Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

include tenant in token #61

Merged
merged 3 commits into from
Oct 24, 2024
Merged

include tenant in token #61

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d83ce65
tenant in token support + verification
ice-cronus Oct 22, 2024
87453a8
allow to parse tokens without verification to extract other tenant's …
ice-cronus Oct 24, 2024
30d97ee
Revert "tenant in token support + verification"
ice-cronus Oct 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions auth/auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ func New(ctx context.Context, applicationYAMLKey string) Client {

func (a *auth) VerifyToken(ctx context.Context, token string) (*Token, error) {
var authToken *Token
if err := iceauth.DetectIceToken(token); err != nil {
if _, err := iceauth.DetectIceToken(token); err != nil {
if a.fb == nil {
return nil, errors.Errorf("non-ice token, but firebase auth is disabled")
}
Expand Down Expand Up @@ -148,9 +148,14 @@ func (a *auth) GenerateMetadata(
return md, errors.Wrapf(err, "failed to generate metadata token for tokenID:%v", tokenID)
}

func (a *auth) ParseToken(token string) (*IceToken, error) {
res := new(IceToken)
err := a.ice.VerifyTokenFields(token, res)
//nolint:revive // .
func (a *auth) ParseToken(token string, verify bool) (res *IceToken, err error) {
if verify {
res = new(IceToken)
err = a.ice.VerifyTokenFields(token, res)
} else {
res, err = iceauth.DetectIceToken(token)
}

return res, errors.Wrapf(err, "can't verify token fields for:%v", token)
}
6 changes: 3 additions & 3 deletions auth/auth_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,7 +213,7 @@ func TestParseToken_Parse(t *testing.T) { //nolint:funlen // .
assert.NotEmpty(t, refreshToken)
assert.NotEmpty(t, accessToken)

accessRes, err := client.ParseToken(accessToken)
accessRes, err := client.ParseToken(accessToken, true)
require.NoError(t, err)
issuer, err := accessRes.GetIssuer()
require.NoError(t, err)
Expand All @@ -228,9 +228,9 @@ func TestParseToken_Parse(t *testing.T) { //nolint:funlen // .
assert.Equal(t, hashCode, accessRes.HashCode)
assert.Equal(t, seq, accessRes.Seq)

refreshRes, err := client.ParseToken(refreshToken)
refreshRes, err := client.ParseToken(refreshToken, true)
require.NoError(t, err)
accessRes, err = client.ParseToken(accessToken)
accessRes, err = client.ParseToken(accessToken, true)
require.NoError(t, err)
issuer, err = refreshRes.GetIssuer()
require.NoError(t, err)
Expand Down
2 changes: 1 addition & 1 deletion auth/contract.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ type (
IceToken = iceauth.Token
Client interface {
VerifyToken(ctx context.Context, token string) (*Token, error)
ParseToken(token string) (*IceToken, error)
ParseToken(token string, verify bool) (*IceToken, error)
UpdateCustomClaims(ctx context.Context, userID string, customClaims map[string]any) error
DeleteUser(ctx context.Context, userID string) error
UpdateEmail(ctx context.Context, userID, email string) error
Expand Down
10 changes: 5 additions & 5 deletions auth/internal/ice/auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,21 +71,21 @@ func (a *auth) VerifyTokenFields(jwtToken string, res jwt.Claims) error {
return nil
}

func DetectIceToken(jwtToken string) error {
func DetectIceToken(jwtToken string) (*Token, error) {
parser := jwt.NewParser()
var claims Token
token, _, err := parser.ParseUnverified(jwtToken, &claims)
if err != nil {
return errors.Wrapf(err, "parse unverified error for token:%v", jwtToken)
return nil, errors.Wrapf(err, "parse unverified error for token:%v", jwtToken)
}
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok || token.Method.Alg() != jwt.SigningMethodHS256.Name {
return errors.Errorf("unexpected signing method:%v", token.Header["alg"])
return nil, errors.Errorf("unexpected signing method:%v", token.Header["alg"])
}
if iss, iErr := token.Claims.GetIssuer(); iErr != nil || (iss != internal.AccessJwtIssuer && iss != internal.RefreshJwtIssuer) {
return errors.Wrapf(ErrInvalidToken, "invalid issuer:%v", iss)
return nil, errors.Wrapf(ErrInvalidToken, "invalid issuer:%v", iss)
}

