13657d5bcc
* feat(authz): add authorization client. Add a new authz crate to provide the interface for making authorization checks from within IOx. This includes the default client that uses the influxdata.iox.authz.v1 gRPC protocol. This feature is not used by any IOx component yet. * feat: optional authorization on write path Support optionally enabling authorization checks on the /api/v2/write handler. If an authrorizer is configured then the handler will attempt to retrieve a token from the request's Authorization header. If no such token exists then a response with a 401 error code is returned. If the token is not valid, or does not have write permission for the requested namespace then a response with a 403 error is returned. * chore: add unit test for authz in write handler Add unit tests that test the correct functioning of the /api/v2/write handler when an Authorizer is configured. * chore(authz): use lazy connection Change the initialization of the authz client to use a lazy connection. This allows the client to be initialised synchronously. * chore: Run cargo hakari tasks * fix(authz): protolint complaints * fix: authz tests * fix: benches and lint * chore: Update clap_blocks/src/authz.rs Co-authored-by: Marko Mikulicic <mkm@influxdata.com> * chore: Update authz/src/lib.rs Co-authored-by: Marko Mikulicic <mkm@influxdata.com> * chore: Update clap_blocks/src/authz.rs Co-authored-by: Marko Mikulicic <mkm@influxdata.com> * chore: review suggestions * chore: review suggestions Apply a number of suggestions from review comments. The main behavioural change is that if the authz service is configured applictions will perform a probe request to ensure it can communicate before continuing startup. * chore: Update router/src/server/http.rs Co-authored-by: Dom <dom@itsallbroken.com> --------- Co-authored-by: CircleCI[bot] <circleci@influxdata.com> Co-authored-by: Marko Mikulicic <mkm@influxdata.com> Co-authored-by: Dom <dom@itsallbroken.com> |
||
|---|---|---|
| .. | ||
| src | ||
| Cargo.toml | ||