Implement POC for RBAC

api/main.go

@@ -37,6 +37,8 @@ func Start() {
 	r.GET("/mfa", HandleGetMFAFlow)
 	r.POST("/mfa", HandlePostMFAFlow)
 
+	r.GET("/rbac", middleware.CheckIfAllowed, HandleRbac)
+
 	r.POST("/create-identity", c.CreateIdentity)
 	r.GET("/get-identity", c.GetIdentity)
 	r.POST("/delete-identity", c.DeleteIdentity)

api/rbac.go

@@ -0,0 +1,67 @@
+package api
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	client "github.com/ory/client-go"
+
+	"github.com/sdslabs/nymeria/config"
+	"github.com/sdslabs/nymeria/log"
+	"github.com/sdslabs/nymeria/pkg/wrapper/keto"
+)
+
+func HandleRbac(c *gin.Context) {
+	log.Logger.Debug("RBAC")
+	cookie, err := c.Cookie("sdslabs_session")
+
+	if err != nil {
+		log.ErrorLogger("Session cookie not found", err)
+		errCode, _ := strconv.Atoi(strings.Split(err.Error(), " ")[0])
+		c.JSON(errCode, gin.H{
+			"error":   err.Error(),
+			"message": "Initialize Rbac failed.",
+		})
+		return
+	}
+
+	apiClient := client.NewAPIClient(config.KratosClientConfig)
+	session, _, err := apiClient.V0alpha2Api.ToSession(context.Background()).Cookie(cookie).Execute()
+	if err != nil {
+		log.ErrorLogger("Invalid Cookie", err)
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"error":   err.Error(),
+			"message": "Initialize Rbac failed.",
+		})
+		return
+	}
+
+	identity := session.GetIdentity()
+	traits := identity.GetTraits()
+	role := traits.(map[string]interface{})["role"]
+
+	data := map[string]interface{}{
+		"namespace": "accounts",
+		"relation": "view",
+		"subject_id": role,
+	}
+
+	res, err := keto.MakeRequest(keto.QueryRelationshipsEndpoint, data)
+	if err != nil {
+		log.ErrorLogger("Error in making request to keto", err)
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"error":   err.Error(),
+			"message": "Creating relationship failed.",
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "RBAC passed",
+		"role":    role,
+		"res":     res,
+	})
+}

config.sample.yaml

@@ -4,6 +4,8 @@ url:
     frontend_url: "http://localhost:4455"
     kratos_url: "http://localhost:4433"
     domain: "https://someaddress.com"
+    keto_read_url: "http://localhost:4466"
+    keto_write_url: "http://localhost:4467"
 
 db:
     dsn: ""

config/keto.go

@@ -0,0 +1,29 @@
+package config
+
+import (
+	client "github.com/ory/client-go"
+)
+
+func getKetoClientConfig() (*client.Configuration, *client.Configuration) {
+	readConfiguration := client.NewConfiguration()
+	readConfiguration.Servers = []client.ServerConfiguration{
+		{
+			URL: NymeriaConfig.URL.KetoReadURL,
+		},
+	}
+
+	writeConfiguration := client.NewConfiguration()
+	writeConfiguration.Servers = []client.ServerConfiguration{
+		{
+			URL: NymeriaConfig.URL.KetoWriteURL,
+		},
+	}
+
+	return readConfiguration, writeConfiguration
+}
+
+var (
+	KetoReadConfig, KetoWriteConfig = getKetoClientConfig()
+	KetoReadURL                     = NymeriaConfig.URL.KetoReadURL
+	KetoWriteURL                    = NymeriaConfig.URL.KetoWriteURL
+)

config/types.go

@@ -6,9 +6,11 @@ type NymeriaCfg struct {
 	DB  DB     `yaml:"db"`
 }
 type URL struct {
-	FrontendURL string `yaml:"frontend_url"`
-	KratosURL   string `yaml:"kratos_url"`
-	Domain      string `yaml:"domain"`
+	FrontendURL  string `yaml:"frontend_url"`
+	KratosURL    string `yaml:"kratos_url"`
+	KetoReadURL  string `yaml:"keto_read_url"`
+	KetoWriteURL string `yaml:"keto_write_url"`
+	Domain       string `yaml:"domain"`
 }
 
 type DB struct {

go.mod

@@ -15,27 +15,31 @@ require (
 require (
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/rogpeppe/go-internal v1.9.0 // indirect
-	github.com/stretchr/testify v1.8.1 // indirect
+	github.com/stretchr/testify v1.8.4 // indirect
 )
 
 require (
 	github.com/gin-contrib/sse v0.1.0 // indirect
 	github.com/go-playground/locales v0.14.0 // indirect
 	github.com/go-playground/universal-translator v0.18.0 // indirect
 	github.com/go-playground/validator/v10 v10.11.0 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/leodido/go-urn v1.2.1 // indirect
 	github.com/mattn/go-isatty v0.0.16 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/ory/keto/proto v0.11.1-alpha.0 // indirect
+	github.com/ory/keto/proto/ory/keto/acl/v1alpha1 v0.0.0-20210616104402-80e043246cf9 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.5 // indirect
 	github.com/ugorji/go/codec v1.2.7 // indirect
-	golang.org/x/crypto v0.1.0 // indirect
-	golang.org/x/net v0.3.0 // indirect
-	golang.org/x/oauth2 v0.3.0 // indirect
-	golang.org/x/sys v0.3.0 // indirect
-	golang.org/x/text v0.5.0 // indirect
+	golang.org/x/crypto v0.16.0 // indirect
+	golang.org/x/net v0.19.0 // indirect
+	golang.org/x/oauth2 v0.15.0 // indirect
+	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	google.golang.org/genproto v0.0.0-20230131230820-1c016267d619 // indirect
+	google.golang.org/grpc v1.52.3 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
 )