serve.go

Rama main · réplica de lectura del repositorio original.

//go:build !desktop

package main

import (
	"context"
	"log/slog"
	"os"
	"time"

	"github.com/sophotechlabs/spinoza/internal/auth"
	"github.com/sophotechlabs/spinoza/internal/kube"
	"github.com/sophotechlabs/spinoza/internal/server"
	"github.com/sophotechlabs/spinoza/internal/store"
)

const providerWait = 30 * time.Second

type teamServer interface {
	UseClusterAuth(settings server.ClusterAuth)
}

func toolKubeconfig(opts settings) string {
	return toolKubeconfigFrom(opts, kube.InCluster, os.UserConfigDir, kube.WriteInClusterKubeconfig)
}

func toolKubeconfigFrom(
	opts settings,
	inCluster func() bool,
	configDir func() (string, error),
	write func(string) (string, error),
) string {
	if !opts.serve.on || opts.cluster.Kubeconfig != "" {
		return ""
	}
	if !inCluster() {
		return ""
	}
	dir, err := configDir()
	if err != nil {
		slog.Warn("helm and kubectl will act as spinoza itself; there is nowhere to write them a kubeconfig", "error", err)
		return ""
	}
	path, writeErr := write(dir)
	if writeErr != nil {
		slog.Warn("helm and kubectl will act as spinoza itself", "error", writeErr)
		return ""
	}
	return path
}

func serveTeam(ctx context.Context, srv teamServer, opts settings, past *store.Store) error {
	building, cancel := context.WithTimeout(ctx, providerWait)
	defer cancel()
	cfg := opts.serve.auth
	if past != nil {
		cfg.Revocations = past
	}
	authn, err := auth.New(building, cfg)
	if err != nil {
		return err
	}
	if !authn.Enabled() {
		slog.Warn("cluster mode is on with no way to sign in, so anybody who reaches this address is an admin here; set --auth-mode")
	}
	if !opts.serve.impersonate {
		slog.Warn("impersonation is off, so every action runs as spinoza's own service account rather than the person who asked for it")
	}
	srv.UseClusterAuth(server.ClusterAuth{Authenticator: authn, PublicURL: opts.serve.publicURL})
	return nil
}

func checkListen(opts settings) error {
	if opts.serve.on {
		return nil
	}
	return server.CheckLoopback(opts.addr)
}

func runToken(opts settings) (string, error) {
	if opts.serve.on {
		return "", nil
	}
	token := server.NewToken()
	err := writeTokenFile(opts.tokenFile, token)
	if err != nil {
		return "", err
	}
	return token, nil
}