Skip to content

Authz

Go Connect service (platform/authz). One responsibility: answer whether a subject holds an action on a target. It stores grants; it does not know what the targets are. The role definitions belong to the calling applications, which register them with SeedRoles.

  • Model — tables, the platform roles, scoping, who may grant.

Service

authz.v1.AuthzService (proto/authz/v1/), plus GET /healthz, on one HTTP/1.1 listener (PORT or AUTHZ_LISTEN_ADDR).

RPC Purpose
IsAllowed Does subject hold any of actions on (target, target_id)?
AssignRole Insert an ACL tuple.
RevokeRole Delete an ACL tuple.
SeedRoles Upsert roles by id and replace each role's actions. Called by each application at startup.
ListRoles Role catalogue.
ListUserPermissions Every ACL tuple of a subject.
ListRoleHolders Every subject holding any role on one (target, target_id).

Authentication

Every RPC needs Authorization: Bearer <key>. The key is accepted if it equals AUTHZ_API_KEY (terraform-generated, given to nexus as NEXUS_AUTHZ_API_KEY) or matches an active bcrypt hash in service_keys. With neither configured, every request is refused.

Service keys are managed with the binary's CLI: authz keys create <name>, authz keys list, authz keys revoke <name>.

Data

The same Postgres database as nexus (AUTHZ_DATABASE_DSN). authz owns roles, role_actions, acl and service_keys, and migrates them at startup from embedded SQL. Other services never write these tables directly.

Callers

Caller Client Role ids
nexus gitlab.com/digilan/platform/authz/pkg/authzclient, wrapped by platform/nexus/internal/authz 1–99
Monsieur Wifi (PHP and Go) Connect-JSON over HTTP POST 100–199
radius-ctrl — (uses its own org_memberships) 200–299 reserved

Role id ranges are load-bearing

SeedRoles upserts by id and replaces actions wholesale, so two applications claiming one id silently redefine each other's roles, and grants on the overwritten role evaluate to deny with no error. Check the live roles table before claiming an id.

nexus wrapper

platform/nexus/internal/authz/authz.go:

  • Constants for targets (TargetOrg, TargetDevice, TargetSystem, TargetSegment), actions and role ids.
  • RoleSeeds() — the role table, used both for SeedRoles and to compute caller_actions returned to the portal, so the UI and the server read one definition.
  • ActionsFor(roleID, target), MembershipRoles, IsMembershipRoleName.
  • IsAllowed, ListPermissions, AssignRole/RevokeRole, AssignOwnerRole, AssignDeviceOwner, ListRoles, ListRoleHolders.
  • When no address is configured the client allows everything; nexus refuses to start in that state unless NEXUS_DEV_AUTH=true.