2020-08-13 20:27:42 +00:00
|
|
|
package rpc
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
2020-10-20 05:37:12 +00:00
|
|
|
"fmt"
|
2020-09-03 23:25:56 +00:00
|
|
|
"strings"
|
2020-08-13 20:27:42 +00:00
|
|
|
"sync"
|
|
|
|
|
2021-08-11 18:10:53 +00:00
|
|
|
"github.com/golang-jwt/jwt"
|
2020-08-13 20:27:42 +00:00
|
|
|
"google.golang.org/grpc"
|
|
|
|
"google.golang.org/grpc/codes"
|
|
|
|
"google.golang.org/grpc/metadata"
|
|
|
|
"google.golang.org/grpc/status"
|
|
|
|
)
|
|
|
|
|
|
|
|
// noAuthPaths keeps track of the paths which do not require
|
|
|
|
// authentication from our API.
|
|
|
|
var (
|
|
|
|
noAuthPaths = map[string]bool{
|
2020-12-17 16:26:32 +00:00
|
|
|
"/ethereum.validator.accounts.v2.Auth/Signup": true,
|
|
|
|
"/ethereum.validator.accounts.v2.Auth/Login": true,
|
2020-12-17 19:46:27 +00:00
|
|
|
"/ethereum.validator.accounts.v2.Auth/Logout": true,
|
2020-12-17 16:26:32 +00:00
|
|
|
"/ethereum.validator.accounts.v2.Auth/HasUsedWeb": true,
|
|
|
|
"/ethereum.validator.accounts.v2.Wallet/HasWallet": true,
|
|
|
|
"/ethereum.validator.accounts.v2.Beacon/GetBeaconStatus": true,
|
|
|
|
"/ethereum.validator.accounts.v2.Beacon/GetValidatorParticipation": true,
|
|
|
|
"/ethereum.validator.accounts.v2.Beacon/GetValidatorPerformance": true,
|
|
|
|
"/ethereum.validator.accounts.v2.Beacon/GetValidatorBalances": true,
|
|
|
|
"/ethereum.validator.accounts.v2.Beacon/GetValidators": true,
|
|
|
|
"/ethereum.validator.accounts.v2.Beacon/GetValidatorQueue": true,
|
|
|
|
"/ethereum.validator.accounts.v2.Beacon/GetPeers": true,
|
2020-12-18 18:03:24 +00:00
|
|
|
"/ethereum.validator.accounts.v2.Beacon/StreamValidatorLogs": true,
|
2020-08-13 20:27:42 +00:00
|
|
|
}
|
|
|
|
authLock sync.RWMutex
|
|
|
|
)
|
|
|
|
|
|
|
|
// JWTInterceptor is a gRPC unary interceptor to authorize incoming requests
|
|
|
|
// for methods that are NOT in the noAuthPaths configuration map.
|
|
|
|
func (s *Server) JWTInterceptor() grpc.UnaryServerInterceptor {
|
|
|
|
return func(
|
|
|
|
ctx context.Context,
|
|
|
|
req interface{},
|
|
|
|
info *grpc.UnaryServerInfo,
|
|
|
|
handler grpc.UnaryHandler,
|
|
|
|
) (interface{}, error) {
|
|
|
|
// Skip authorize when the path doesn't require auth.
|
|
|
|
authLock.RLock()
|
|
|
|
shouldAuthenticate := !noAuthPaths[info.FullMethod]
|
|
|
|
authLock.RUnlock()
|
|
|
|
if shouldAuthenticate {
|
|
|
|
if err := s.authorize(ctx); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
h, err := handler(ctx, req)
|
|
|
|
log.Debugf("Request - Method: %s, Error: %v\n", info.FullMethod, err)
|
|
|
|
return h, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Authorize the token received is valid.
|
|
|
|
func (s *Server) authorize(ctx context.Context) error {
|
|
|
|
md, ok := metadata.FromIncomingContext(ctx)
|
|
|
|
if !ok {
|
2020-09-03 23:25:56 +00:00
|
|
|
return status.Errorf(codes.InvalidArgument, "Retrieving metadata failed")
|
2020-08-13 20:27:42 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
authHeader, ok := md["authorization"]
|
|
|
|
if !ok {
|
2020-09-03 23:25:56 +00:00
|
|
|
return status.Errorf(codes.Unauthenticated, "Authorization token could not be found")
|
2020-08-13 20:27:42 +00:00
|
|
|
}
|
2020-09-03 23:25:56 +00:00
|
|
|
if len(authHeader) < 1 || !strings.Contains(authHeader[0], "Bearer ") {
|
|
|
|
return status.Error(codes.Unauthenticated, "Invalid auth header, needs Bearer {token}")
|
|
|
|
}
|
|
|
|
token := strings.Split(authHeader[0], "Bearer ")[1]
|
2020-10-20 05:37:12 +00:00
|
|
|
_, err := jwt.Parse(token, s.validateJWT)
|
2020-08-13 20:27:42 +00:00
|
|
|
if err != nil {
|
2020-10-10 02:07:28 +00:00
|
|
|
return status.Errorf(codes.Unauthenticated, "Could not parse JWT token: %v", err)
|
2020-08-13 20:27:42 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2020-10-20 05:37:12 +00:00
|
|
|
|
|
|
|
func (s *Server) validateJWT(token *jwt.Token) (interface{}, error) {
|
|
|
|
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
|
|
|
|
return nil, fmt.Errorf("unexpected JWT signing method: %v", token.Header["alg"])
|
|
|
|
}
|
|
|
|
return s.jwtKey, nil
|
|
|
|
}
|