return nil
return &claims, nil
}

func (a *auth) verify() func(token *jwt.Token) (any, error) {
Expand Down
32 changes: 16 additions & 16 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,19 +38,19 @@ require (
github.com/xlzd/gotp v0.1.0
github.com/zeebo/xxh3 v1.0.2
golang.org/x/net v0.30.0
google.golang.org/api v0.201.0
google.golang.org/api v0.203.0
)

require (
cel.dev/expr v0.16.2 // indirect
cel.dev/expr v0.18.0 // indirect
cloud.google.com/go v0.116.0 // indirect
cloud.google.com/go/auth v0.9.8 // indirect
cloud.google.com/go/auth v0.9.9 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.4 // indirect
cloud.google.com/go/compute/metadata v0.5.2 // indirect
cloud.google.com/go/firestore v1.17.0 // indirect
cloud.google.com/go/iam v1.2.1 // indirect
cloud.google.com/go/longrunning v0.6.1 // indirect
cloud.google.com/go/monitoring v1.21.1 // indirect
cloud.google.com/go/iam v1.2.2 // indirect
cloud.google.com/go/longrunning v0.6.2 // indirect
cloud.google.com/go/monitoring v1.21.2 // indirect
cloud.google.com/go/storage v1.45.0 // indirect
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.24.3 // indirect
Expand All @@ -59,10 +59,10 @@ require (
github.com/KyleBanks/depth v1.2.1 // indirect
github.com/MicahParks/keyfunc v1.9.0 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/Microsoft/hcsshim v0.12.7 // indirect
github.com/Microsoft/hcsshim v0.12.8 // indirect
github.com/andybalholm/brotli v1.1.1 // indirect
github.com/bytedance/sonic v1.12.3 // indirect
github.com/bytedance/sonic/loader v0.2.0 // indirect
github.com/bytedance/sonic/loader v0.2.1 // indirect
github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/cloudflare/circl v1.5.0 // indirect
Expand All @@ -71,7 +71,6 @@ require (
github.com/cncf/xds/go v0.0.0-20240905190251-b4127c9b8d78 // indirect
github.com/containerd/cgroups/v3 v3.0.3 // indirect
github.com/containerd/containerd v1.7.23 // indirect
github.com/containerd/errdefs v0.3.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
github.com/distribution/reference v0.6.0 // indirect
Expand Down Expand Up @@ -102,7 +101,7 @@ require (
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/mock v1.6.0 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/pprof v0.0.0-20241017200806-017d972448fc // indirect
github.com/google/pprof v0.0.0-20241023014458-598669927662 // indirect
github.com/google/s2a-go v0.1.8 // indirect
github.com/google/tink/go v1.7.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
Expand All @@ -124,20 +123,21 @@ require (
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/moby/sys/mount v0.3.4 // indirect
github.com/moby/sys/mountinfo v0.7.2 // indirect
github.com/moby/sys/user v0.3.0 // indirect
github.com/moby/term v0.5.0 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/morikuni/aec v1.0.0 // indirect
github.com/onsi/ginkgo/v2 v2.20.2 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.1.0 // indirect
github.com/opencontainers/runc v1.1.15 // indirect
github.com/opencontainers/runc v1.2.0 // indirect
github.com/pelletier/go-toml/v2 v2.2.3 // indirect
github.com/pierrec/lz4/v4 v4.1.21 // indirect
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/quic-go/qpack v0.5.1 // indirect
github.com/quic-go/quic-go v0.48.0 // indirect
github.com/quic-go/quic-go v0.48.1 // indirect
github.com/refraction-networking/utls v1.6.7 // indirect
github.com/sagikazarmark/locafero v0.6.0 // indirect
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
Expand Down Expand Up @@ -174,11 +174,11 @@ require (
golang.org/x/time v0.7.0 // indirect
golang.org/x/tools v0.26.0 // indirect
google.golang.org/appengine/v2 v2.0.6 // indirect
google.golang.org/genproto v0.0.0-20241015192408-796eee8c2d53 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20241015192408-796eee8c2d53 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53 // indirect
google.golang.org/genproto v0.0.0-20241021214115-324edc3d5d38 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20241021214115-324edc3d5d38 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38 // indirect
google.golang.org/grpc v1.67.1 // indirect
google.golang.org/grpc/stats/opentelemetry v0.0.0-20241018153737-98959d9a4904 // indirect
google.golang.org/grpc/stats/opentelemetry v0.0.0-20241023165937-8212cf037683 // indirect
google.golang.org/protobuf v1.35.1 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
Expand Down
Loading
Loading