API: Add authorization hook (v3)

internal/rest/access/authentication.go

@@ -132,6 +132,10 @@ func Authenticate(s types.State, r *http.Request, hostAddress string, trustedCer
 
 	switch r.Host {
 	case hostAddrPort.WithZone("").String():
+		if intState.Hooks != nil && intState.Hooks.OnAuthenticate != nil {
+			return intState.Hooks.OnAuthenticate(r.Context(), s, r, trustedCerts)
+		}
+
 		if r.TLS != nil {
 			for _, cert := range r.TLS.PeerCertificates {
 				trusted, fingerprint := checkMutualTLS(r.Context(), *cert, trustedCerts)

microcluster/app.go

@@ -141,7 +141,7 @@ func (m *MicroCluster) Status(ctx context.Context) (*types.Status, error) {
 func (m *MicroCluster) Ready(ctx context.Context) error {
 	logger := slog.New(m.args.LogHandler)
 
-	finger := make(chan error, 1)
+	finger := make(chan struct{}, 1)
 	var errLast error
 	go func() {
 		for i := 0; ; i++ {
@@ -185,7 +185,7 @@ func (m *MicroCluster) Ready(ctx context.Context) error {
 				continue
 			}
 
-			finger <- nil
+			finger <- struct{}{}
 			return
 		}
 	}()

microcluster/types/hooks.go

@@ -1,6 +1,10 @@
 package types
 
-import "context"
+import (
+	"context"
+	"crypto/x509"
+	"net/http"
+)
 
 // HookType represents the various types of hooks available to microcluster.
 type HookType string
@@ -89,4 +93,12 @@ type Hooks struct {
 
 	// OnDaemonConfigUpdate is a post-action hook that is run on all cluster members when any cluster member receives a local configuration update.
 	OnDaemonConfigUpdate func(ctx context.Context, s State, config DaemonConfig) error
+
+	// OnAuthenticate is run when an incoming HTTP request needs to be authenticated.
+	// If defined it is used as a replacement for the regular mTLS check.
+	// trustedCerts contains the certs from the truststore.
+	// Returning true indicates that the request is trusted.
+	// Returning false indicates that the request is not trusted.
+	// Returning an error is optional but will always result in a forbidden request.
+	OnAuthenticate func(ctx context.Context, s State, r *http.Request, trustedCerts map[string]x509.Certificate) (bool, error)
 }