MG-2048 - Authorize clients and users with PATs

[nyagamunene]

What type of PR is this?

This is a feature because it adds the following functionality: It adds authorization to things and users using PATs.

What does this do?

It adds PATs authorization to things and users middleware

Which issue(s) does this PR fix/relate to?

• Related Issue Implement Personal Access Tokens (PATs) #2048
• Resolves #

Have you included tests for your changes?

Yes

Did you document any new/modified feature?

No

Notes

[arvindh123]

Suggested change

	Domain: session.DomainID,
	if err := am.extAuthorize(ctx, clients.GroupOpSetChildClient, authz.PolicyReq{

[arvindh123]

Suggested change

	Domain: session.DomainID,
	if err := am.extAuthorize(ctx, clients.GroupOpSetChildClient, authz.PolicyReq{
	Domain: session.DomainID,

[arvindh123]

This can be done in auth service, During authentication process.
Is there any reason behind this ?

[arvindh123]

Lets have seperate RPC for PAT Authentication like PAT,

[arvindh123]

Please remove this endpoint, For now we can provide authoirzePAT via gRPC only.

[arvindh123]

Move this logic to Authenticate function in file pkg/authn/authsvc/authn.go

Lets have seperate RPC for IdentifyPAT.

The Authenticate function in file pkg/authn/authsvc/authn.go will call IdentifyPAT base on token prefix

[arvindh123]

Lets have seperate RPC call IdentifyPAT, move the logic to here

Something like below code

Suggested change

	}
	return authn.Session{DomainUserID: res.GetId(), UserID: res.GetUserId(), DomainID: res.GetDomainId()}, nil
	return authn.Session{ID: res.GetId(), UserID: res.GetUserId(), DomainID: res.GetDomainId()}, nil
	}
	switch {
	case strings.HasPrefix(token, patPrefix+patSecretSeparator):
	res, err := a.authSvcClient.AuthenticatePAT(ctx, token)
	if err != nil {
	return authn.Session{}, errors.Wrap(errors.ErrAuthentication, err)
	}
	return authn.Session{ID: res.GetId(), UserID: res.GetUserId(), DomainID: res.GetDomainId()}, nil
	default:
	res, err := a.authSvcClient.Authenticate(ctx, &grpcAuthV1.AuthNReq{Token: token})
	if err != nil {
	return authn.Session{}, errors.Wrap(errors.ErrAuthentication, err)
	}
	return authn.Session{ID: res.GetId(), UserID: res.GetUserId(), DomainID: res.GetDomainId()}, nil
	}

[arvindh123]

Do PAT Authorization before checkAdmin or UserAuthz

[codecov]

Codecov Report

Attention: Patch coverage is 0.29499% with 338 lines in your changes missing coverage. Please review.

Project coverage is 41.94%. Comparing base (e95d1bf) to head (2c719f6).

Files with missing lines	Patch %	Lines
users/middleware/authorization.go	0.00%	185 Missing ⚠️
clients/middleware/authorization.go	0.00%	152 Missing ⚠️
auth/tracing/tracing.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2499      +/-   ##
==========================================
- Coverage   43.38%   41.94%   -1.45%     
==========================================
  Files         398      326      -72     
  Lines       51476    44094    -7382     
==========================================
- Hits        22335    18496    -3839     
+ Misses      26951    24219    -2732     
+ Partials     2190     1379     -811     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.