Add identity-api client and expand fetch permission rules

- Add identity.Client for device DID -> vehicle DID resolution (GraphQL)
- Wire IdentityAPIURL in config, app (optional; device DIDs require it)
- Allow fetch access with GetRawData OR (GetLocationHistory AND GetNonLocationHistory)
- Helm: IDENTITY_API_URL in values.yaml (dev) and values-prod.yaml (prod)
- Sample config: IDENTITY_API_URL in settings.sample.yaml and sample.env
- Lint: handle httpResp.Body.Close() error in identity client

Author: zer0stars

charts/fetch-api/values-prod.yaml

@@ -14,6 +14,7 @@ env:
   PARQUET_BUCKET: dimo-iceberg-prod
   VEHICLE_NFT_ADDRESS: '0xbA5738a18d83D41847dfFbDC6101d37C69c9B0cF'
   CHAIN_ID: 137
+  IDENTITY_API_URL: https://identity-api.dimo.zone/query
 ingress:
   enabled: true
   className: nginx

charts/fetch-api/values.yaml

@@ -37,6 +37,7 @@ env:
   S3_AWS_REGION: us-east-2
   VEHICLE_NFT_ADDRESS: '0x45fbCD3ef7361d156e8b16F5538AE36DEdf61Da8'
   CHAIN_ID: 80002
+  IDENTITY_API_URL: https://identity-api.dev.dimo.zone/query
 service:
   type: ClusterIP
   ports:

internal/app/app.go

@@ -12,6 +12,7 @@ import (
 	"github.com/DIMO-Network/fetch-api/internal/config"
 	"github.com/DIMO-Network/fetch-api/internal/fetch/rpc"
 	"github.com/DIMO-Network/fetch-api/internal/graph"
+	"github.com/DIMO-Network/fetch-api/internal/identity"
 	"github.com/DIMO-Network/fetch-api/internal/limits"
 	"github.com/DIMO-Network/fetch-api/pkg/eventrepo"
 	fetchgrpc "github.com/DIMO-Network/fetch-api/pkg/grpc"
@@ -50,7 +51,12 @@ func New(settings config.Settings) (*App, error) {
 	buckets := []string{settings.CloudEventBucket, settings.EphemeralBucket}
 	eventService := eventrepo.New(chConn, s3Client, settings.ParquetBucket)
 
-	gqlSrv := newGraphQLHandler(&settings, eventService, buckets, chainID)
+	var identityClient identity.Client
+	if settings.IdentityAPIURL != "" {
+		identityClient = identity.New(settings.IdentityAPIURL)
+	}
+
+	gqlSrv := newGraphQLHandler(&settings, eventService, buckets, chainID, identityClient)
 
 	jwtMiddleware, err := auth.NewJWTMiddleware(settings.TokenExchangeIssuer, settings.TokenExchangeJWTKeySetURL)
 	if err != nil {
@@ -92,12 +98,13 @@ func (a *App) Cleanup() {
 }
 
 // newGraphQLHandler creates a configured gqlgen handler.Server.
-func newGraphQLHandler(settings *config.Settings, eventService *eventrepo.Service, buckets []string, chainID uint64) *handler.Server {
+func newGraphQLHandler(settings *config.Settings, eventService *eventrepo.Service, buckets []string, chainID uint64, identityClient identity.Client) *handler.Server {
 	resolver := &graph.Resolver{
-		EventService: eventService,
-		Buckets:      buckets,
-		VehicleAddr:  settings.VehicleNFTAddress,
-		ChainID:      chainID,
+		EventService:   eventService,
+		Buckets:        buckets,
+		VehicleAddr:    settings.VehicleNFTAddress,
+		ChainID:        chainID,
+		IdentityClient: identityClient,
 	}
 
 	cfg := graph.Config{Resolvers: resolver}

internal/config/settings.go

@@ -24,4 +24,5 @@ type Settings struct {
 	S3AWSAccessKeyID          string          `yaml:"S3_AWS_ACCESS_KEY_ID"`
 	S3AWSSecretAccessKey      string          `yaml:"S3_AWS_SECRET_ACCESS_KEY"`
 	Clickhouse                config.Settings `yaml:",inline"`
+	IdentityAPIURL            string          `yaml:"IDENTITY_API_URL"`
 }

internal/graph/resolver.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/DIMO-Network/cloudevent"
 	"github.com/DIMO-Network/fetch-api/internal/graph/model"
+	"github.com/DIMO-Network/fetch-api/internal/identity"
 	"github.com/DIMO-Network/fetch-api/pkg/eventrepo"
 	"github.com/DIMO-Network/fetch-api/pkg/grpc"
 	"github.com/DIMO-Network/token-exchange-api/pkg/tokenclaims"
@@ -15,17 +16,17 @@ import (
 
 // This file will not be regenerated automatically.
 //
-// It serves as dependency injection for your app, add any dependencies you require
-// here.
+// It serves as dependency injection for your app, add any dependencies you require here.
 
