lit: create litMacValidator

a type which implements the macaroons.MacaroonValidator interface which
purely authenticates a call against LiT's macaroon service. Then, make
this available to the rpc proxy. It is not used yet.

Author: ellemouton

rpc_proxy.go

@@ -66,7 +66,8 @@ func (e *proxyErr) Unwrap() error {
 // newRpcProxy creates a new RPC proxy that can take any native gRPC, grpc-web
 // or REST request and delegate (and convert if necessary) it to the correct
 // component.
-func newRpcProxy(cfg *Config, validator macaroons.MacaroonValidator,
+func newRpcProxy(cfg *Config, validator,
+	litMacValidator macaroons.MacaroonValidator,
 	superMacValidator session.SuperMacaroonValidator,
 	permsMgr *perms.Manager, subServerMgr *subservers.Manager,
 	statusMgr *litstatus.Manager) *rpcProxy {
@@ -87,6 +88,7 @@ func newRpcProxy(cfg *Config, validator macaroons.MacaroonValidator,
 		cfg:               cfg,
 		basicAuth:         basicAuth,
 		permsMgr:          permsMgr,
+		litMacValidator:   litMacValidator,
 		macValidator:      validator,
 		superMacValidator: superMacValidator,
 		subServerMgr:      subServerMgr,
@@ -169,6 +171,7 @@ type rpcProxy struct {
 
 	bakeSuperMac bakeSuperMac
 
+	litMacValidator   macaroons.MacaroonValidator
 	macValidator      macaroons.MacaroonValidator
 	superMacValidator session.SuperMacaroonValidator
 

terminal.go

@@ -296,8 +296,8 @@ func (g *LightningTerminal) Run() error {
 	// Construct the rpcProxy. It must be initialised before the main web
 	// server is started.
 	g.rpcProxy = newRpcProxy(
-		g.cfg, g, g.validateSuperMacaroon, g.permsMgr, g.subServerMgr,
-		g.statusMgr,
+		g.cfg, g, &litMacValidator{g}, g.validateSuperMacaroon,
+		g.permsMgr, g.subServerMgr, g.statusMgr,
 	)
 
 	// Register any gRPC services that should be served using LiT's
@@ -1212,19 +1212,12 @@ func (g *LightningTerminal) ValidateMacaroon(ctx context.Context,
 	}
 
 	if g.permsMgr.IsSubServerURI(subservers.LIT, fullMethod) {
-		if !g.macaroonServiceStarted {
-			return fmt.Errorf("the macaroon service has not " +
-				"started yet")
-		}
-
-		if err := g.macaroonService.ValidateMacaroon(
+		validator := &litMacValidator{g}
+		err = validator.ValidateMacaroon(
 			ctx, requiredPermissions, fullMethod,
-		); err != nil {
-			return &proxyErr{
-				proxyContext: "lit",
-				wrapped: fmt.Errorf("invalid macaroon: %w",
-					err),
-			}
+		)
+		if err != nil {
+			return err
 		}
 	}
 
@@ -1236,6 +1229,40 @@ func (g *LightningTerminal) ValidateMacaroon(ctx context.Context,
 	return nil
 }
 
+// litMacValidator wraps the LightningTerminal struct and uses it to implement
+// the macaroons.ValidateMacaroon interface. Unlike the LightningTerminal's
+// ValidateMacaroon method which does whitelist checks and possibly uses a
+// different sub-server's macaroon validator, this implementation uses only
+// LiT's own macaroon service to verify the call.
+type litMacValidator struct {
+	*LightningTerminal
+}
+
+// ValidateMacaroon checks that the given call is properly authenticated
+// according to LiT's macaroon service.
+//
+// NOTE: This is part of the macaroons.ValidateMacaroon interface.
+func (g *litMacValidator) ValidateMacaroon(ctx context.Context,
+	requiredPermissions []bakery.Op, fullMethod string) error {
+
+	if !g.macaroonServiceStarted {
+		return fmt.Errorf("the macaroon service has not " +
+			"started yet")
+	}
+
+	if err := g.macaroonService.ValidateMacaroon(
+		ctx, requiredPermissions, fullMethod,
+	); err != nil {
+		return &proxyErr{
+			proxyContext: "lit",
+			wrapped: fmt.Errorf("invalid macaroon: %w",
+				err),
+		}
+	}
+
+	return nil
+}
+
 // Permissions returns all permissions for which the external validator of the
 // terminal is responsible.
 //