add

internal/api/auth.go

@@ -1,16 +1,19 @@
 package api
 
 import (
+	"context"
 	"crypto/rand"
 	"crypto/sha256"
 	"crypto/subtle"
 	"encoding/hex"
 	"errors"
+	"fmt"
 	"net/http"
 	"sync"
 	"time"
 
 	"git.k8s-git-k6n.net/mats/fancy-dns/internal/config"
+	"github.com/coreos/go-oidc/v3/oidc"
 )
 
 // authenticator checks API keys, basic credentials and issued session tokens.
@@ -38,18 +41,34 @@ type authenticator struct {
 	// sessionTTL is how long an issued token stays valid.
 	sessionTTL time.Duration
 	// trustLoopback is informational; the caller checks it.
-	mu       sync.RWMutex
-	sessions map[string]session
+	mu             sync.RWMutex
+	sessions       map[string]session
+	oidcIssuer     string
+	oidcAudience   string
+	oidcClientID   string
+	oidcWriteRoles map[string]bool
+	oidcInitMu     sync.Mutex
+	oidcVerifier   *oidc.IDTokenVerifier
 }
 
 func newAuthenticator(cfg config.Auth) *authenticator {
 	a := &authenticator{
-		mode:       cfg.Mode,
-		readOnly:   make(map[string]string, len(cfg.ReadOnlyAPIKeys)),
-		readWrite:  make(map[string]string, len(cfg.APIKeys)),
-		username:   cfg.Username,
-		sessionTTL: cfg.SessionTTL.D(),
-		sessions:   make(map[string]session),
+		mode:           cfg.Mode,
+		readOnly:       make(map[string]string, len(cfg.ReadOnlyAPIKeys)),
+		readWrite:      make(map[string]string, len(cfg.APIKeys)),
+		username:       cfg.Username,
+		sessionTTL:     cfg.SessionTTL.D(),
+		sessions:       make(map[string]session),
+		oidcIssuer:     cfg.OIDCIssuer,
+		oidcAudience:   cfg.OIDCAudience,
+		oidcClientID:   cfg.OIDCClientID,
+		oidcWriteRoles: make(map[string]bool),
+	}
+	for _, role := range cfg.OIDCWriteRoles {
+		a.oidcWriteRoles[role] = true
+	}
+	if len(a.oidcWriteRoles) == 0 {
+		a.oidcWriteRoles["admin"] = true
 	}
 	for i, k := range cfg.ReadOnlyAPIKeys {
 		if k == "" {
@@ -74,6 +93,68 @@ func newAuthenticator(cfg config.Auth) *authenticator {
 	return a
 }
 
+// oidcPrincipal verifies an RS256 access token against issuer discovery/JWKS.
+// Provider metadata and keys are fetched lazily, then cached by go-oidc.
+func (a *authenticator) oidcPrincipal(raw string) (Principal, error) {
+	if a == nil || a.oidcIssuer == "" || a.oidcAudience == "" {
+		return Principal{}, errors.New("oidc: not configured")
+	}
+	a.oidcInitMu.Lock()
+	if a.oidcVerifier == nil {
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		provider, err := oidc.NewProvider(ctx, a.oidcIssuer)
+		cancel()
+		if err != nil {
+			a.oidcInitMu.Unlock()
+			return Principal{}, fmt.Errorf("oidc discovery: %w", err)
+		}
+		a.oidcVerifier = provider.Verifier(&oidc.Config{ClientID: a.oidcAudience, SupportedSigningAlgs: []string{"RS256"}})
+	}
+	verifier := a.oidcVerifier
+	a.oidcInitMu.Unlock()
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	tok, err := verifier.Verify(ctx, raw)
+	if err != nil {
+		return Principal{}, fmt.Errorf("oidc token: %w", err)
+	}
+	var claims struct {
+		Subject  string   `json:"sub"`
+		TokenUse string   `json:"token_use"`
+		Name     string   `json:"name"`
+		Email    string   `json:"email"`
+		Roles    []string `json:"roles"`
+	}
+	if err := tok.Claims(&claims); err != nil {
+		return Principal{}, err
+	}
+	if claims.Subject == "" || claims.TokenUse != "access" {
+		return Principal{}, errors.New("oidc: token is not an access token")
+	}
+	name := claims.Name
+	if name == "" {
+		name = claims.Email
+	}
+	if name == "" {
+		name = claims.Subject
+	}
+	readOnly := true
+	for _, role := range claims.Roles {
+		if a.oidcWriteRoles[role] {
+			readOnly = false
+			break
+		}
+	}
+	return Principal{Mode: "oidc", Name: name, ReadOnly: readOnly}, nil
+}
+
+func (a *authenticator) OIDCConfig() (issuer, clientID string) {
+	if a == nil || a.mode != "oidc" {
+		return "", ""
+	}
+	return a.oidcIssuer, a.oidcClientID
+}
+
 func keyLabel(kind string, i int) string {
 	return kind + "-" + itoa(i+1)
 }
@@ -290,3 +371,8 @@ func (s *Server) handleWhoami(w http.ResponseWriter, r *http.Request) {
 		"base_path": s.base,
 	})
 }
+
+func (s *Server) handleAuthConfig(w http.ResponseWriter, r *http.Request) {
+	issuer, clientID := s.auth.OIDCConfig()
+	writeJSON(w, http.StatusOK, map[string]string{"mode": s.AuthMode(), "issuer": issuer, "client_id": clientID})
+}