 // ClaimsContextKey is the context key for token claims (set by JWT middleware).
 type ClaimsContextKey struct{}
 
 type Resolver struct {
-	EventService *eventrepo.Service
-	Buckets      []string
-	VehicleAddr  common.Address
-	ChainID      uint64
+	EventService   *eventrepo.Service
+	Buckets        []string
+	VehicleAddr    common.Address
+	ChainID        uint64
+	IdentityClient identity.Client
 }
 
 // CheckVehicleRawDataByDID returns an error if the context does not have claims or the token
@@ -34,27 +35,58 @@ func CheckVehicleRawDataByDID(ctx context.Context, did string) error {
 	if _, err := cloudevent.DecodeERC721DID(did); err != nil {
 		return fmt.Errorf("invalid DID: %w", err)
 	}
+	return checkRawDataPermissionsForVehicle(ctx, did)
+}
+
+// checkRawDataPermissionsForVehicle verifies the context token has access for vehicleDID.
+// vehicleDID must already be validated.
+// Allowed: GetRawData, or both GetLocationHistory (all-time location) and GetNonLocationHistory.
+func checkRawDataPermissionsForVehicle(ctx context.Context, vehicleDID string) error {
 	tok, _ := ctx.Value(ClaimsContextKey{}).(*tokenclaims.Token)
 	if tok == nil {
 		return fmt.Errorf("unauthorized: no token claims")
 	}
-	if tok.Asset != did {
+	if tok.Asset != vehicleDID {
 		return fmt.Errorf("unauthorized: token does not have access to this vehicle")
 	}
-	if !slices.Contains(tok.Permissions, tokenclaims.PermissionGetRawData) {
-		return fmt.Errorf("unauthorized: missing GetRawData privilege")
+	hasGetRawData := slices.Contains(tok.Permissions, tokenclaims.PermissionGetRawData)
+	hasLocationHistory := slices.Contains(tok.Permissions, tokenclaims.PermissionGetLocationHistory)
+	hasNonLocationHistory := slices.Contains(tok.Permissions, tokenclaims.PermissionGetNonLocationHistory)
+	hasAllTimeData := hasLocationHistory && hasNonLocationHistory
+	if !hasGetRawData && !hasAllTimeData {
+		return fmt.Errorf("unauthorized: token does not have access to this vehicle")
 	}
 	return nil
 }
 
-// requireVehicleOptsByDID validates access by DID and returns search options for the vehicle.
+// requireVehicleOptsByDID validates raw-data access and returns search options for the DID.
+//
+// If did belongs to the vehicle NFT contract (r.VehicleAddr), the token asset must match that
+// vehicle DID directly. Otherwise the DID is treated as a device DID: identity-api is called
+// to resolve the paired vehicle, and the token must have access to that vehicle. Either way,
+// the search subject is always the originally requested DID.
 func (r *queryResolver) requireVehicleOptsByDID(ctx context.Context, did string, filter *model.CloudEventFilter) (*grpc.SearchOptions, error) {
-	if err := CheckVehicleRawDataByDID(ctx, did); err != nil {
-		return nil, err
-	}
-	subject, err := cloudevent.DecodeERC721DID(did)
+	decoded, err := cloudevent.DecodeERC721DID(did)
 	if err != nil {
 		return nil, fmt.Errorf("invalid DID: %w", err)
 	}
-	return filterToSearchOptions(filter, subject), nil
+
+	var vehicleDID string
+	if decoded.ContractAddress == r.VehicleAddr {
+		vehicleDID = did
+	} else {
+		if r.IdentityClient == nil {
+			return nil, fmt.Errorf("device DID lookup not configured: no identity client")
+		}
+		vehicleDID, err = r.IdentityClient.GetVehicleDIDForDevice(ctx, did)
+		if err != nil {
+			return nil, fmt.Errorf("failed to resolve vehicle for device DID: %w", err)
+		}
+	}
+
+	if err := checkRawDataPermissionsForVehicle(ctx, vehicleDID); err != nil {
+		return nil, err
+	}
+
+	return filterToSearchOptions(filter, decoded), nil
 }