Function craftMiddleware

app/controlplane/internal/server/grpc.go:186–282

(opts *Opts)

}

func craftMiddleware(opts *Opts) []middleware.Middleware {
	middlewares := []middleware.Middleware{
		recovery.Recovery(
			recovery.WithHandler(func(_ context.Context, req, err interface{}) error {
				sentry.CaptureMessage(fmt.Sprintf("%v", err))
				return errors.InternalServer("internal error", "there was an internal error")
			}),
		),
		logging.Server(opts.Logger),
	}

	logHelper := log.NewHelper(opts.Logger)

	// User authentication
	middlewares = append(middlewares,
		usercontext.Prometheus(),
		// If we require a logged in user we
		selector.Server(
			// 1 - Extract the currentUser/API token from the JWT
			// NOTE: this works because both currentUser and API tokens JWT use the same signing method and secret
			jwtMiddleware.Server(func(_ *jwt.Token) (interface{}, error) {
				return []byte(opts.AuthConfig.GeneratedJwsHmacSecret), nil
			},
				jwtMiddleware.WithSigningMethod(user.SigningMethod),
			),
			// 2.a - Set its API token and organization as alternative to the user
			usercontext.WithCurrentAPITokenAndOrgMiddleware(opts.APITokenUseCase, opts.OrganizationUseCase, logHelper),
			// 2.b - Update API Token last usage
			usercontext.WithAPITokenUsageUpdater(opts.APITokenUseCase, logHelper),
			// 2.c - Set its user
			usercontext.WithCurrentUserMiddleware(opts.UserUseCase, logHelper),
			// Store all memberships in the context
			usercontext.WithCurrentMembershipsMiddleware(opts.MembershipUseCase, opts.MembershipsCache),
			// Operation authorization forward
			usercontext.WithOperationAuthorizationMiddleware(opts.OperationAuthConfig, logHelper),
			selector.Server(
				// 2.d- Set its organization
				usercontext.WithCurrentOrganizationMiddleware(opts.UserUseCase, opts.OrganizationUseCase, logHelper),
				// 2.e- Block all operations on suspended orgs
				usercontext.WithSuspensionMiddleware(),
				// 3 - Check user/token authorization
				authzMiddleware.WithAuthzMiddleware(opts.AuthzUseCase, logHelper),
			).Match(requireAllButOrganizationOperationsMatcher()).Build(),
			// 4 - Make sure the account is fully functional
			selector.Server(
				usercontext.CheckUserHasAccess(opts.AuthConfig.AllowList, opts.UserUseCase),
			).Match(allowListEnabled()).Build(),
			selector.Server(
				usercontext.ValidateCASBackend(opts.CASBackendUseCase),
			).Match(requireFullyConfiguredOrgMatcher()).Build(),
		).Match(requireCurrentUserMatcher()).Build(),
	)

	// attestation branch
	middlewares = append(middlewares,
		// if we require a robot account
		selector.Server(
			// 1 - Extract information from the JWT by using the claims