Merge pull request #61 from dkrizic/copilot/fix-login-with-any-password

Add stream interceptor for authentication

Author: dkrizic

service/service/auth/auth.go

@@ -28,6 +28,54 @@ func requiresAuthentication(fullMethod string) bool {
 	return false
 }
 
+// validateCredentials extracts and validates credentials from the context metadata
+func validateCredentials(ctx context.Context, fullMethod, username, password string) error {
+	// Extract metadata from context
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		slog.WarnContext(ctx, "Missing metadata in request", "method", fullMethod)
+		return status.Error(codes.Unauthenticated, "missing metadata")
+	}
+
+	// Check for authorization header
+	authHeaders := md.Get("authorization")
+	if len(authHeaders) == 0 {
+		slog.WarnContext(ctx, "Missing authorization header", "method", fullMethod)
+		return status.Error(codes.Unauthenticated, "missing authorization header")
+	}
+
+	// Parse Basic Auth header
+	auth := authHeaders[0]
+	if !strings.HasPrefix(auth, "Basic ") {
+		slog.WarnContext(ctx, "Invalid authorization header format", "method", fullMethod)
+		return status.Error(codes.Unauthenticated, "invalid authorization header")
+	}
+
+	// Decode base64 credentials
+	payload, err := base64.StdEncoding.DecodeString(auth[6:])
+	if err != nil {
+		slog.WarnContext(ctx, "Failed to decode authorization header", "method", fullMethod, "error", err)
+		return status.Error(codes.Unauthenticated, "invalid authorization header")
+	}
+
+	// Split username:password
+	pair := strings.SplitN(string(payload), ":", 2)
+	if len(pair) != 2 {
+		slog.WarnContext(ctx, "Invalid credentials format", "method", fullMethod)
+		return status.Error(codes.Unauthenticated, "invalid credentials format")
+	}
+
+	// Validate credentials
+	if pair[0] != username || pair[1] != password {
+		slog.WarnContext(ctx, "Invalid credentials", "method", fullMethod, "username", pair[0])
+		return status.Error(codes.Unauthenticated, "invalid credentials")
+	}
+
+	// Credentials are valid
+	slog.DebugContext(ctx, "Authentication successful", "method", fullMethod, "username", pair[0])
+	return nil
+}
+
 // SelectiveInterceptor creates a gRPC unary server interceptor that only applies
 // authentication to specific services (Feature and Workload)
 func SelectiveInterceptor(enabled bool, username, password string) grpc.UnaryServerInterceptor {
@@ -48,49 +96,42 @@ func SelectiveInterceptor(enabled bool, username, password string) grpc.UnarySer
 			return handler(ctx, req)
 		}
 
-		// Extract metadata from context
-		md, ok := metadata.FromIncomingContext(ctx)
-		if !ok {
-			slog.WarnContext(ctx, "Missing metadata in request", "method", info.FullMethod)
-			return nil, status.Error(codes.Unauthenticated, "missing metadata")
-		}
-
-		// Check for authorization header
-		authHeaders := md.Get("authorization")
-		if len(authHeaders) == 0 {
-			slog.WarnContext(ctx, "Missing authorization header", "method", info.FullMethod)
-			return nil, status.Error(codes.Unauthenticated, "missing authorization header")
+		// Validate credentials
+		if err := validateCredentials(ctx, info.FullMethod, username, password); err != nil {
+			return nil, err
 		}
 
-		// Parse Basic Auth header
-		auth := authHeaders[0]
-		if !strings.HasPrefix(auth, "Basic ") {
-			slog.WarnContext(ctx, "Invalid authorization header format", "method", info.FullMethod)
-			return nil, status.Error(codes.Unauthenticated, "invalid authorization header")
-		}
+		// Credentials are valid, proceed with the request
+		return handler(ctx, req)
+	}
+}
 
-		// Decode base64 credentials
-		payload, err := base64.StdEncoding.DecodeString(auth[6:])
-		if err != nil {
-			slog.WarnContext(ctx, "Failed to decode authorization header", "method", info.FullMethod, "error", err)
-			return nil, status.Error(codes.Unauthenticated, "invalid authorization header")
+// SelectiveStreamInterceptor creates a gRPC stream server interceptor that only applies
+// authentication to specific services (Feature and Workload)
+func SelectiveStreamInterceptor(enabled bool, username, password string) grpc.StreamServerInterceptor {
+	return func(
+		srv interface{},
+		ss grpc.ServerStream,
+		info *grpc.StreamServerInfo,
+		handler grpc.StreamHandler,
+	) error {
+		// If authentication is not enabled, allow all requests
+		if !enabled {
+			return handler(srv, ss)
 		}
 
-		// Split username:password
-		pair := strings.SplitN(string(payload), ":", 2)
-		if len(pair) != 2 {
-			slog.WarnContext(ctx, "Invalid credentials format", "method", info.FullMethod)
-			return nil, status.Error(codes.Unauthenticated, "invalid credentials format")
+		// Only authenticate protected services (Feature and Workload)
+		// Allow Health and Meta services to pass through without authentication
+		if !requiresAuthentication(info.FullMethod) {
+			return handler(srv, ss)
 		}
 
 		// Validate credentials
-		if pair[0] != username || pair[1] != password {
-			slog.WarnContext(ctx, "Invalid credentials", "method", info.FullMethod, "username", pair[0])
-			return nil, status.Error(codes.Unauthenticated, "invalid credentials")
+		if err := validateCredentials(ss.Context(), info.FullMethod, username, password); err != nil {
+			return err
 		}
 
 		// Credentials are valid, proceed with the request
-		slog.DebugContext(ctx, "Authentication successful", "method", info.FullMethod, "username", pair[0])
-		return handler(ctx, req)
+		return handler(srv, ss)
 	}
 }

service/service/service.go

@@ -139,11 +139,13 @@ func Service(ctx context.Context, cmd *cli.Command) error {
 	))
 
 	authInterceptor := auth.SelectiveInterceptor(authEnabled, authUsername, authPassword)
+	authStreamInterceptor := auth.SelectiveStreamInterceptor(authEnabled, authUsername, authPassword)
 
 	// Create gRPC server with chained interceptors
 	grpcServer := grpc.NewServer(
 		grpc.StatsHandler(otelInterceptor),
 		grpc.ChainUnaryInterceptor(authInterceptor),
+		grpc.ChainStreamInterceptor(authStreamInterceptor),
 	)
 
 	// meta