mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-23 13:59:09 +02:00
Maycon Santos
8397bed4af
An integrated validator can approve or revoke peers outside a login or sync, for example during a periodic EDR sync. Only revocations of SSO peers reached anyone; a newly approved peer kept its empty map, and its peers did not see it, until an unrelated update or a reconnect. Add SetPeerValidationChangeListener to the IntegratedValidator interface. The account manager registers a handler that resolves the affected peers and calls OnPeersUpdated, the same path a login-time approval takes. The OSS validator and the mock implement it as a no-op.
30 lines
2.1 KiB
Go
30 lines
2.1 KiB
Go
package integrated_validator
|
|
|
|
import (
|
|
"context"
|
|
|
|
nbpeer "github.com/netbirdio/netbird/management/server/peer"
|
|
"github.com/netbirdio/netbird/management/server/types"
|
|
"github.com/netbirdio/netbird/shared/management/networkmap/nmdata"
|
|
"github.com/netbirdio/netbird/shared/management/proto"
|
|
)
|
|
|
|
//go:generate go tool mockgen -package integrated_validator -destination=integrated_validator_mock.go -source=./interface.go -build_flags=-mod=mod
|
|
|
|
// IntegratedValidator interface exists to avoid the circle dependencies
|
|
type IntegratedValidator interface {
|
|
ValidateExtraSettings(ctx context.Context, newExtraSettings *types.ExtraSettings, oldExtraSettings *types.ExtraSettings, userID string, accountID string) error
|
|
ValidatePeer(ctx context.Context, update *nbpeer.Peer, p *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error)
|
|
PreparePeer(ctx context.Context, accountID string, p *nbpeer.Peer, peersGroup []string, extraSettings *types.ExtraSettings, temporary bool) *nbpeer.Peer
|
|
IsNotValidPeer(ctx context.Context, accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *types.ExtraSettings) (bool, bool, error)
|
|
GetValidatedPeers(ctx context.Context, accountID string, groups []*nmdata.Group, peers []*nmdata.Peer, extraSettings *types.ExtraSettings) (map[string]struct{}, error)
|
|
GetInvalidPeers(ctx context.Context, accountID string, extraSettings *types.ExtraSettings) (map[string]string, error)
|
|
PeerDeleted(ctx context.Context, accountID, peerID string, extraSettings *types.ExtraSettings) error
|
|
SetPeerInvalidationListener(fn func(accountID string, peerIDs []string))
|
|
// SetPeerValidationChangeListener registers fn to be called with the peers whose
|
|
// validation state changed outside a login or sync, so their network maps can be pushed.
|
|
SetPeerValidationChangeListener(fn func(accountID string, peerIDs []string))
|
|
Stop(ctx context.Context)
|
|
ValidateFlowResponse(ctx context.Context, peerKey string, flowResponse *proto.PKCEAuthorizationFlow) *proto.PKCEAuthorizationFlow
|
|
}
|