mirror of
https://github.com/versity/versitygw.git
synced 2026-09-28 18:55:54 +00:00
feat: add AWS-compatible standalone IAM service
Closes #1640 Add a standalone AWS IAM Query API implementation for managing IAM users through standard AWS SDKs and the AWS CLI. Server usage Start the IAM server with internal file-backed storage: mkdir -p /tmp/versitygw-iam ./versitygw --port 127.0.0.1:7070 --access user --secret pass iam --dir /tmp/versitygw-iam Start the IAM server with Vault KV v2 storage using AppRole: VGW_IAM_VAULT_ROLE_SECRET=<role-secret> ./versitygw --port 127.0.0.1:7070 --access user --secret pass iam --vault-endpoint-url http://127.0.0.1:8200 --vault-auth-method approle --vault-role-id <role-id> --vault-mount-path kv --vault-secret-storage-path iam Vault authentication also supports root tokens, separate authentication and secret-storage namespaces, custom mount paths, server certificate validation, and mutual TLS client certificates. Configure the AWS CLI credentials used by the IAM server: export AWS_ACCESS_KEY_ID=user export AWS_SECRET_ACCESS_KEY=pass export AWS_DEFAULT_REGION=us-east-1 Implemented IAM actions CreateUser creates an IAM user with an AWS-compatible ARN, generated AIDA user ID, creation timestamp, optional path, and tags. It validates usernames, paths, tag limits, reserved tag prefixes, duplicate tag keys, and existing users. aws --endpoint-url http://127.0.0.1:7070 iam create-user --user-name bob aws --endpoint-url http://127.0.0.1:7070 iam create-user --user-name bob --path /engineering/ --tags Key=team,Value=storage GetUser returns a stored user or the root identity when requested without a username through the IAM Query API. aws --endpoint-url http://127.0.0.1:7070 iam get-user --user-name bob ListUsers returns users in deterministic username order and supports path filtering, marker-based pagination, and MaxItems limits. aws --endpoint-url http://127.0.0.1:7070 iam list-users aws --endpoint-url http://127.0.0.1:7070 iam list-users --path-prefix /engineering/ --max-items 100 UpdateUser updates the username and/or path, recalculates the user ARN, and rejects conflicts with existing users. aws --endpoint-url http://127.0.0.1:7070 iam update-user --user-name bob --new-user-name robert --new-path /platform/ DeleteUser permanently removes an IAM user and returns AWS-compatible errors for missing users. aws --endpoint-url http://127.0.0.1:7070 iam delete-user --user-name robert IAM protocol and authentication - Support the AWS IAM Query protocol version 2010-05-08 over GET and POST form requests. - Return AWS-compatible XML responses, error documents, status codes, request IDs, user metadata, and pagination fields. - Authenticate root credentials with AWS Signature Version 4 for the IAM service in us-east-1. - Support both Authorization-header and query-string SigV4 authentication. - Validate credential scope, signed headers, timestamps, clock skew, content length, signatures, and unsupported signature or session-token modes. - Add IAM-specific validation and error mapping for malformed requests, invalid actions, duplicate entities, missing users, throttling, and internal failures. Storage implementations - Add an internal JSON-backed store using iam.json and iam.json.backup with atomic temporary-file replacement, concurrent access protection, stable ordering, pagination, and persistence across restarts. - Add a Vault KV v2 store with one secret per user, CAS-based duplicate protection, permanent deletion, AppRole reauthentication, namespace support, configurable authentication and KV mounts, root-token authentication, and TLS/mTLS configuration. - Introduce a common Storer interface and require exactly one storage backend to be configured. Server and embedding support - Register the new `versitygw iam` command with environment-variable and CLI configuration for both storage backends. - Add `embedgw.RunIAMAPI` and `IAMConfig` for embedding the IAM service in Go applications. Gateway-level internal packages - Add `internal/iamstore` as a reusable generic file-backed IAM persistence engine and migrate the existing gateway internal IAM service to it. - Add `internal/sigv4auth` for shared SigV4 header and presigned-query parsing, canonical request generation, signature verification, and structured authentication errors. - Refactor the S3 authentication paths to use the shared SigV4 implementation while preserving S3-specific error responses. - Add `internal/httpctx` for shared Fiber context keys and AWS-style request ID handling. - Add `internal/routekit` for shared query, form, and header route matchers. - Add `internal/netutil` for reusable certificate storage, hostname-aware listeners, multi-address serving, TLS listeners, and UNIX socket handling. - Update the custom SigV4 signer to honor an explicitly supplied signed-header list so unrelated headers do not alter IAM signatures. Testing and CI - Add AWS IAM SDK-based integration coverage for all supported user actions, header authentication, query authentication, validation, errors, filtering, and pagination. - Split standalone IAM tests into `versitygw test iam` and retain existing gateway IAM tests under `versitygw test gw-iam`. - Add unit coverage for controllers, authentication, routing, storage, embedding, listeners, request matching, persistence, and signing behavior. - Add `runiamtests.sh` to exercise internal storage over HTTP and HTTPS plus Vault storage through AppRole. - Add a dedicated IAM functional-test workflow with a Vault service and merged runtime coverage reporting. - Include the IAM test runner in shellcheck and add the AWS IAM SDK dependency.
