From 3662a94ca7cac7311167cef7f70cb7aa5488586a Mon Sep 17 00:00:00 2001 From: micbar Date: Wed, 14 Oct 2026 17:45:44 +0200 Subject: [PATCH] fix: nats checks were missing the configured auth --- pkg/checks/checknats_test.go | 51 +++++++++++++++++++ pkg/nats/options.go | 8 +++ .../activitylog/pkg/server/debug/server.go | 2 +- services/antivirus/pkg/server/debug/server.go | 2 +- services/audit/pkg/server/debug/server.go | 2 +- .../auth-guest/pkg/server/debug/server.go | 2 +- services/clientlog/pkg/server/debug/server.go | 2 +- .../eventhistory/pkg/server/debug/server.go | 2 +- services/gateway/pkg/server/debug/server.go | 12 ++++- services/graph/pkg/server/debug/server.go | 2 +- .../notifications/pkg/server/debug/server.go | 2 +- services/ocm/pkg/server/debug/server.go | 2 +- services/ocs/pkg/server/debug/server.go | 12 ++++- services/policies/pkg/server/debug/server.go | 2 +- .../postprocessing/pkg/server/debug/server.go | 2 +- services/proxy/pkg/server/debug/server.go | 2 +- services/search/pkg/server/debug/server.go | 2 +- services/sharing/pkg/server/debug/server.go | 2 +- services/sse/pkg/server/debug/server.go | 2 +- .../storage-users/pkg/server/debug/server.go | 2 +- services/userlog/pkg/server/debug/server.go | 2 +- 21 files changed, 96 insertions(+), 21 deletions(-) create mode 100644 pkg/checks/checknats_test.go diff --git a/pkg/checks/checknats_test.go b/pkg/checks/checknats_test.go new file mode 100644 index 0000000000..a56f4c61e8 --- /dev/null +++ b/pkg/checks/checknats_test.go @@ -0,0 +1,51 @@ +package checks_test + +import ( + "context" + "testing" + "time" + + "github.com/nats-io/nats-server/v2/server" + "github.com/test-go/testify/require" + + "github.com/opencloud-eu/opencloud/pkg/checks" + "github.com/opencloud-eu/opencloud/pkg/nats" +) + +func TestNewNatsCheckWithAuth(t *testing.T) { + ns, err := server.NewServer(&server.Options{ + Host: "127.0.0.1", + Port: server.RANDOM_PORT, + NoLog: true, + NoSigs: true, + Username: "opencloud", + Password: "secret", + }) + require.NoError(t, err) + go ns.Start() + t.Cleanup(ns.Shutdown) + require.True(t, ns.ReadyForConnections(5*time.Second)) + + addr := ns.ClientURL() + ctx := context.Background() + + require.Error(t, checks.NewNatsCheck(addr)(ctx), "anonymous connection must be rejected") + require.Error(t, checks.NewNatsCheck(addr, nats.Auth("opencloud", "wrong"))(ctx)) + require.NoError(t, checks.NewNatsCheck(addr, nats.Auth("opencloud", "secret"))(ctx)) +} + +func TestNewNatsCheckWithoutAuth(t *testing.T) { + ns, err := server.NewServer(&server.Options{ + Host: "127.0.0.1", + Port: server.RANDOM_PORT, + NoLog: true, + NoSigs: true, + }) + require.NoError(t, err) + go ns.Start() + t.Cleanup(ns.Shutdown) + require.True(t, ns.ReadyForConnections(5*time.Second)) + + // no username configured: Auth adds no option and the secure option may be nil as well + require.NoError(t, checks.NewNatsCheck(ns.ClientURL(), nats.Secure(false, false, ""), nats.Auth("", ""))(context.Background())) +} diff --git a/pkg/nats/options.go b/pkg/nats/options.go index 43d54be2e6..5230a44218 100644 --- a/pkg/nats/options.go +++ b/pkg/nats/options.go @@ -18,3 +18,11 @@ func Secure(enableTLS, insecure bool, rootCA string) nats.Option { } return nil } + +// Auth returns the option to authenticate with the given credentials, nil when no username is set. +func Auth(username, password string) nats.Option { + if username != "" { + return nats.UserInfo(username, password) + } + return nil +} diff --git a/services/activitylog/pkg/server/debug/server.go b/services/activitylog/pkg/server/debug/server.go index 79a016f421..16c89ae511 100644 --- a/services/activitylog/pkg/server/debug/server.go +++ b/services/activitylog/pkg/server/debug/server.go @@ -24,7 +24,7 @@ func Server(opts ...Option) (*http.Server, error) { options.Config.Events.TLSRootCACertificate, ) readyHandlerConfiguration := healthHandlerConfiguration. - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)) + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))) return debug.NewService( debug.Logger(options.Logger), diff --git a/services/antivirus/pkg/server/debug/server.go b/services/antivirus/pkg/server/debug/server.go index 29836059ce..2a47125615 100644 --- a/services/antivirus/pkg/server/debug/server.go +++ b/services/antivirus/pkg/server/debug/server.go @@ -26,7 +26,7 @@ func Server(opts ...Option) (*http.Server, error) { ) readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration(). WithLogger(options.Logger). - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)). + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))). WithCheck("antivirus reachability", func(ctx context.Context) error { cfg := options.Config switch cfg.Scanner.Type { diff --git a/services/audit/pkg/server/debug/server.go b/services/audit/pkg/server/debug/server.go index 0fb247d718..ba29bea84d 100644 --- a/services/audit/pkg/server/debug/server.go +++ b/services/audit/pkg/server/debug/server.go @@ -21,7 +21,7 @@ func Server(opts ...Option) (*http.Server, error) { ) readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration(). WithLogger(options.Logger). - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)) + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))) return debug.NewService( debug.Logger(options.Logger), diff --git a/services/auth-guest/pkg/server/debug/server.go b/services/auth-guest/pkg/server/debug/server.go index 5b6b9ef8ee..bf31f1fba9 100644 --- a/services/auth-guest/pkg/server/debug/server.go +++ b/services/auth-guest/pkg/server/debug/server.go @@ -27,7 +27,7 @@ func Server(opts ...Option) (*http.Server, error) { options.Config.Events.TLSRootCACertificate, ) readyHandlerConfiguration := healthHandlerConfiguration. - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)) + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))) return debug.NewService( debug.Logger(options.Logger), diff --git a/services/clientlog/pkg/server/debug/server.go b/services/clientlog/pkg/server/debug/server.go index 0fb247d718..ba29bea84d 100644 --- a/services/clientlog/pkg/server/debug/server.go +++ b/services/clientlog/pkg/server/debug/server.go @@ -21,7 +21,7 @@ func Server(opts ...Option) (*http.Server, error) { ) readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration(). WithLogger(options.Logger). - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)) + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))) return debug.NewService( debug.Logger(options.Logger), diff --git a/services/eventhistory/pkg/server/debug/server.go b/services/eventhistory/pkg/server/debug/server.go index 664ff2558a..47d4d04f15 100644 --- a/services/eventhistory/pkg/server/debug/server.go +++ b/services/eventhistory/pkg/server/debug/server.go @@ -24,7 +24,7 @@ func Server(opts ...Option) (*http.Server, error) { options.Config.Events.TLSRootCACertificate, ) readyHandlerConfiguration := healthHandlerConfiguration. - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)) + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))) return debug.NewService( debug.Logger(options.Logger), diff --git a/services/gateway/pkg/server/debug/server.go b/services/gateway/pkg/server/debug/server.go index 1bf19e49b6..e68020f50d 100644 --- a/services/gateway/pkg/server/debug/server.go +++ b/services/gateway/pkg/server/debug/server.go @@ -6,6 +6,7 @@ import ( "github.com/opencloud-eu/opencloud/pkg/checks" "github.com/opencloud-eu/opencloud/pkg/handlers" + "github.com/opencloud-eu/opencloud/pkg/nats" "github.com/opencloud-eu/opencloud/pkg/service/debug" "github.com/opencloud-eu/opencloud/pkg/version" ) @@ -18,8 +19,15 @@ func Server(opts ...Option) (*http.Server, error) { WithLogger(options.Logger). WithCheck("nats reachability", func(ctx context.Context) error { if options.Config.Cache.ProviderCacheStore == "nats-js-kv" && len(options.Config.Cache.ProviderCacheNodes) > 0 { - // no secureOption because we cannot yet configure tls for the cache store - return checks.NewNatsCheck(options.Config.Cache.ProviderCacheNodes[0])(ctx) + return checks.NewNatsCheck( + options.Config.Cache.ProviderCacheNodes[0], + nats.Secure( + options.Config.Cache.ProviderCacheEnableTLS, + options.Config.Cache.ProviderCacheTLSInsecure, + options.Config.Cache.ProviderCacheTLSRootCACertificate, + ), + nats.Auth(options.Config.Cache.ProviderCacheAuthUsername, options.Config.Cache.ProviderCacheAuthPassword), + )(ctx) } return nil }) diff --git a/services/graph/pkg/server/debug/server.go