Function DefaultGrpcDialOptions

api/authorizer.go:108–143

DefaultGrpcDialOptions returns a set of sensible default list of grpc.DialOption values. It includes transport credentials and configures per-RPC credentials using an authorizer, if one is configured.

(hostport string, s UsesAuthorizer, additionalOpts ...grpc.DialOption)

// DefaultGrpcDialOptions returns a set of sensible default list of grpc.DialOption values. It includes
// transport credentials and configures per-RPC credentials using an authorizer, if one is configured.
func DefaultGrpcDialOptions(hostport string, s UsesAuthorizer, additionalOpts ...grpc.DialOption) (opts []grpc.DialOption) {
	var (
		port string
		host string
		err  error
	)

	host, port, err = net.SplitHostPort(hostport)

	// TODO(oxisto): make a better distinction, for now this is ok
	if err == nil && port == "443" {
		// Use default TLS configuration using the system cert store
		opts = append(opts, grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
			ServerName: host,
			MinVersion: tls.VersionTLS12,
			MaxVersion: 0,
		})))
	} else {
		opts = append(opts, grpc.WithTransportCredentials(insecure.NewCredentials()))
	}

	// In practice, we should always have an authorizer, so we could fail early here. However,
	// if the server-side has not enabled the auth middleware (for example in testing), it is perfectly
	// fine to at least attempt to run it without one. If the server-side has enabled auth middleware
	// and does not receive any client credentials, the actual RPC call will then fail later.
	if s != nil {
		if authorizer := s.Authorizer(); authorizer != nil {
			opts = append(opts, grpc.WithPerRPCCredentials(authorizer))
		}
	}

	// Apply any additional options that we might have
	opts = append(opts, additionalOpts...)

	return opts
}