1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
package component
import (
"context"
"crypto/tls"
"errors"
"fmt"
"log/slog"
commonv1 "github.com/johnandersen777/socialweb-computer-kcp/api/common/v1alpha1"
"github.com/johnandersen777/socialweb-computer-kcp/internal/bus"
"github.com/johnandersen777/socialweb-computer-kcp/internal/contract/vault"
"github.com/johnandersen777/socialweb-computer-kcp/internal/kit/tlsreload"
)
type Trust struct {
ref *commonv1.ObjectRef
pool *tlsreload.Pool
}
func NewTrust(caRef *commonv1.ObjectRef, log *slog.Logger) *Trust {
if caRef == nil || caRef.IsZero() {
return &Trust{}
}
ref := *caRef
return &Trust{ref: &ref, pool: tlsreload.EmptyPool(log)}
}
func (t *Trust) Enabled() bool {
return t != nil && t.ref != nil
}
func (t *Trust) Client(base *tls.Config) *tls.Config {
if !t.Enabled() {
return base
}
return t.pool.ClientConfig(base)
}
func (t *Trust) Follow(ctx context.Context, in Instance) (func(), error) {
if !t.Enabled() {
return func() {}, nil
}
if in.Bus == nil {
return nil, errors.New("component: the CA ref needs the bus")
}
to := *t.ref
to.Workspace = to.InWorkspace(in.Self.Workspace)
trust, err := bus.Resolve[vault.Trust](in.Caller(ctx), in.Bus, in.Self, to,
bus.Capability{Name: vault.CapabilityRead, Scope: []string{vault.TrustScope}})
if err != nil {
return nil, fmt.Errorf("component: the CA bundle of %s: %w", to.String(), err)
}
return t.pool.Follow(ctx, trust), nil
}
