mirror of
https://github.com/harness/drone.git
synced 2025-05-07 13:49:58 +08:00
1115a5083b
This change is adding the concept of Paths. A repository and space always have a Primary Path which always is represents the ancestry to the root space. All access history / resource visibility / child listings / UI traversal / etc. is done via that path. Additionally, repos and spaces can have Alias Paths, which as the name states are aliases. via the primary path. They sole impact is that a space or repo can be reached via different paths from the UI / rest apis / git apis. This fulfills two major purposes: - Customers can rename or move projects and spaces without breaking any existing references from CI pipeliens / code bases / local repos / ... - Customer can create shorter aliases for important repos when in harness embeded mode! (acc/org/proj/repo can be shortened to acc/repo, or acc/repo' Apart from the path changes, this PR adds: Improved User facing errors Improved internal error handling and wrapping update / rename operation for repo and space path list / delete / create operation for repo and space
98 lines
2.3 KiB
Go
98 lines
2.3 KiB
Go
// Copyright 2022 Harness Inc. All rights reserved.
|
|
// Use of this source code is governed by the Polyform Free Trial License
|
|
// that can be found in the LICENSE.md file for this repository.
|
|
|
|
package authn
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/dgrijalva/jwt-go"
|
|
"github.com/harness/gitness/internal/store"
|
|
"github.com/harness/gitness/internal/token"
|
|
"github.com/harness/gitness/types"
|
|
"github.com/rs/zerolog/hlog"
|
|
)
|
|
|
|
var _ Authenticator = (*TokenAuthenticator)(nil)
|
|
|
|
/*
|
|
* Authenticates a user by checking for an access token in the
|
|
* "Authorization" header or the "access_token" form value.
|
|
*/
|
|
type TokenAuthenticator struct {
|
|
users store.UserStore
|
|
}
|
|
|
|
func NewTokenAuthenticator(userStore store.UserStore) Authenticator {
|
|
return &TokenAuthenticator{
|
|
users: userStore,
|
|
}
|
|
}
|
|
|
|
func (a *TokenAuthenticator) Authenticate(r *http.Request) (*types.User, error) {
|
|
ctx := r.Context()
|
|
str := extractToken(r)
|
|
|
|
if len(str) == 0 {
|
|
return nil, nil
|
|
}
|
|
|
|
var user *types.User
|
|
parsed, err := jwt.ParseWithClaims(str, &token.Claims{}, func(token_ *jwt.Token) (interface{}, error) {
|
|
sub := token_.Claims.(*token.Claims).Subject
|
|
id, err := strconv.ParseInt(sub, 10, 64)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
user, err = a.users.Find(ctx, id)
|
|
if err != nil {
|
|
hlog.FromRequest(r).
|
|
Error().Err(err).
|
|
Int64("user", id).
|
|
Msg("cannot find user")
|
|
return nil, fmt.Errorf("Failed to get user info: %s", err)
|
|
}
|
|
return []byte(user.Salt), nil
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if parsed.Valid == false {
|
|
return nil, errors.New("Invalid token")
|
|
}
|
|
|
|
if _, ok := parsed.Method.(*jwt.SigningMethodHMAC); !ok {
|
|
return nil, errors.New("Invalid token")
|
|
}
|
|
|
|
// this code should be deprecated, since the jwt.ParseWithClaims
|
|
// should fail if the token is expired. TODO remove once we have
|
|
// proper unit tests in place.
|
|
if claims, ok := parsed.Claims.(*token.Claims); ok {
|
|
if claims.ExpiresAt > 0 {
|
|
if time.Now().Unix() > claims.ExpiresAt {
|
|
return nil, errors.New("Expired token")
|
|
}
|
|
}
|
|
}
|
|
|
|
return user, nil
|
|
}
|
|
|
|
func extractToken(r *http.Request) string {
|
|
bearer := r.Header.Get("Authorization")
|
|
if bearer == "" {
|
|
return r.FormValue("access_token")
|
|
}
|
|
bearer = strings.TrimPrefix(bearer, "Bearer ")
|
|
bearer = strings.TrimPrefix(bearer, "IdentityService ")
|
|
return bearer
|
|
}
|