This commit is contained in:
niksis02
@@ -0,0 +1,258 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package iammiddleware
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/gofiber/fiber/v3"
|
||||
"github.com/versity/versitygw/iamapi/iamerr"
|
||||
"github.com/versity/versitygw/internal/sigv4auth"
|
||||
)
|
||||
|
||||
const (
|
||||
SigningRegion = "us-east-1"
|
||||
timeExpiration = 15 * time.Minute
|
||||
)
|
||||
|
||||
var requiredSignedHeaders = []string{"host"}
|
||||
|
||||
type RootCredentials struct {
|
||||
Access string
|
||||
Secret string
|
||||
}
|
||||
|
||||
func VerifyIAMAuth(root *RootCredentials) fiber.Handler {
|
||||
return func(ctx fiber.Ctx) error {
|
||||
authData, tdate, queryAuth, err := parseIAMAuth(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if authData.Access != root.Access {
|
||||
return iamerr.GetAPIError(iamerr.ErrInvalidClientTokenID)
|
||||
}
|
||||
|
||||
contentLength, err := parseContentLength(ctx.Get("Content-Length"))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
payloadHash := sigv4auth.PayloadSHA256Hex(ctx.BodyRaw())
|
||||
if queryAuth {
|
||||
_, err = sigv4auth.CheckQuerySignature(ctx, authData, root.Secret, payloadHash, tdate, contentLength, sigv4auth.CheckOptions{
|
||||
Service: sigv4auth.ServiceIAM,
|
||||
RequiredSignedHeaders: requiredSignedHeaders,
|
||||
})
|
||||
} else {
|
||||
_, err = sigv4auth.CheckSignature(ctx, authData, root.Secret, payloadHash, tdate, contentLength, sigv4auth.CheckOptions{
|
||||
Service: sigv4auth.ServiceIAM,
|
||||
RequiredSignedHeaders: requiredSignedHeaders,
|
||||
})
|
||||
}
|
||||
if err != nil {
|
||||
return mapIAMSigV4Error(err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
func parseIAMAuth(ctx fiber.Ctx) (sigv4auth.AuthData, time.Time, bool, error) {
|
||||
if sigv4auth.IsQueryAuth(ctx) {
|
||||
return parseIAMQueryAuth(ctx)
|
||||
}
|
||||
if sigv4auth.IsQueryAuthV2(ctx) {
|
||||
return sigv4auth.AuthData{}, time.Time{}, false, iamerr.GetAPIError(iamerr.ErrUnsupportedSignatureVersion)
|
||||
}
|
||||
|
||||
return parseIAMHeaderAuth(ctx)
|
||||
}
|
||||
|
||||
func parseIAMHeaderAuth(ctx fiber.Ctx) (sigv4auth.AuthData, time.Time, bool, error) {
|
||||
authData := sigv4auth.AuthData{}
|
||||
|
||||
authorization := ctx.Get("Authorization")
|
||||
if authorization == "" {
|
||||
return authData, time.Time{}, false, iamerr.GetAPIError(iamerr.ErrMissingAuthenticationToken)
|
||||
}
|
||||
|
||||
date := ctx.Get("X-Amz-Date")
|
||||
if date == "" {
|
||||
date = ctx.Get("Date")
|
||||
}
|
||||
if date == "" {
|
||||
return authData, time.Time{}, false, iamerr.IncompleteSignatureMissingDate(authorization)
|
||||
}
|
||||
|
||||
tdate, err := time.Parse(sigv4auth.ISO8601Format, date)
|
||||
if err != nil {
|
||||
return authData, time.Time{}, false, iamerr.IncompleteSignatureInvalidXAmzDate(date)
|
||||
}
|
||||
if err := ValidateDateAt(tdate, time.Now().UTC()); err != nil {
|
||||
return authData, time.Time{}, false, err
|
||||
}
|
||||
|
||||
authData, err = sigv4auth.ParseAuthorization(authorization, sigv4auth.ServiceIAM)
|
||||
if err != nil {
|
||||
return authData, time.Time{}, false, mapIAMSigV4Error(err, authorization)
|
||||
}
|
||||
|
