+		ConfigTypeID: &zrokProxyConfigId,
+		Data:         cfg,
+		Name:         &svcName,
+		Tags:         zrokTags(svcName),
+	}
+	cfgReq := &config.CreateConfigParams{
+		Config:  cfgCrt,
+		Context: context.Background(),
+	}
+	cfgReq.SetTimeout(30 * time.Second)
+	cfgResp, err := edge.Config.CreateConfig(cfgReq, nil)
+	if err != nil {
+		return "", err
+	}
+	logrus.Infof("created config '%v' for environment '%v'", cfgResp.Payload.Data.ID, envZId)
+	return cfgResp.Payload.Data.ID, nil
+}
+
 func deleteConfig(envZId, svcName string, edge *rest_management_api_client.ZitiEdgeManagement) error {
 	filter := fmt.Sprintf("tags.zrokServiceName=\"%v\"", svcName)
 	limit := int64(0)
@@ -119,6 +242,28 @@ func deleteConfig(envZId, svcName string, edge *rest_management_api_client.ZitiE
 	return nil
 }
 
+func createService(envZId, svcName, cfgId string, edge *rest_management_api_client.ZitiEdgeManagement) (serviceId string, err error) {
+	configs := []string{cfgId}
+	encryptionRequired := true
+	svc := &rest_model.ServiceCreate{
+		Configs:            configs,
+		EncryptionRequired: &encryptionRequired,
+		Name:               &svcName,
+		Tags:               zrokTags(svcName),
+	}
+	req := &edge_service.CreateServiceParams{
+		Service: svc,
+		Context: context.Background(),
+	}
+	req.SetTimeout(30 * time.Second)
+	resp, err := edge.Service.CreateService(req, nil)
+	if err != nil {
+		return "", err
+	}
+	logrus.Infof("created zrok service named '%v' (with ziti id '%v') for environment '%v'", svcName, resp.Payload.Data.ID, envZId)
+	return resp.Payload.Data.ID, nil
+}
+
 func deleteService(envZId, svcId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
 	req := &service.DeleteServiceParams{
 		ID:      svcId,
@@ -178,3 +323,12 @@ func deleteIdentity(id string, edge *rest_management_api_client.ZitiEdgeManageme
 	logrus.Infof("deleted environment identity '%v'", id)
 	return nil
 }
+
+func zrokTags(svcName string) *rest_model.Tags {
+	return &rest_model.Tags{
+		SubTags: map[string]interface{}{
+			"zrok":            build.String(),
+			"zrokServiceName": svcName,
+		},
+	}
+}

controller/share.go

@@ -58,7 +58,14 @@ func (h *shareHandler) Handle(params service.ShareParams, principal *rest_model_
 	var frontendEndpoints []string
 	switch params.Body.ShareMode {
 	case "public":
-		svcZId, frontendEndpoints, err = newPublicResourceAllocator().Allocate(envZId, svcName, params, edge)
+		svcZId, frontendEndpoints, err = newPublicResourceAllocator().allocate(envZId, svcName, params, edge)
+		if err != nil {
+			logrus.Error(err)
+			return service.NewShareInternalServerError()
+		}
+
+	case "private":
+		svcZId, frontendEndpoints, err = newPrivateResourceAllocator().allocate(envZId, svcName, params, edge)
 		if err != nil {
 			logrus.Error(err)
 			return service.NewShareInternalServerError()

controller/share_private.go

@@ -0,0 +1,39 @@
+package controller
+
+import (
+	"github.com/openziti-test-kitchen/zrok/model"
+	"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/service"
+	"github.com/openziti/edge/rest_management_api_client"
+)
+
+type privateResourceAllocator struct{}
+
+func newPrivateResourceAllocator() *privateResourceAllocator {
+	return &privateResourceAllocator{}
+}
+
+func (a *privateResourceAllocator) allocate(envZId, svcName string, params service.ShareParams, edge *rest_management_api_client.ZitiEdgeManagement) (svcZId string, frontendEndpoints []string, err error) {
+	var authUsers []*model.AuthUser
+	for _, authUser := range params.Body.AuthUsers {
+		authUsers = append(authUsers, &model.AuthUser{authUser.Username, authUser.Password})
+	}
+	cfgId, err := createConfig(envZId, svcName, params.Body.AuthScheme, authUsers, edge)
+	if err != nil {
+		return "", nil, err
+	}
+
+	svcZId, err = createService(envZId, svcName, cfgId, edge)
+	if err != nil {
+		return "", nil, err
+	}
+
+	if err := createServicePolicyBind(envZId, svcName, svcZId, edge); err != nil {
+		return "", nil, err
+	}
+
+	if err := createServiceEdgeRouterPolicy(envZId, svcName, svcZId, edge); err != nil {
+		return "", nil, err
+	}
+
+	return svcZId, []string{proxyUrl(svcName)}, nil
+}