b/services/graph/pkg/server/debug/server.go index 83e3dbb0f1..59204708fb 100644 --- a/services/graph/pkg/server/debug/server.go +++ b/services/graph/pkg/server/debug/server.go @@ -39,7 +39,7 @@ func Server(opts ...Option) (*http.Server, error) { options.Config.Events.TLSRootCACertificate, ) readyHandlerConfiguration = readyHandlerConfiguration. - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)) + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))) } return debug.NewService( diff --git a/services/notifications/pkg/server/debug/server.go b/services/notifications/pkg/server/debug/server.go index 99b75a57e6..f10184c01b 100644 --- a/services/notifications/pkg/server/debug/server.go +++ b/services/notifications/pkg/server/debug/server.go @@ -22,7 +22,7 @@ func Server(opts ...Option) (*http.Server, error) { ) readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration(). WithLogger(options.Logger). - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Notifications.Events.Endpoint, secureOption)). + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Notifications.Events.Endpoint, secureOption, nats.Auth(options.Config.Notifications.Events.AuthUsername, options.Config.Notifications.Events.AuthPassword))). WithCheck("smtp-check", checks.NewTCPCheck(options.Config.Notifications.SMTP.Host+":"+strconv.Itoa(options.Config.Notifications.SMTP.Port))) return debug.NewService( diff --git a/services/ocm/pkg/server/debug/server.go b/services/ocm/pkg/server/debug/server.go index 492224d24e..8b0930769e 100644 --- a/services/ocm/pkg/server/debug/server.go +++ b/services/ocm/pkg/server/debug/server.go @@ -24,7 +24,7 @@ func Server(opts ...Option) (*http.Server, error) { options.Config.Events.TLSRootCACertificate, ) readyHandlerConfiguration := healthHandlerConfiguration. - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)). + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))). WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr)) return debug.NewService( diff --git a/services/ocs/pkg/server/debug/server.go b/services/ocs/pkg/server/debug/server.go index c428bb5f1d..62f5d69986 100644 --- a/services/ocs/pkg/server/debug/server.go +++ b/services/ocs/pkg/server/debug/server.go @@ -6,6 +6,7 @@ import ( "github.com/opencloud-eu/opencloud/pkg/checks" "github.com/opencloud-eu/opencloud/pkg/handlers" + "github.com/opencloud-eu/opencloud/pkg/nats" "github.com/opencloud-eu/opencloud/pkg/service/debug" "github.com/opencloud-eu/opencloud/pkg/version" ) @@ -21,8 +22,15 @@ func Server(opts ...Option) (*http.Server, error) { readyHandlerConfiguration := healthHandlerConfiguration. WithCheck("nats reachability", func(ctx context.Context) error { if len(options.Config.SigningKeys.Nodes) > 0 { - // no secureOption because we cannot configure it - return checks.NewNatsCheck(options.Config.SigningKeys.Nodes[0])(ctx) + return checks.NewNatsCheck( + options.Config.SigningKeys.Nodes[0], + nats.Secure( + options.Config.SigningKeys.EnableTLS, + options.Config.SigningKeys.TLSInsecure, + options.Config.SigningKeys.TLSRootCACertificate, + ), + nats.Auth(options.Config.SigningKeys.AuthUsername, options.Config.SigningKeys.AuthPassword), + )(ctx) } return nil }) diff --git a/services/policies/pkg/server/debug/server.go b/services/policies/pkg/server/debug/server.go index 0877e696fb..619e02e2f4 100644 --- a/services/policies/pkg/server/debug/server.go +++ b/services/policies/pkg/server/debug/server.go @@ -29,7 +29,7 @@ func Server(opts ...Option) (*http.Server, error) { options.Config.Events.TLSRootCACertificate, ) readyHandlerConfiguration := healthHandlerConfiguration. - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)) + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))) natsCheckFactory = func() debug.Option { return debug.Ready(handlers.NewCheckHandler(readyHandlerConfiguration)) } } diff --git a/services/postprocessing/pkg/server/debug/server.go b/services/postprocessing/pkg/server/debug/server.go index b0d0050cec..b8c6c0fe39 100644 --- a/services/postprocessing/pkg/server/debug/server.go +++ b/services/postprocessing/pkg/server/debug/server.go @@ -21,7 +21,7 @@ func Server(opts ...Option) (*http.Server, error) { ) readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration(). WithLogger(options.Logger). - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Postprocessing.Events.Endpoint, secureOption)) + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Postprocessing.Events.Endpoint, secureOption, nats.Auth(options.Config.Postprocessing.Events.AuthUsername, options.Config.Postprocessing.Events.AuthPassword))) return debug.NewService( debug.Logger(options.Logger), diff --git a/services/proxy/pkg/server/debug/server.go b/services/proxy/pkg/server/debug/server.go index 1420ee0226..e9c3055466 100644 --- a/services/proxy/pkg/server/debug/server.go +++ b/services/proxy/pkg/server/debug/server.go @@ -28,7 +28,7 @@ func Server(opts ...Option) (*http.Server, error) { options.Config.Events.TLSRootCACertificate, ) readyHandlerConfiguration := healthHandlerConfiguration. - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)) + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))) var configDumpFunc http.HandlerFunc = configDump(options.Config) return debug.NewService( diff --git a/services/search/pkg/server/debug/server.go b/services/search/pkg/server/debug/server.go index 2aae46e07c..3f5eb45d98 100644 --- a/services/search/pkg/server/debug/server.go +++ b/services/search/pkg/server/debug/server.go @@ -26,7 +26,7 @@ func Server(opts ...Option) (*http.Server, error) { options.Config.Events.TLSRootCACertificate, ) readyHandlerConfiguration := healthHandlerConfiguration. - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)). + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))). WithCheck("tika-check", func(ctx context.Context) error { if options.Config.Extractor.Type == "tika" { u, err := url.Parse(options.Config.Extractor.Tika.TikaURL) diff --git a/services/sharing/pkg/server/debug/server.go b/services/sharing/pkg/server/debug/server.go index c1cfbcfe7c..845612b407 100644 --- a/services/sharing/pkg/server/debug/server.go +++ b/services/sharing/pkg/server/debug/server.go @@ -21,7 +21,7 @@ func Server(opts ...Option) (*http.Server, error) { ) readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration(). WithLogger(options.Logger). - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr, secureOption)). + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))). WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr)) return debug.NewService( diff --git a/services/sse/pkg/server/debug/server.go b/services/sse/pkg/server/debug/server.go index 26e785c319..f59c7ed4b3 100644 --- a/services/sse/pkg/server/debug/server.go +++ b/services/sse/pkg/server/debug/server.go @@ -24,7 +24,7 @@ func Server(opts ...Option) (*http.Server, error) { options.Config.Events.TLSRootCACertificate, ) readyHandlerConfiguration := healthHandlerConfiguration. - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)) + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))) return debug.NewService( debug.Logger(options.Logger), diff --git a/services/storage-users/pkg/server/debug/server.go b/services/storage-users/pkg/server/debug/server.go index 9c22609340..0fb71c7b72 100644 --- a/services/storage-users/pkg/server/debug/server.go +++ b/services/storage-users/pkg/server/debug/server.go @@ -21,7 +21,7 @@ func Server(opts ...Option) (*http.Server, error) { ) readyHandler := handlers.NewCheckHandler(handlers.NewCheckHandlerConfiguration(). WithLogger(options.Logger). - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr, secureOption)). + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))). WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr)), ) diff --git a/services/userlog/pkg/server/debug/server.go b/services/userlog/pkg/server/debug/server.go index 26e785c319..f59c7ed4b3 100644 --- a/services/userlog/pkg/server/debug/server.go +++ b/services/userlog/pkg/server/debug/server.go @@ -24,7 +24,7 @@ func Server(opts ...Option) (*http.Server, error) { options.Config.Events.TLSRootCACertificate, ) readyHandlerConfiguration := healthHandlerConfiguration. - WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)) + WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption, nats.Auth(options.Config.Events.AuthUsername, options.Config.Events.AuthPassword))) return debug.NewService( debug.Logger(options.Logger),