mirror of https://github.com/grafana/grafana
Merge pull request #15239 from grafana/auth_token_middleware_refactor
Auth token package and middleware refactoringpull/15198/head^2
Marcus Efraimsson
7 years ago
committed by
GitHub
commit
c71904e326
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,32 @@ |
||||
package models |
||||
|
||||
import "errors" |
||||
|
||||
// Typed errors
|
||||
var ( |
||||
ErrUserTokenNotFound = errors.New("user token not found") |
||||
) |
||||
|
||||
// UserToken represents a user token
|
||||
type UserToken struct { |
||||
Id int64 |
||||
UserId int64 |
||||
AuthToken string |
||||
PrevAuthToken string |
||||
UserAgent string |
||||
ClientIp string |
||||
AuthTokenSeen bool |
||||
SeenAt int64 |
||||
RotatedAt int64 |
||||
CreatedAt int64 |
||||
UpdatedAt int64 |
||||
UnhashedToken string |
||||
} |
||||
|
||||
// UserTokenService are used for generating and validating user tokens
|
||||
type UserTokenService interface { |
||||
CreateToken(userId int64, clientIP, userAgent string) (*UserToken, error) |
||||
LookupToken(unhashedToken string) (*UserToken, error) |
||||
TryRotateToken(token *UserToken, clientIP, userAgent string) (bool, error) |
||||
RevokeToken(token *UserToken) error |
||||
} |
||||
@ -1,38 +0,0 @@ |
||||
package auth |
||||
|
||||
import ( |
||||
"context" |
||||
"time" |
||||
) |
||||
|
||||
func (srv *UserAuthTokenServiceImpl) Run(ctx context.Context) error { |
||||
ticker := time.NewTicker(time.Hour * 12) |
||||
deleteSessionAfter := time.Hour * 24 * time.Duration(srv.Cfg.LoginDeleteExpiredTokensAfterDays) |
||||
|
||||
for { |
||||
select { |
||||
case <-ticker.C: |
||||
srv.ServerLockService.LockAndExecute(ctx, "delete old sessions", time.Hour*12, func() { |
||||
srv.deleteOldSession(deleteSessionAfter) |
||||
}) |
||||
|
||||
case <-ctx.Done(): |
||||
return ctx.Err() |
||||
} |
||||
} |
||||
} |
||||
|
||||
func (srv *UserAuthTokenServiceImpl) deleteOldSession(deleteSessionAfter time.Duration) (int64, error) { |
||||
sql := `DELETE from user_auth_token WHERE rotated_at < ?` |
||||
|
||||
deleteBefore := getTime().Add(-deleteSessionAfter) |
||||
res, err := srv.SQLStore.NewSession().Exec(sql, deleteBefore.Unix()) |
||||
if err != nil { |
||||
return 0, err |
||||
} |
||||
|
||||
affected, err := res.RowsAffected() |
||||
srv.log.Info("deleted old sessions", "count", affected) |
||||
|
||||
return affected, err |
||||
} |
||||
@ -1,36 +0,0 @@ |
||||
package auth |
||||
|
||||
import ( |
||||
"fmt" |
||||
"testing" |
||||
"time" |
||||
|
||||
. "github.com/smartystreets/goconvey/convey" |
||||
) |
||||
|
||||
func TestUserAuthTokenCleanup(t *testing.T) { |
||||
|
||||
Convey("Test user auth token cleanup", t, func() { |
||||
ctx := createTestContext(t) |
||||
|
||||
insertToken := func(token string, prev string, rotatedAt int64) { |
||||
ut := userAuthToken{AuthToken: token, PrevAuthToken: prev, RotatedAt: rotatedAt, UserAgent: "", ClientIp: ""} |
||||
_, err := ctx.sqlstore.NewSession().Insert(&ut) |
||||
So(err, ShouldBeNil) |
||||
} |
||||
|
||||
// insert three old tokens that should be deleted
|
||||
for i := 0; i < 3; i++ { |
||||
insertToken(fmt.Sprintf("oldA%d", i), fmt.Sprintf("oldB%d", i), int64(i)) |
||||
} |
||||
|
||||
// insert three active tokens that should not be deleted
|
||||
for i := 0; i < 3; i++ { |
||||
insertToken(fmt.Sprintf("newA%d", i), fmt.Sprintf("newB%d", i), getTime().Unix()) |
||||
} |
||||
|
||||
affected, err := ctx.tokenService.deleteOldSession(time.Hour) |
||||
So(err, ShouldBeNil) |
||||
So(affected, ShouldEqual, 3) |
||||
}) |
||||
} |
||||
@ -0,0 +1,57 @@ |
||||
package auth |
||||
|
||||
import ( |
||||
"context" |
||||
"time" |
||||
) |
||||
|
||||
func (srv *UserAuthTokenService) Run(ctx context.Context) error { |
||||
ticker := time.NewTicker(time.Hour) |
||||
maxInactiveLifetime := time.Duration(srv.Cfg.LoginMaxInactiveLifetimeDays) * 24 * time.Hour |
||||
maxLifetime := time.Duration(srv.Cfg.LoginMaxLifetimeDays) * 24 * time.Hour |
||||
|
||||
err := srv.ServerLockService.LockAndExecute(ctx, "cleanup expired auth tokens", time.Hour*12, func() { |
||||
