Go로 PostgreSQL 프록시 만들기 (44) - Admin API 인증과 RBAC

// internal/dataapi/handler.go
token := extractBearerToken(r)
for _, k := range apiKeys {
    if k == token {
        allowed = true
        break
    }
}

type AdminAuthConfig struct {
    Enabled     bool          `yaml:"enabled"`
    APIKeys     []AdminAPIKey `yaml:"api_keys"`
    IPAllowlist []string      `yaml:"ip_allowlist"`
}

type AdminAPIKey struct {
    Key  string `yaml:"key"`
    Role string `yaml:"role"` // "admin" or "viewer"
}

admin:
  enabled: true
  listen: "0.0.0.0:9091"
  auth:
    enabled: true
    api_keys:
      - key: "ops-full-access-key"
        role: "admin"
      - key: "grafana-readonly-key"
        role: "viewer"
    ip_allowlist:
      - "10.0.0.0/8"
      - "172.16.0.0/12"

func (s *Server) withAuth(next http.HandlerFunc, requireAdmin bool) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        cfg := s.cfgFn()  // hot-reload된 최신 설정
        authCfg := cfg.Admin.Auth

        if !authCfg.Enabled {
            next(w, r)
            return
        }

        // 1. IP allowlist 검사
        if len(authCfg.IPAllowlist) > 0 {
            clientIP := extractClientIP(r)
            if !isIPAllowed(clientIP, authCfg.IPAllowlist) {
                writeJSONError(w, http.StatusForbidden, "ip not allowed")
                return
            }
        }

        // 2. Bearer 토큰 검사
        token := extractBearerToken(r)
        if token == "" {
            w.Header().Set("WWW-Authenticate", "Bearer")
            writeJSONError(w, http.StatusUnauthorized, "authentication required")
            return
        }

        // 3. API Key 매칭 → 역할 확인
        role := ""
        for _, k := range authCfg.APIKeys {
            if k.Key == token {
                role = k.Role
                break
            }
        }
        if role == "" {
            writeJSONError(w, http.StatusUnauthorized, "invalid api key")
            return
        }

        // 4. 인가: POST 엔드포인트는 admin만
        if requireAdmin && role != "admin" {
            writeJSONError(w, http.StatusForbidden, "admin role required")
            return
        }

        next(w, r)
    }
}

mux.HandleFunc("/admin/health", s.withAuth(s.handleHealth, false))
mux.HandleFunc("/admin/reload", s.withAuth(s.handleReload, true))

func extractClientIP(r *http.Request) string {
    if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
        parts := strings.SplitN(xff, ",", 2)
        return strings.TrimSpace(parts[0])
    }
    host, _, err := net.SplitHostPort(r.RemoteAddr)
    if err != nil {
        return r.RemoteAddr
    }
    return host
}

func isIPAllowed(clientIP string, allowlist []string) bool {
    ip := net.ParseIP(clientIP)
    if ip == nil {
        return false
    }
    for _, entry := range allowlist {
        _, cidr, err := net.ParseCIDR(entry)
        if err == nil {
            if cidr.Contains(ip) {
                return true
            }
            continue
        }
        if net.ParseIP(entry) != nil && entry == clientIP {
            return true
        }
    }
    return false
}

for _, k := range cfg.Admin.Auth.APIKeys {
    safe.Admin.Auth.APIKeys = append(safe.Admin.Auth.APIKeys, safeAdminAPIKey{
        Key:  "********",
        Role: k.Role,   // 역할은 노출해도 안전
    })
}

if c.Admin.Auth.Enabled {
    if len(c.Admin.Auth.APIKeys) == 0 {
        return fmt.Errorf("admin.auth.api_keys is required when admin.auth is enabled")
    }
    for i, k := range c.Admin.Auth.APIKeys {
        if k.Role != "admin" && k.Role != "viewer" {
            return fmt.Errorf("admin.auth.api_keys[%d].role must be \"admin\" or \"viewer\"", i)
        }
    }
    for i, cidr := range c.Admin.Auth.IPAllowlist {
        if _, _, err := net.ParseCIDR(cidr); err != nil {
            if ip := net.ParseIP(cidr); ip == nil {
                return fmt.Errorf("admin.auth.ip_allowlist[%d] is not a valid IP or CIDR", i)
            }
        }
    }
}