controller/share_public.go

@@ -1,201 +1,43 @@
 package controller
 
 import (
-	"context"
-	"fmt"
-	"github.com/openziti-test-kitchen/zrok/build"
 	"github.com/openziti-test-kitchen/zrok/model"
 	"github.com/openziti-test-kitchen/zrok/rest_server_zrok/operations/service"
 	"github.com/openziti/edge/rest_management_api_client"
-	"github.com/openziti/edge/rest_management_api_client/config"
-	edge_service "github.com/openziti/edge/rest_management_api_client/service"
-	"github.com/openziti/edge/rest_management_api_client/service_edge_router_policy"
-	"github.com/openziti/edge/rest_management_api_client/service_policy"
-	"github.com/openziti/edge/rest_model"
-	"github.com/sirupsen/logrus"
-	"strings"
-	"time"
 )
 
-type publicResourceAllocator struct {
+type publicResourceAllocator struct{}
-}
 
 func newPublicResourceAllocator() *publicResourceAllocator {
 	return &publicResourceAllocator{}
 }
 
-func (a *publicResourceAllocator) Allocate(envZId, svcName string, params service.ShareParams, edge *rest_management_api_client.ZitiEdgeManagement) (svcZId string, frontendEndpoints []string, err error) {
+func (a *publicResourceAllocator) allocate(envZId, svcName string, params service.ShareParams, edge *rest_management_api_client.ZitiEdgeManagement) (svcZId string, frontendEndpoints []string, err error) {
-	cfgId, err := a.createConfig(envZId, svcName, params, edge)
+	var authUsers []*model.AuthUser
+	for _, authUser := range params.Body.AuthUsers {
+		authUsers = append(authUsers, &model.AuthUser{authUser.Username, authUser.Password})
+	}
+	cfgId, err := createConfig(envZId, svcName, params.Body.AuthScheme, authUsers, edge)
 	if err != nil {
-		logrus.Error(err)
+		return "", nil, err
 	}
-	svcZId, err = a.createService(envZId, svcName, cfgId, edge)
-	if err != nil {
-		logrus.Error(err)
-	}
-	if err := a.createServicePolicyBind(envZId, svcName, svcZId, envZId, edge); err != nil {
-		logrus.Error(err)
-	}
-	if err := a.createServicePolicyDial(envZId, svcName, svcZId, edge); err != nil {
-		logrus.Error(err)
-	}
-	if err := a.createServiceEdgeRouterPolicy(envZId, svcName, svcZId, edge); err != nil {
-		logrus.Error(err)
-	}
-	frontendUrl := a.proxyUrl(svcName)
-	return svcZId, []string{frontendUrl}, nil
-}
 
-func (a *publicResourceAllocator) createConfig(envZId, svcName string, params service.ShareParams, edge *rest_management_api_client.ZitiEdgeManagement) (cfgID string, err error) {
+	svcZId, err = createService(envZId, svcName, cfgId, edge)
-	authScheme, err := model.ParseAuthScheme(params.Body.AuthScheme)
 	if err != nil {
-		return "", err
+		return "", nil, err
 	}
-	cfg := &model.ProxyConfig{
-		AuthScheme: authScheme,
-	}
-	if cfg.AuthScheme == model.Basic {
-		cfg.BasicAuth = &model.BasicAuth{}
-		for _, authUser := range params.Body.AuthUsers {
-			cfg.BasicAuth.Users = append(cfg.BasicAuth.Users, &model.AuthUser{Username: authUser.Username, Password: authUser.Password})
-		}
-	}
-	cfgCrt := &rest_model.ConfigCreate{
-		ConfigTypeID: &zrokProxyConfigId,
-		Data:         cfg,
-		Name:         &svcName,
-		Tags:         a.zrokTags(svcName),
-	}
-	cfgReq := &config.CreateConfigParams{
-		Config:  cfgCrt,
-		Context: context.Background(),
-	}
-	cfgReq.SetTimeout(30 * time.Second)
-	cfgResp, err := edge.Config.CreateConfig(cfgReq, nil)
-	if err != nil {
-		return "", err
-	}
-	logrus.Infof("created config '%v' for environment '%v'", cfgResp.Payload.Data.ID, envZId)
-	return cfgResp.Payload.Data.ID, nil
-}
 
-func (a *publicResourceAllocator) createService(envZId, svcName, cfgId string, edge *rest_management_api_client.ZitiEdgeManagement) (serviceId string, err error) {
+	if err := createServicePolicyBind(envZId, svcName, svcZId, edge); err != nil {
-	configs := []string{cfgId}
+		return "", nil, err
-	encryptionRequired := true
-	svc := &rest_model.ServiceCreate{
-		Configs:            configs,
-		EncryptionRequired: &encryptionRequired,
-		Name:               &svcName,
-		Tags:               a.zrokTags(svcName),
 	}
-	req := &edge_service.CreateServiceParams{
-		Service: svc,
-		Context: context.Background(),
-	}
-	req.SetTimeout(30 * time.Second)
-	resp, err := edge.Service.CreateService(req, nil)
-	if err != nil {
-		return "", err
-	}
-	logrus.Infof("created zrok service named '%v' (with ziti id '%v') for environment '%v'", svcName, resp.Payload.Data.ID, envZId)
-	return resp.Payload.Data.ID, nil
-}
 
