services/role/roled/internal/discharger.go

// Copyright 2015 The Vanadium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package internal

import (
	"time"

	"v.io/v23"
	"v.io/v23/context"
	"v.io/v23/rpc"
	"v.io/v23/security"
	"v.io/v23/verror"

	"v.io/x/ref/services/discharger"

	"v.io/x/lib/vlog"
)

func init() {
	security.RegisterCaveatValidator(LoggingCaveat, func(_ *context.T, _ security.Call, params []string) error {
		vlog.Infof("Params: %#v", params)
		return nil
	})

}

type dischargerImpl struct {
	serverConfig *serverConfig
}

func (dischargerImpl) Discharge(ctx *context.T, call rpc.ServerCall, caveat security.Caveat, impetus security.DischargeImpetus) (security.Discharge, error) {
	details := caveat.ThirdPartyDetails()
	if details == nil {
		return security.Discharge{}, discharger.NewErrNotAThirdPartyCaveat(ctx, caveat)
	}
	if err := details.Dischargeable(ctx, call.Security()); err != nil {
		return security.Discharge{}, err
	}
	// TODO(rthellend,ashankar): Do proper logging when the API allows it.
	vlog.Infof("Discharge() impetus: %#v", impetus)

	expiry, err := security.NewExpiryCaveat(time.Now().Add(5 * time.Minute))
	if err != nil {
		return security.Discharge{}, verror.Convert(verror.ErrInternal, ctx, err)
	}
	// Bind the discharge to precisely the purpose the requestor claims it will be used.
	method, err := security.NewMethodCaveat(impetus.Method)
	if err != nil {
		return security.Discharge{}, verror.Convert(verror.ErrInternal, ctx, err)
	}
	peer, err := security.NewCaveat(security.PeerBlessingsCaveat, impetus.Server)
	if err != nil {
		return security.Discharge{}, verror.Convert(verror.ErrInternal, ctx, err)
	}
	discharge, err := v23.GetPrincipal(ctx).MintDischarge(caveat, expiry, method, peer)
	if err != nil {
		return security.Discharge{}, verror.Convert(verror.ErrInternal, ctx, err)
	}
	return discharge, nil
}

func (d *dischargerImpl) GlobChildren__(ctx *context.T, call rpc.ServerCall) (<-chan string, error) {
	return globChildren(ctx, call.Security(), d.serverConfig)
}