(fullMethod string)
| 363 | } |
| 364 | |
| 365 | func getAuthContext(fullMethod string) (*common.AuthContext, error) { |
| 366 | methodTokens := strings.Split(fullMethod, "/") |
| 367 | if len(methodTokens) != 3 { |
| 368 | return nil, errs.Errorf("invalid full method name %q", fullMethod) |
| 369 | } |
| 370 | rd, err := protoregistry.GlobalFiles.FindDescriptorByName(protoreflect.FullName(methodTokens[1])) |
| 371 | if err != nil { |
| 372 | return nil, errs.Wrapf(err, "invalid registry service descriptor, full method name %q", fullMethod) |
| 373 | } |
| 374 | sd, ok := rd.(protoreflect.ServiceDescriptor) |
| 375 | if !ok { |
| 376 | return nil, errs.Errorf("invalid service descriptor, full method name %q", fullMethod) |
| 377 | } |
| 378 | md, ok := sd.Methods().ByName(protoreflect.Name(methodTokens[2])).Options().(*descriptorpb.MethodOptions) |
| 379 | if !ok { |
| 380 | return nil, errs.Errorf("invalid method options, full method name %q", fullMethod) |
| 381 | } |
| 382 | allowWithoutCredentialAny := proto.GetExtension(md, v1pb.E_AllowWithoutCredential) |
| 383 | allowWithoutCredential, ok := allowWithoutCredentialAny.(bool) |
| 384 | if !ok { |
| 385 | return nil, errs.Errorf("invalid allow without credential extension, full method name %q", fullMethod) |
| 386 | } |
| 387 | permissionAny := proto.GetExtension(md, v1pb.E_Permission) |
| 388 | permission, ok := permissionAny.(string) |
| 389 | if !ok { |
| 390 | return nil, errs.Errorf("invalid permission extension, full method name %q", fullMethod) |
| 391 | } |
| 392 | authMethodAny := proto.GetExtension(md, v1pb.E_AuthMethod) |
| 393 | am, ok := authMethodAny.(v1pb.AuthMethod) |
| 394 | if !ok { |
| 395 | return nil, errs.Errorf("invalid auth method extension, full method name %q", fullMethod) |
| 396 | } |
| 397 | var authMethod common.AuthMethod |
| 398 | switch am { |
| 399 | case v1pb.AuthMethod_AUTH_METHOD_UNSPECIFIED: |
| 400 | authMethod = common.AuthMethodUnspecified |
| 401 | case v1pb.AuthMethod_IAM: |
| 402 | authMethod = common.AuthMethodIAM |
| 403 | case v1pb.AuthMethod_CUSTOM: |
| 404 | authMethod = common.AuthMethodCustom |
| 405 | default: |
| 406 | return nil, errs.Errorf("unknown auth method %v for full method name %q", am, fullMethod) |
| 407 | } |
| 408 | auditAny := proto.GetExtension(md, v1pb.E_Audit) |
| 409 | audit, ok := auditAny.(bool) |
| 410 | if !ok { |
| 411 | return nil, errs.Errorf("invalid audit extension, full method name %q", fullMethod) |
| 412 | } |
| 413 | |
| 414 | return &common.AuthContext{ |
| 415 | AllowWithoutCredential: allowWithoutCredential, |
| 416 | Permission: permission, |
| 417 | AuthMethod: authMethod, |
| 418 | Audit: audit, |
| 419 | }, nil |
| 420 | } |
no test coverage detected