tree 53ca75e16e98d7d3cf5b0cf20293aea1d3b0986a
parent d88541d140437c7233fef62819b14846efc0435c
author Jonathan Amsterdam <jba@google.com> 1725400169 -0400
committer Jonathan Amsterdam <jba@google.com> 1725530708 +0000

internal/gcp/crproxy: add simple path auth

Neither App Engine nor IAP provides a way to authorize a user for a
particular path. This CL provides a simple path-based auth implementation.

Details of the design are in the comment at the top of auth.go.

The mapping from users and paths to roles is stored in Firestore's
default DB. We need to maintain our own mapping because it isn't
feasible get roles from IAM. We can query the policy bindings, but we
can't expand groups.

Change-Id: I24a47dd8f0d5be927ada60ccad1c39ce4cd38948
Reviewed-on: https://go-review.googlesource.com/c/oscar/+/610615
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>