forked from wallarm/api-firewall
-
Notifications
You must be signed in to change notification settings - Fork 0
/
routes.go
96 lines (80 loc) · 2.95 KB
/
routes.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
package proxy
import (
"crypto/rsa"
"net/url"
"os"
"path"
"strings"
"github.com/golang-jwt/jwt"
"github.com/karlseguin/ccache/v2"
"github.com/mango19970707/api-firewall/inner/config"
"github.com/mango19970707/api-firewall/inner/mid"
"github.com/mango19970707/api-firewall/inner/platform/denylist"
woauth2 "github.com/mango19970707/api-firewall/inner/platform/oauth2"
"github.com/mango19970707/api-firewall/inner/platform/proxy"
"github.com/mango19970707/api-firewall/inner/platform/router"
"github.com/mango19970707/api-firewall/inner/platform/web"
"github.com/sirupsen/logrus"
"github.com/valyala/fasthttp"
"github.com/valyala/fastjson"
)
func Handlers(cfg *config.APIFWConfiguration, serverURL *url.URL, shutdown chan os.Signal, logger *logrus.Logger, proxy proxy.Pool, swagRouter *router.Router, deniedTokens *denylist.DeniedTokens) fasthttp.RequestHandler {
// define FastJSON parsers pool
var parserPool fastjson.ParserPool
// Init OAuth validator
var oauthValidator woauth2.OAuth2
switch strings.ToLower(cfg.Server.Oauth.ValidationType) {
case "jwt":
var key *rsa.PublicKey
if strings.HasPrefix(strings.ToLower(cfg.Server.Oauth.JWT.SignatureAlgorithm), "rs") && cfg.Server.Oauth.JWT.PubCertFile != "" {
verifyBytes, err := os.ReadFile(cfg.Server.Oauth.JWT.PubCertFile)
if err != nil {
logger.Errorf("Error reading public key from file: %s", err)
break
}
key, err = jwt.ParseRSAPublicKeyFromPEM(verifyBytes)
if err != nil {
logger.Errorf("Error parsing public key: %s", err)
break
}
logger.Infof("OAuth2: public certificate successfully loaded")
}
oauthValidator = &woauth2.JWT{
Cfg: &cfg.Server.Oauth,
Logger: logger,
PubKey: key,
SecretKey: []byte(cfg.Server.Oauth.JWT.SecretKey),
}
case "introspection":
oauthValidator = &woauth2.Introspection{
Cfg: &cfg.Server.Oauth,
Logger: logger,
Cache: ccache.New(ccache.Configure()),
}
}
// Construct the web.App which holds all routes as well as common Middleware.
app := web.NewApp(shutdown, cfg, logger, mid.Logger(logger), mid.Errors(logger), mid.Panics(logger), mid.Proxy(cfg, serverURL), mid.Denylist(cfg, deniedTokens, logger), mid.ShadowAPIMonitor(logger, &cfg.ShadowAPI))
for i := 0; i < len(swagRouter.Routes); i++ {
s := openapiWaf{
customRoute: &swagRouter.Routes[i],
proxyPool: proxy,
logger: logger,
cfg: cfg,
parserPool: &parserPool,
oauthValidator: oauthValidator,
}
updRoutePath := path.Join(serverURL.Path, swagRouter.Routes[i].Path)
s.logger.Debugf("handler: Loaded path %s - %s", swagRouter.Routes[i].Method, updRoutePath)
app.Handle(swagRouter.Routes[i].Method, updRoutePath, s.openapiWafHandler)
}
// set handler for default behavior (404, 405)
s := openapiWaf{
customRoute: nil,
proxyPool: proxy,
logger: logger,
cfg: cfg,
parserPool: &parserPool,
}
app.SetDefaultBehavior(s.openapiWafHandler)
return app.Router.Handler
}