Skip to content

fix: authzen #442

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gusfcarvalho merged 1 commit into from
Jul 2, 2026
Merged

fix: authzen #442

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions cmd/root.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,9 @@ func bindEnvironmentVariables() {
viper.MustBindEnv("authz_driver")
viper.MustBindEnv("authz_role_assignments")
viper.MustBindEnv("authz_fail_mode")
viper.MustBindEnv("authz_endpoint")
viper.MustBindEnv("authz_cache_ttl")
viper.MustBindEnv("authz_cedar_policy_dir")
}

func init() {
Expand Down
33 changes: 30 additions & 3 deletions internal/authz/authzen.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,13 +55,20 @@ func NewAuthZen(endpoint string, logger *zap.SugaredLogger) (*AuthZen, error) {
if logger == nil {
logger = zap.NewNop().Sugar()
}
return &AuthZen{
a := &AuthZen{
evalURL: endpoint,
evalsURL: deriveEvaluationsURL(endpoint),
wellKnownURL: u.Scheme + "://" + u.Host + "/.well-known/authzen-configuration",
client: &http.Client{Timeout: defaultAuthzenTimeout},
logger: logger,
}, nil
}
// An always-visible startup line confirms the authzen driver is the active engine (vs the
// builtin/cedar defaults) and shows exactly where decisions are sent — the first thing to
// check when a remote PDP isn't taking effect.
logger.Infow("authz: authzen driver initialized",
"evalURL", a.evalURL, "evalsURL", a.evalsURL, "wellKnownURL", a.wellKnownURL,
"timeout", defaultAuthzenTimeout.String())
Comment on lines +68 to +70
return a, nil
}

// deriveEvaluationsURL maps the single-evaluation URL to its batch sibling using the
Expand Down Expand Up @@ -142,11 +149,20 @@ func decisionFrom(resp authzenDecisionResponse) Decision {

// Evaluate implements PDP via the AuthZen single Access Evaluation API.
func (a *AuthZen) Evaluate(ctx context.Context, s Subject, action string, r Resource, reqCtx map[string]any) (Decision, error) {
start := time.Now()
var resp authzenDecisionResponse
if err := a.post(ctx, a.evalURL, toEvaluation(s, action, r, reqCtx), &resp); err != nil {
a.logger.Warnw("authz: authzen evaluate failed",
"subject", s.ID, "subjectType", s.Type, "action", action,
"resource", r.Type, "resourceID", r.ID, "error", err)
return Decision{}, err
}
return decisionFrom(resp), nil
dec := decisionFrom(resp)
a.logger.Debugw("authz: authzen decision",
"subject", s.ID, "subjectType", s.Type, "action", action,
"resource", r.Type, "resourceID", r.ID, "allow", dec.Allow, "reason", dec.Reason,
"latencyMs", float64(time.Since(start).Microseconds())/1000.0)
return dec, nil
Comment on lines +152 to +165

@coderabbitai coderabbitai Bot Jul 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Subject ID logged on every Evaluate call — verify it isn't PII.

Unlike Evaluations (which only logs aggregate counts), Evaluate's Warnw/Debugw calls log s.ID directly. Depending on the IdP, subject IDs may be emails or other identifying values. Given the compliance-focused nature of this service, confirm this is acceptable for the target logging backend/retention policy, or hash/redact the identifier.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/authz/authzen.go` around lines 152 - 165, The Evaluate logging in
authzen.go is emitting the raw subject identifier via s.ID in both the Warnw and
Debugw paths. Review the authz: authzen evaluate failed and authz: authzen
decision logs in the Evaluate flow and either confirm the backend/retention
policy allows this, or replace s.ID with a hashed/redacted form before logging.
Keep the rest of the context fields intact so the logging remains useful without
exposing potentially PII-bearing subject IDs.

}

// Evaluations implements PDP via the AuthZen batch Access Evaluations API — one HTTP call
Expand All @@ -155,21 +171,30 @@ func (a *AuthZen) Evaluations(ctx context.Context, reqs []EvalRequest) ([]Decisi
if len(reqs) == 0 {
return []Decision{}, nil
}
start := time.Now()
body := authzenEvaluationsRequest{Evaluations: make([]authzenEvaluation, len(reqs))}
for i, req := range reqs {
body.Evaluations[i] = toEvaluation(req.Subject, req.Action, req.Resource, req.Context)
}
var resp authzenEvaluationsResponse
if err := a.post(ctx, a.evalsURL, body, &resp); err != nil {
a.logger.Warnw("authz: authzen batch evaluate failed", "count", len(reqs), "error", err)
return nil, err
}
if len(resp.Evaluations) != len(reqs) {
return nil, fmt.Errorf("authz: authzen returned %d decisions for %d requests", len(resp.Evaluations), len(reqs))
}
out := make([]Decision, len(reqs))
allowed := 0
for i, d := range resp.Evaluations {
out[i] = decisionFrom(d)
if out[i].Allow {
allowed++
}
}
a.logger.Debugw("authz: authzen batch decision",
"count", len(reqs), "allowed", allowed, "denied", len(reqs)-allowed,
"latencyMs", float64(time.Since(start).Microseconds())/1000.0)
return out, nil
}

Expand Down Expand Up @@ -201,6 +226,7 @@ func (a *AuthZen) post(ctx context.Context, endpoint string, payload any, out an
if err != nil {
return fmt.Errorf("authz: marshal authzen request: %w", err)
}
a.logger.Debugw("authz: authzen request", "endpoint", endpoint, "body", string(buf))
req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(buf))
if err != nil {
return fmt.Errorf("authz: build authzen request: %w", err)
Expand All @@ -222,6 +248,7 @@ func (a *AuthZen) post(ctx context.Context, endpoint string, payload any, out an
default:
return fmt.Errorf("authz: authzen PDP %s returned %s: %s", endpoint, resp.Status, readSnippet(resp.Body))
}
a.logger.Debugw("authz: authzen response", "endpoint", endpoint, "status", resp.StatusCode)

if err := json.NewDecoder(resp.Body).Decode(out); err != nil {
return fmt.Errorf("authz: decode authzen response from %s: %w", endpoint, err)
Expand Down
Loading