||||
if authData.Region != SigningRegion {
|
||||
return authData, time.Time{}, false, iamerr.GetAPIError(iamerr.ErrInvalidRegion)
|
||||
}
|
||||
if date[:8] != authData.Date {
|
||||
return authData, time.Time{}, false, iamerr.GetAPIError(iamerr.ErrInvalidCredentialDate)
|
||||
}
|
||||
|
||||
return authData, tdate, false, nil
|
||||
}
|
||||
|
||||
func parseIAMQueryAuth(ctx fiber.Ctx) (sigv4auth.AuthData, time.Time, bool, error) {
|
||||
if ctx.Request().URI().QueryArgs().Has(sigv4auth.QuerySecurityToken) {
|
||||
return sigv4auth.AuthData{}, time.Time{}, true, mapIAMSigV4Error(&sigv4auth.QueryError{Kind: sigv4auth.ErrQuerySecurityToken})
|
||||
}
|
||||
|
||||
authData, details, err := sigv4auth.ParseQueryAuthorization(ctx, sigv4auth.QueryAuthOptions{
|
||||
Service: sigv4auth.ServiceIAM,
|
||||
Region: SigningRegion,
|
||||
})
|
||||
if err != nil {
|
||||
return authData, time.Time{}, true, mapIAMSigV4Error(err)
|
||||
}
|
||||
if err := ValidateDateAt(details.SigningTime, time.Now().UTC()); err != nil {
|
||||
return authData, time.Time{}, true, err
|
||||
}
|
||||
|
||||
return authData, details.SigningTime, true, nil
|
||||
}
|
||||
|
||||
func parseContentLength(contentLengthStr string) (int64, error) {
|
||||
if contentLengthStr == "" {
|
||||
return 0, nil
|
||||
}
|
||||
|
||||
contentLength, err := strconv.ParseInt(contentLengthStr, 10, 64)
|
||||
if err != nil {
|
||||
return 0, iamerr.GetAPIError(iamerr.ErrInvalidContentLength)
|
||||
}
|
||||
|
||||
return contentLength, nil
|
||||
}
|
||||
|
||||
// ValidateDateAt checks that date is within the allowed window relative to now.
|
||||
// Exported so tests can exercise it directly.
|
||||
func ValidateDateAt(date, now time.Time) error {
|
||||
if date.After(now.Add(timeExpiration)) {
|
||||
return iamerr.SignatureDoesNotMatchNotYetCurrent(date, now, timeExpiration)
|
||||
}
|
||||
if date.Before(now.Add(-timeExpiration)) {
|
||||
return iamerr.SignatureDoesNotMatchExpired(date, now, timeExpiration)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func mapIAMSigV4Error(err error, authorization ...string) error {
|
||||
var queryErr *sigv4auth.QueryError
|
||||
if errors.As(err, &queryErr) {
|
||||
return mapIAMQueryError(queryErr)
|
||||
}
|
||||
|
||||
var parseErr *sigv4auth.ParseError
|
||||
if errors.As(err, &parseErr) {
|
||||
authHeader := ""
|
||||
if len(authorization) > 0 {
|
||||
authHeader = authorization[0]
|
||||
}
|
||||
return mapIAMParseError(parseErr, authHeader)
|
||||
}
|
||||
|
||||
var headersErr *sigv4auth.HeadersNotSignedError
|
||||
if errors.As(err, &headersErr) {
|
||||
if len(headersErr.Headers) == 1 && headersErr.Headers[0] == "host" {
|
||||
return iamerr.GetAPIError(iamerr.ErrMissingHostSignedHeader)
|
||||
}
|
||||
return iamerr.IncompleteSignatureHeadersNotSigned(headersErr.Headers)
|
||||
}
|
||||
|
||||
var sigErr *sigv4auth.SignatureMismatchError
|
||||
if errors.As(err, &sigErr) {
|
||||
return iamerr.GetAPIError(iamerr.ErrSignatureDoesNotMatch)
|
||||
}
|
||||
|
||||
return err
|
||||
}
|
||||
|
||||
func mapIAMQueryError(err *sigv4auth.QueryError) error {
|
||||
switch err.Kind {
|
||||
case sigv4auth.ErrQueryMissingRequiredParams:
|
||||
switch err.Value {
|
