authz: Add onPolicyUpdate callback to file watcher.

Signed-off-by: Keith Collister <kcollister@google.com>

Author: hnefatl

authz/grpc_authz_server_interceptors.go

@@ -97,19 +97,28 @@ type FileWatcherInterceptor struct {
 	policyContents      []byte
 	refreshDuration     time.Duration
 	cancel              context.CancelFunc
+	onPolicyUpdate      func()
 }
 
 // NewFileWatcher returns a new FileWatcherInterceptor from a policy file
 // that contains JSON string of authorization policy and a refresh duration to
 // specify the amount of time between policy refreshes.
 func NewFileWatcher(file string, duration time.Duration) (*FileWatcherInterceptor, error) {
+	return NewFileWatcherWithCallback(file, duration, func() {})
+}
+
+// NewFileWatcherWithCallback returns a new FileWatcherInterceptor from a policy file
+// that contains JSON string of authorization policy and a refresh duration to
+// specify the amount of time between policy refreshes. The callback is invoked when
+// a policy is loaded.
+func NewFileWatcherWithCallback(file string, duration time.Duration, onPolicyUpdate func()) (*FileWatcherInterceptor, error) {
 	if file == "" {
 		return nil, fmt.Errorf("authorization policy file path is empty")
 	}
 	if duration <= time.Duration(0) {
 		return nil, fmt.Errorf("requires refresh interval(%v) greater than 0s", duration)
 	}
-	i := &FileWatcherInterceptor{policyFile: file, refreshDuration: duration}
+	i := &FileWatcherInterceptor{policyFile: file, refreshDuration: duration, onPolicyUpdate: onPolicyUpdate}
 	if err := i.updateInternalInterceptor(); err != nil {
 		return nil, err
 	}
@@ -155,6 +164,7 @@ func (i *FileWatcherInterceptor) updateInternalInterceptor() error {
 	}
 	atomic.StorePointer(&i.internalInterceptor, unsafe.Pointer(interceptor))
 	logger.Infof("authorization policy reload status: successfully loaded new policy %v", policyContentsString)
+	i.onPolicyUpdate()
 	return nil
 }
 

authz/grpc_authz_server_interceptors_test.go

@@ -118,3 +118,35 @@ func (s) TestNewFileWatcher(t *testing.T) {
 		})
 	}
 }
+
+func (s) TestOnPolicyUpdate(t *testing.T) {
+	updateCount := 0
+	updates := make(chan int, 2)
+	onPolicyUpdate := func() {
+		updateCount++
+		updates <- updateCount
+	}
+
+	file := createTmpPolicyFile(t, "onpolicyupdate", []byte(`{"name": "foo1", "allow_rules":[{"name":"bar"}]}`))
+	i, err := authz.NewFileWatcherWithCallback(file, time.Millisecond, onPolicyUpdate)
+	if err != nil {
+		t.Fatalf("NewFileWatcherWithCallback() returned err: %v", err)
+	}
+	defer i.Close()
+	if <-updates != 1 {
+		t.Fatalf("expected updateCount=1 after first call of NewFileWatcherWithCallback()")
+	}
+
+	// Tweak the file, expect an update.
+	if err := os.WriteFile(file, []byte(`{"name": "foo2", "allow_rules":[{"name":"bar"}]}`), os.ModePerm); err != nil {
+		t.Fatalf("os.WriteFile(%q) failed: %v", file, err)
+	}
+
+	if <-updates != 2 {
+		t.Fatalf("expected updateCount=2 after second call of NewFileWatcherWithCallback()")
+	}
+	close(updates)
+	if len(updates) != 0 {
+		t.Fatalf("expected exactly 2 updates in channel")
+	}
+}