ptp wireguard

.configs/gqlgen.yaml

@@ -66,6 +66,7 @@ autobind:
   - "github.com/nais/api/internal/servicemaintenance"
   - "github.com/nais/api/internal/servicemaintenance/activitylog"
   - "github.com/nais/api/internal/team"
+  - "github.com/nais/api/internal/tunnel"
   - "github.com/nais/api/internal/unleash"
   - "github.com/nais/api/internal/user"
   - "github.com/nais/api/internal/usersync"

internal/auth/authz/queries.go

@@ -314,6 +314,10 @@ func CanCreateAivenCredentials(ctx context.Context, teamSlug slug.Slug) error {
 	return requireTeamAuthorization(ctx, teamSlug, "aiven:credentials:create")
 }
 
+func CanCreateTunnel(ctx context.Context, teamSlug slug.Slug) error {
+	return requireTeamAuthorization(ctx, teamSlug, "tunnels:create")
+}
+
 func RequireGlobalAdmin(ctx context.Context) error {
 	if ActorFromContext(ctx).User.IsAdmin() {
 		return nil

internal/cmd/api/http.go

@@ -50,6 +50,7 @@ import (
 	"github.com/nais/api/internal/thirdparty/hookd"
 	"github.com/nais/api/internal/thirdparty/promclient"
 	promfake "github.com/nais/api/internal/thirdparty/promclient/fake"
+	"github.com/nais/api/internal/tunnel"
 	"github.com/nais/api/internal/unleash"
 	"github.com/nais/api/internal/user"
 	"github.com/nais/api/internal/usersync"
@@ -311,6 +312,7 @@ func ConfigureGraph(
 		ctx = session.NewLoaderContext(ctx, pool)
 		ctx = search.NewLoaderContext(ctx, pool, searcher)
 		ctx = unleash.NewLoaderContext(ctx, tenantName, watchers.UnleashWatcher, bifrostAPIURL, allowedClusters, log)
+		ctx = tunnel.WithLoaders(ctx, tunnel.NewLoaders(watchers.TunnelWatcher))
 		ctx = logging.NewPackageContext(ctx, tenantName, defaultLogDestinations)
 		ctx = environment.NewLoaderContext(ctx, pool)
 		ctx = feature.NewLoaderContext(

internal/database/migrations/0063_add_tunnel_authorization.sql

@@ -0,0 +1,27 @@
+-- +goose Up
+INSERT INTO
+	authorizations (name, description)
+VALUES
+	(
+		'tunnels:create',
+		'Permission to create WireGuard tunnels.'
+	)
+;
+
+INSERT INTO
+	role_authorizations (role_name, authorization_name)
+VALUES
+	('Team member', 'tunnels:create'),
+	('Team owner', 'tunnels:create')
+;
+
+-- +goose Down
+DELETE FROM role_authorizations
+WHERE
+	authorization_name = 'tunnels:create'
+;
+
+DELETE FROM authorizations
+WHERE
+	name = 'tunnels:create'
+;