tinyauth/internal/service/kubernetes_httproute_extractor.go

package service

import (
	"slices"

	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
	gateway "sigs.k8s.io/gateway-api/apis/v1"
)

type KubernetesHTTPRouteExtractor struct {
	log *logger.Logger
}

type KubernetesHTTPRouteExtractorInput struct {
	Log *logger.Logger
}

func NewKubernetesHTTPRouteExtractor(i KubernetesHTTPRouteExtractorInput) *KubernetesHTTPRouteExtractor {
	return &KubernetesHTTPRouteExtractor{
		log: i.Log,
	}
}

func (k *KubernetesHTTPRouteExtractor) getHosts(hostnames []gateway.Hostname) []string {
	var hosts []string

	for _, hostname := range hostnames {
		if hostname != "" {
			hosts = append(hosts, string(hostname))
		}
	}

	return nil
}

func (k *KubernetesHTTPRouteExtractor) getRuleMatchers(matchers []gateway.HTTPRouteMatch) []string {
	var res []string

	for _, m := range matchers {
		pathType := m.Path.Type
		if pathType == nil {
			pathType = new(gateway.PathMatchPathPrefix)
		}

		pathValue := m.Path.Value
		if pathValue == nil {
			pathValue = new("/")
		}

		if *pathType != gateway.PathMatchPathPrefix {
			continue
		}

		res = append(res, *pathValue)
	}

	return res
}

func (k *KubernetesHTTPRouteExtractor) getPaths(rules []gateway.HTTPRouteRule) []string {
	var paths []string

	for _, rule := range rules {
		matchers := k.getRuleMatchers(rule.Matches)
		paths = append(paths, matchers...)
	}

	return paths
}

func (k *KubernetesHTTPRouteExtractor) Extract(route *gateway.HTTPRoute) *ExtractionResult {
	hosts := k.getHosts(route.Spec.Hostnames)
	paths := k.getPaths(route.Spec.Rules)

	namespace := route.GetNamespace()
	name := route.GetName()

	annotations := route.GetAnnotations()

	if !slices.Contains(paths, "/") {
		k.log.App.Warn().Str("namespace", namespace).Str("name", name).Strs("paths", paths).Msg("Route does not contain a catch-all path, another route may be able to bypass auth checks if it routes the same host with a different path. Consider adding a catch-all path to this route to ensure auth checks are applied to all paths for this host.")
	}

	return &ExtractionResult{
		typ:         ResourceTypeHTTPRoute,
		name:        name,
		namespace:   namespace,
		hosts:       hosts,
		annotations: annotations,
	}
}