Custom Headers on authzed-node client SpiceDB #spicedb

Custom Headers on authzed-node client

blitz2145

09/08/2023, 8:39 PM

Hey folks, does anyone have an example of passing some custom headers to the authzed/node client? I see we can pass through grpc options, and I think I need to construct a grpc Metadata object,

Copy code

const metadata = new grpc.Metadata();
  metadata.add('X-Serverless-Authorization', 'stuff');

then pass it here: https://github.com/authzed/authzed-node/blob/main/src/v1.ts#L61 But I think I'm missing some intermediate steps to make an interceptor? Haven't seen any worked out examples

blitz2145

09/08/2023, 9:46 PM

I figured this out, using an interceptor,

Copy code

js
  const client = v1.NewClient(
    process.env.AUTHZED_TOKEN,
    // isDevelopment ? 'localhost:50051' : process.env.AUTHZED_URL,
    isDevelopment ? process.env.AUTHZED_URL : process.env.AUTHZED_URL,
    // isDevelopment
    //   ? v1.ClientSecurity.INSECURE_PLAINTEXT_CREDENTIALS
    //   : undefined,
    undefined,
    undefined,
    {
      interceptors: [
        (options, nextCall) => {
          return new grpc.InterceptingCall(nextCall(options), {
            start: (metadata, listener, next) => {
              metadata.add(
                'Your_HEADER',
                `Bearer ${process.env.YOUR_TOKEN}`
              );
              next(metadata, listener);
            },
          });
        },
      ],
    }
  ).promises;

grpc in JS really needs way better DX.

Joey

09/08/2023, 9:47 PM

yeah, it kind of sucks

Joey

09/08/2023, 9:47 PM

what are you trying to accomplish?

blitz2145

09/08/2023, 10:16 PM

We are self hosting an authzed staging env, and cloud run needs its own auth header passed through.

blitz2145

09/08/2023, 10:17 PM

Also wished the authzed node client took an options object rather than separate args, more idiomatic.

vroldanbet

09/09/2023, 10:22 AM

Are you running it in Cloud Run? Would you mind sharing details on how to make it run there?

vroldanbet

09/09/2023, 10:23 AM

I assume dispatch won't work

blitz2145

09/09/2023, 11:41 PM

Will do later, trying to run it in cloud run ya

blitz2145

09/12/2023, 6:30 PM

Got it working, ended up using custom grpc creds, and writing code to create Metadata with both the

Authorization

and

X-Serverless-Authorization

headers.

Copy code

ts
    const sslCreds = credentials.createSsl();
    const auth = new GoogleAuth();
    const idTokenClient = await auth.getIdTokenClient(
      `https://${authzedEndpoint}`
    );
    const callCreds = createFromGoogleCredential(idTokenClient);
    const creds = credentials.combineChannelCredentials(sslCreds, callCreds);

    client = v1.NewClientWithChannelCredentials(
      authzedEndpoint,
      creds
    ).promises;

Previous Next