||||
case sigv4auth.QueryAlgorithm:
|
||||
return iamerr.GetAPIError(iamerr.ErrMissingAuthenticationToken)
|
||||
case sigv4auth.QueryCredential, sigv4auth.QueryDate, sigv4auth.QuerySignedHeaders, sigv4auth.QuerySignature:
|
||||
return iamerr.IncompleteSignatureMissingQueryParameter(err.Value)
|
||||
default:
|
||||
return iamerr.GetAPIError(iamerr.ErrIncompleteSignature)
|
||||
}
|
||||
case sigv4auth.ErrQueryUnsupportedAlgorithm, sigv4auth.ErrQueryUnsupportedECDSA:
|
||||
return iamerr.GetAPIError(iamerr.ErrUnsupportedQueryAlgorithm)
|
||||
case sigv4auth.ErrQueryInvalidDateFormat:
|
||||
return iamerr.IncompleteSignatureInvalidXAmzDate(err.Value)
|
||||
case sigv4auth.ErrQueryDateMismatch:
|
||||
return iamerr.GetAPIError(iamerr.ErrInvalidCredentialDate)
|
||||
case sigv4auth.ErrQueryIncorrectRegion:
|
||||
return iamerr.GetAPIError(iamerr.ErrInvalidRegion)
|
||||
case sigv4auth.ErrQuerySecurityToken:
|
||||
return iamerr.GetAPIError(iamerr.ErrInvalidClientTokenID)
|
||||
default:
|
||||
return iamerr.GetAPIError(iamerr.ErrIncompleteSignature)
|
||||
}
|
||||
}
|
||||
|
||||
func mapIAMParseError(err *sigv4auth.ParseError, authorization string) error {
|
||||
if authorization == "" {
|
||||
authorization = err.Input
|
||||
}
|
||||
|
||||
switch err.Kind {
|
||||
case sigv4auth.ErrInvalidAuthorizationHeader:
|
||||
return iamerr.GetAPIError(iamerr.ErrMissingAuthenticationToken)
|
||||
case sigv4auth.ErrUnsupportedAuthorizationVersion:
|
||||
return iamerr.GetAPIError(iamerr.ErrUnsupportedSignatureVersion)
|
||||
case sigv4auth.ErrInvalidAuthorizationType:
|
||||
return iamerr.GetAPIError(iamerr.ErrMissingAuthenticationToken)
|
||||
case sigv4auth.ErrMissingComponents:
|
||||
return iamerr.GetAPIError(iamerr.ErrMissingAuthorizationComponents)
|
||||
case sigv4auth.ErrMissingCredential:
|
||||
return iamerr.IncompleteSignatureMissingAuthorizationComponent("Credential", authorization)
|
||||
case sigv4auth.ErrMissingSignedHeaders:
|
||||
return iamerr.IncompleteSignatureMissingAuthorizationComponent("SignedHeaders", authorization)
|
||||
case sigv4auth.ErrMissingSignature:
|
||||
return iamerr.IncompleteSignatureMissingAuthorizationComponent("Signature", authorization)
|
||||
case sigv4auth.ErrMalformedComponent:
|
||||
return iamerr.IncompleteSignatureMalformedComponent(err.Value)
|
||||
case sigv4auth.ErrMalformedCredential:
|
||||
return iamerr.IncompleteSignatureMalformedCredential(err.Input)
|
||||
case sigv4auth.ErrIncorrectService:
|
||||
return iamerr.GetAPIError(iamerr.ErrIncorrectService)
|
||||
case sigv4auth.ErrIncorrectTerminal:
|
||||
return iamerr.GetAPIError(iamerr.ErrInvalidTerminal)
|
||||
case sigv4auth.ErrInvalidDateFormat:
|
||||
return iamerr.GetAPIError(iamerr.ErrInvalidCredentialDate)
|
||||
default:
|
||||
return iamerr.GetAPIError(iamerr.ErrIncompleteSignature)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package iammiddleware
|
||||
|
||||
import (
|
||||
"github.com/gofiber/fiber/v3"
|
||||
"github.com/versity/versitygw/debuglogger"
|
||||
"github.com/versity/versitygw/internal/httpctx"
|
||||
)
|
||||
|
||||
// DebugLogger returns a middleware that logs full request and response details
|
||||
// when debug logging is enabled.