srv.deleteExpiredTokens(maxInactiveLifetime, maxLifetime) |
||||
}) |
||||
if err != nil { |
||||
srv.log.Error("failed to lock and execite cleanup of expired auth token", "erro", err) |
||||
} |
||||
|
||||
for { |
||||
select { |
||||
case <-ticker.C: |
||||
err := srv.ServerLockService.LockAndExecute(ctx, "cleanup expired auth tokens", time.Hour*12, func() { |
||||
srv.deleteExpiredTokens(maxInactiveLifetime, maxLifetime) |
||||
}) |
||||
|
||||
if err != nil { |
||||
srv.log.Error("failed to lock and execite cleanup of expired auth token", "erro", err) |
||||
} |
||||
|
||||
case <-ctx.Done(): |
||||
return ctx.Err() |
||||
} |
||||
} |
||||
} |
||||
|
||||
func (srv *UserAuthTokenService) deleteExpiredTokens(maxInactiveLifetime, maxLifetime time.Duration) (int64, error) { |
||||
createdBefore := getTime().Add(-maxLifetime) |
||||
rotatedBefore := getTime().Add(-maxInactiveLifetime) |
||||
|
||||
srv.log.Debug("starting cleanup of expired auth tokens", "createdBefore", createdBefore, "rotatedBefore", rotatedBefore) |
||||
|
||||
sql := `DELETE from user_auth_token WHERE created_at <= ? OR rotated_at <= ?` |
||||
res, err := srv.SQLStore.NewSession().Exec(sql, createdBefore.Unix(), rotatedBefore.Unix()) |
||||
if err != nil { |
||||
return 0, err |
||||
} |
||||
|
||||
affected, err := res.RowsAffected() |
||||
if err != nil { |
||||
srv.log.Error("failed to cleanup expired auth tokens", "error", err) |
||||
return 0, nil |
||||
} |
||||
|
||||
srv.log.Info("cleanup of expired auth tokens done", "count", affected) |
||||
return affected, err |
||||
} |
||||
@ -0,0 +1,68 @@ |
||||
package auth |
||||
|
||||
import ( |
||||
"fmt" |
||||
"testing" |
||||
"time" |
||||
|
||||
. "github.com/smartystreets/goconvey/convey" |
||||
) |
||||
|
||||
func TestUserAuthTokenCleanup(t *testing.T) { |
||||
|
||||
Convey("Test user auth token cleanup", t, func() { |
||||
ctx := createTestContext(t) |
||||
ctx.tokenService.Cfg.LoginMaxInactiveLifetimeDays = 7 |
||||
ctx.tokenService.Cfg.LoginMaxLifetimeDays = 30 |
||||
|
||||
insertToken := func(token string, prev string, createdAt, rotatedAt int64) { |
||||
ut := userAuthToken{AuthToken: token, PrevAuthToken: prev, CreatedAt: createdAt, RotatedAt: rotatedAt, UserAgent: "", ClientIp: ""} |
||||
_, err := ctx.sqlstore.NewSession().Insert(&ut) |
||||
So(err, ShouldBeNil) |
||||
} |
||||
|
||||
t := time.Date(2018, 12, 13, 13, 45, 0, 0, time.UTC) |
||||
getTime = func() time.Time { |
||||
return t |
||||
} |
||||
|
||||
Convey("should delete tokens where token rotation age is older than or equal 7 days", func() { |
||||
from := t.Add(-7 * 24 * time.Hour) |
||||
|
||||
// insert three old tokens that should be deleted
|
||||
for i := 0; i < 3; i++ { |
||||
insertToken(fmt.Sprintf("oldA%d", i), fmt.Sprintf("oldB%d", i), from.Unix(), from.Unix()) |
||||
} |
||||
|
||||
// insert three active tokens that should not be deleted
|
||||
for i := 0; i < 3; i++ { |
||||
from = from.Add(time.Second) |
||||
insertToken(fmt.Sprintf("newA%d", i), fmt.Sprintf("newB%d", i), from.Unix(), from.Unix()) |
||||
} |
||||
|
||||
affected, err := ctx.tokenService.deleteExpiredTokens(7*24*time.Hour, 30*24*time.Hour) |
||||
So(err, ShouldBeNil) |
||||
So(affected, ShouldEqual, 3) |
||||
}) |
||||
|
||||
Convey("should delete tokens where token age is older than or equal 30 days", func() { |
||||
from := t.Add(-30 * 24 * time.Hour) |
||||
fromRotate := t.Add(-time.Second) |
||||
|
||||
// insert three old tokens that should be deleted
|
||||
for i := 0; i < 3; i++ { |
||||
insertToken(fmt.Sprintf("oldA%d", i), fmt.Sprintf("oldB%d", i), from.Unix(), fromRotate.Unix()) |
||||
} |
||||
|
||||
// insert three active tokens that should not be deleted
|
||||
for i := 0; i < 3; i++ { |
||||
from = from.Add(time.Second) |
||||
insertToken(fmt.Sprintf("newA%d", i), fmt.Sprintf("newB%d", i), from.Unix(), fromRotate.Unix()) |
||||
} |
||||
|
||||
affected, err := ctx.tokenService.deleteExpiredTokens(7*24*time.Hour, 30*24*time.Hour) |
||||
So(err, ShouldBeNil) |
||||
So(affected, ShouldEqual, 3) |
||||
}) |
||||
}) |
||||
} |
||||
Loading…
Reference in new issue