mirror of
https://github.com/harness/drone.git
synced 2025-05-12 23:20:10 +08:00
124 lines
3.3 KiB
Go
124 lines
3.3 KiB
Go
// Copyright 2022 Harness Inc. All rights reserved.
|
|
// Use of this source code is governed by the Polyform Free Trial License
|
|
// that can be found in the LICENSE.md file for this repository.
|
|
|
|
package authn
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/harness/gitness/internal/api/request"
|
|
"github.com/harness/gitness/internal/auth"
|
|
"github.com/harness/gitness/internal/store"
|
|
"github.com/harness/gitness/internal/token"
|
|
"github.com/harness/gitness/types"
|
|
|
|
"github.com/dgrijalva/jwt-go"
|
|
)
|
|
|
|
var _ Authenticator = (*TokenAuthenticator)(nil)
|
|
|
|
/*
|
|
* Authenticates a user by checking for an access token in the
|
|
* "Authorization" header or the "access_token" form value.
|
|
*/
|
|
type TokenAuthenticator struct {
|
|
principalStore store.PrincipalStore
|
|
tokenStore store.TokenStore
|
|
}
|
|
|
|
func NewTokenAuthenticator(
|
|
principalStore store.PrincipalStore,
|
|
tokenStore store.TokenStore) *TokenAuthenticator {
|
|
return &TokenAuthenticator{
|
|
principalStore: principalStore,
|
|
tokenStore: tokenStore,
|
|
}
|
|
}
|
|
|
|
func (a *TokenAuthenticator) Authenticate(r *http.Request, sourceRouter SourceRouter) (*auth.Session, error) {
|
|
ctx := r.Context()
|
|
str := extractToken(r)
|
|
|
|
if len(str) == 0 {
|
|
return nil, ErrNoAuthData
|
|
}
|
|
|
|
var principal *types.Principal
|
|
var err error
|
|
claims := &token.JWTClaims{}
|
|
parsed, err := jwt.ParseWithClaims(str, claims, func(token_ *jwt.Token) (interface{}, error) {
|
|
principal, err = a.principalStore.Find(ctx, claims.PrincipalID)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to get principal for token: %w", err)
|
|
}
|
|
return []byte(principal.Salt), nil
|
|
})
|
|
if err != nil {
|
|
return nil, fmt.Errorf("parsing of JWT claims failed: %w", err)
|
|
}
|
|
|
|
if !parsed.Valid {
|
|
return nil, errors.New("parsed JWT token is invalid")
|
|
}
|
|
|
|
if _, ok := parsed.Method.(*jwt.SigningMethodHMAC); !ok {
|
|
return nil, errors.New("invalid HMAC signature for JWT")
|
|
}
|
|
|
|
// ensure tkn exists
|
|
tkn, err := a.tokenStore.Find(ctx, claims.TokenID)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to find token in db: %w", err)
|
|
}
|
|
|
|
// protect against faked JWTs for other principals in case of single salt leak
|
|
if principal.ID != tkn.PrincipalID {
|
|
return nil, fmt.Errorf("JWT was for principal %d while db token was for principal %d",
|
|
principal.ID, tkn.PrincipalID)
|
|
}
|
|
|
|
return &auth.Session{
|
|
Principal: *principal,
|
|
Metadata: &auth.TokenMetadata{
|
|
TokenType: tkn.Type,
|
|
TokenID: tkn.ID,
|
|
Grants: tkn.Grants,
|
|
},
|
|
}, nil
|
|
}
|
|
|
|
func extractToken(r *http.Request) string {
|
|
// Check query param first (as that's most immediately visible to caller)
|
|
if queryToken, ok := request.GetAccessTokenFromQuery(r); ok {
|
|
return queryToken
|
|
}
|
|
|
|
// check authorization header next
|
|
headerToken := r.Header.Get(request.HeaderAuthorization)
|
|
switch {
|
|
// in case of git push / pull it would be basic auth and token is in password
|
|
case strings.HasPrefix(headerToken, "Basic "):
|
|
// return pwd either way - if it's invalid pwd is empty string which we'd return anyway
|
|
_, pwd, _ := r.BasicAuth()
|
|
return pwd
|
|
// strip bearer prefix if present
|
|
case strings.HasPrefix(headerToken, "Bearer "):
|
|
return headerToken[7:]
|
|
// otherwise use value as is
|
|
case headerToken != "":
|
|
return headerToken
|
|
}
|
|
|
|
// check cookies last (as that's least visible to caller)
|
|
if cookieToken, ok := request.GetTokenFromCookie(r); ok {
|
|
return cookieToken
|
|
}
|
|
|
|
// no token found
|
|
return ""
|
|
}
|