|
||||
func DebugLogger() fiber.Handler {
|
||||
return func(ctx fiber.Ctx) error {
|
||||
debuglogger.LogFiberRequestDetails(ctx)
|
||||
err := ctx.Next()
|
||||
debuglogger.LogFiberResponseDetails(ctx)
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
// StackTraceHandler stores the panic value in the request context so that the
|
||||
// global error handler can distinguish panics from regular errors.
|
||||
func StackTraceHandler(ctx fiber.Ctx, e any) {
|
||||
httpctx.ContextKeyStack.Set(ctx, e)
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package iammiddleware
|
||||
|
||||
import (
|
||||
"errors"
|
||||
|
||||
"github.com/gofiber/fiber/v3"
|
||||
"github.com/versity/versitygw/debuglogger"
|
||||
"github.com/versity/versitygw/iamapi/iamerr"
|
||||
"github.com/versity/versitygw/internal/httpctx"
|
||||
)
|
||||
|
||||
// GlobalErrorHandler is the fiber error handler for the IAM API server. It
|
||||
// translates APIError values into XML responses and logs unexpected errors.
|
||||
func GlobalErrorHandler(ctx fiber.Ctx, er error) error {
|
||||
requestID := EnsureRequestID(ctx)
|
||||
ctx.Response().Header.SetContentType(fiber.MIMEApplicationXML)
|
||||
|
||||
var apiErr iamerr.APIError
|
||||
if errors.As(er, &apiErr) {
|
||||
return ctx.Status(apiErr.StatusCode()).Send(apiErr.XMLBody(requestID))
|
||||
}
|
||||
|
||||
if httpctx.ContextKeyStack.IsSet(ctx) {
|
||||
debuglogger.Panic(er)
|
||||
} else {
|
||||
debuglogger.InternalError(er)
|
||||
}
|
||||
|
||||
err := iamerr.GetAPIError(iamerr.ErrInternalFailure)
|
||||
return ctx.Status(err.StatusCode()).Send(err.XMLBody(requestID))
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package iammiddleware
|
||||
|
||||
import (
|
||||
"github.com/gofiber/fiber/v3"
|
||||
"github.com/versity/versitygw/iamapi/iamerr"
|
||||
"golang.org/x/sync/semaphore"
|
||||
)
|
||||
|
||||
// RateLimiter returns a middleware that limits concurrent in-flight requests to
|
||||
// limit. Excess requests receive a Throttling error response immediately.
|
||||
func RateLimiter(limit int) fiber.Handler {
|
||||
sem := semaphore.NewWeighted(int64(limit))
|
||||
|
||||
return func(ctx fiber.Ctx) error {
|
||||
requestID := EnsureRequestID(ctx)
|
||||
|
||||
if !sem.TryAcquire(1) {
|
||||
err := iamerr.GetAPIError(iamerr.ErrThrottling)
|
||||
ctx.Response().Header.SetContentType(fiber.MIMEApplicationXML)
|
||||
return ctx.Status(err.StatusCode()).Send(err.XMLBody(requestID))
|
||||
}
|
||||
defer sem.Release(1)
|
||||
return ctx.Next()
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package iammiddleware
|
||||
|
||||
import (
|
||||
"github.com/gofiber/fiber/v3"
|
||||
"github.com/google/uuid"
|
||||
"github.com/versity/versitygw/internal/httpctx"
|
||||
)
|
||||
|
||||
const HeaderAmznRequestID = "x-amzn-RequestId"
|
||||
|
||||
// RequestIDs is a middleware that ensures every request has a request ID set
|
||||
// and returned in the response header.
|
||||
func RequestIDs() fiber.Handler {
|
||||
return func(ctx fiber.Ctx) error {
|
||||
EnsureRequestID(ctx)
|
||||
return ctx.Next()
|
||||
}
|
||||
}
|
||||
|
||||
// EnsureRequestID returns the existing request ID from the context, or
|
||||
// generates and stores a new one if none exists. It always sets the
|
||||
// x-amzn-RequestId response header.
|
||||
func EnsureRequestID(ctx fiber.Ctx) string {
|
||||
requestID, _ := httpctx.ContextKeyRequestID.Get(ctx).(string)
|
||||
if requestID == "" {
|
||||
requestID = uuid.NewString()
|
||||
httpctx.ContextKeyRequestID.Set(ctx, requestID)
|
||||
}
|
||||
|
||||
ctx.Response().Header.Set(HeaderAmznRequestID, requestID)
|
||||
return requestID
|
||||
}
|
||||
Reference in New Issue
Block a user