-func (a *publicResourceAllocator) createServicePolicyBind(envZId, svcName, svcZId, envId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+	if err := createServicePolicyDial(envZId, svcName, svcZId, edge); err != nil {
-	semantic := rest_model.SemanticAllOf
+		return "", nil, err
-	identityRoles := []string{fmt.Sprintf("@%v", envId)}
-	name := fmt.Sprintf("%v-backend", svcName)
-	var postureCheckRoles []string
-	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
-	dialBind := rest_model.DialBindBind
-	svcp := &rest_model.ServicePolicyCreate{
-		IdentityRoles:     identityRoles,
-		Name:              &name,
-		PostureCheckRoles: postureCheckRoles,
-		Semantic:          &semantic,
-		ServiceRoles:      serviceRoles,
-		Type:              &dialBind,
-		Tags:              a.zrokTags(svcName),
 	}
-	req := &service_policy.CreateServicePolicyParams{
-		Policy:  svcp,
-		Context: context.Background(),
-	}
-	req.SetTimeout(30 * time.Second)
-	resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
-	if err != nil {
-		return err
-	}
-	logrus.Infof("created bind service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
-	return nil
-}
 
-func (a *publicResourceAllocator) createServicePolicyDial(envZId, svcName, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+	if err := createServiceEdgeRouterPolicy(envZId, svcName, svcZId, edge); err != nil {
-	var identityRoles []string
+		return "", nil, err
-	for _, proxyIdentity := range cfg.Proxy.Identities {
-		identityRoles = append(identityRoles, "@"+proxyIdentity)
-		logrus.Infof("added proxy identity role '%v'", proxyIdentity)
 	}
-	name := fmt.Sprintf("%v-dial", svcName)
-	var postureCheckRoles []string
-	semantic := rest_model.SemanticAllOf
-	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
-	dialBind := rest_model.DialBindDial
-	svcp := &rest_model.ServicePolicyCreate{
-		IdentityRoles:     identityRoles,
-		Name:              &name,
-		PostureCheckRoles: postureCheckRoles,
-		Semantic:          &semantic,
-		ServiceRoles:      serviceRoles,
-		Type:              &dialBind,
-		Tags:              a.zrokTags(svcName),
-	}
-	req := &service_policy.CreateServicePolicyParams{
-		Policy:  svcp,
-		Context: context.Background(),
-	}
-	req.SetTimeout(30 * time.Second)
-	resp, err := edge.ServicePolicy.CreateServicePolicy(req, nil)
-	if err != nil {
-		return err
-	}
-	logrus.Infof("created dial service policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
-	return nil
-}
 
-func (a *publicResourceAllocator) createServiceEdgeRouterPolicy(envZId, svcName, svcZId string, edge *rest_management_api_client.ZitiEdgeManagement) error {
+	return svcZId, []string{proxyUrl(svcName)}, nil
-	edgeRouterRoles := []string{"#all"}
-	semantic := rest_model.SemanticAllOf
-	serviceRoles := []string{fmt.Sprintf("@%v", svcZId)}
-	serp := &rest_model.ServiceEdgeRouterPolicyCreate{
-		EdgeRouterRoles: edgeRouterRoles,
-		Name:            &svcName,
-		Semantic:        &semantic,
-		ServiceRoles:    serviceRoles,
-		Tags:            a.zrokTags(svcName),
-	}
-	serpParams := &service_edge_router_policy.CreateServiceEdgeRouterPolicyParams{
-		Policy:  serp,
-		Context: context.Background(),
-	}
-	serpParams.SetTimeout(30 * time.Second)
-	resp, err := edge.ServiceEdgeRouterPolicy.CreateServiceEdgeRouterPolicy(serpParams, nil)
-	if err != nil {
-		return err
-	}
-	logrus.Infof("created service edge router policy '%v' for service '%v' for environment '%v'", resp.Payload.Data.ID, svcZId, envZId)
-	return nil
-}
-
-func (a *publicResourceAllocator) proxyUrl(svcName string) string {
-	return strings.Replace(cfg.Proxy.UrlTemplate, "{svcName}", svcName, -1)
-}
-
-func (a *publicResourceAllocator) zrokTags(svcName string) *rest_model.Tags {
-	return &rest_model.Tags{
-		SubTags: map[string]interface{}{
-			"zrok":            build.String(),
-			"zrokServiceName": svcName,
-		},
-	}
 }

controller/util.go

@@ -89,3 +89,7 @@ func realRemoteAddress(req *http.Request) string {
 	}
 	return ip
 }
+
+func proxyUrl(svcName string) string {
+	return strings.Replace(cfg.Proxy.UrlTemplate, "{svcName}", svcName, -1)
+}