mirror of https://github.com/grafana/grafana
CloudMigration: Create authapi service (#96581)
lean.dev
7 months ago
committed by
GitHub
parent
c8bc1f8637
commit
e9fae5bd7f
@ -0,0 +1,398 @@ |
||||
// Package authapi contains the connector for Grafana internal auth service. This can be used instead of the GCOM service
|
||||
// to create access policies and access tokens
|
||||
package authapi |
||||
|
||||
import ( |
||||
"bytes" |
||||
"context" |
||||
"encoding/json" |
||||
"errors" |
||||
"fmt" |
||||
"io" |
||||
"net/http" |
||||
"net/url" |
||||
"time" |
||||
|
||||
"github.com/grafana/grafana/pkg/infra/log" |
||||
) |
||||
|
||||
const LogPrefix = "auth-api.service" |
||||
|
||||
var ErrTokenNotFound = errors.New("auth-api: token not found") |
||||
|
||||
type Service interface { |
||||
CreateAccessPolicy(ctx context.Context, params CreateAccessPolicyParams, payload CreateAccessPolicyPayload) (AccessPolicy, error) |
||||
ListAccessPolicies(ctx context.Context, params ListAccessPoliciesParams) ([]AccessPolicy, error) |
||||
DeleteAccessPolicy(ctx context.Context, params DeleteAccessPolicyParams) (bool, error) |
||||
ListTokens(ctx context.Context, params ListTokenParams) ([]TokenView, error) |
||||
CreateToken(ctx context.Context, params CreateTokenParams, payload CreateTokenPayload) (Token, error) |
||||
DeleteToken(ctx context.Context, params DeleteTokenParams) error |
||||
} |
||||
|
||||
type CreateAccessPolicyParams struct { |
||||
RequestID string |
||||
// this is needed until we fully migrate from gcom to authapi
|
||||
Region string |
||||
} |
||||
|
||||
type CreateAccessPolicyPayload struct { |
||||
Name string `json:"name"` |
||||
DisplayName string `json:"displayName"` |
||||
Realms []Realm `json:"realms"` |
||||
Scopes []string `json:"scopes"` |
||||
} |
||||
|
||||
type Realm struct { |
||||
Identifier string `json:"identifier"` |
||||
LabelPolicies []LabelPolicy `json:"labelPolicies"` |
||||
Type string `json:"type"` |
||||
} |
||||
|
||||
type LabelPolicy struct { |
||||
Selector string `json:"selector"` |
||||
} |
||||
|
||||
type createAccessPolicyResponse struct { |
||||
Data AccessPolicy `json:"data"` |
||||
} |
||||
|
||||
type AccessPolicy struct { |
||||
ID string `json:"id"` |
||||
Name string `json:"name"` |
||||
} |
||||
|
||||
type ListAccessPoliciesParams struct { |
||||
RequestID string |
||||
Name string |
||||
// this is needed until we fully migrate from gcom to authapi
|
||||
Region string |
||||
} |
||||
|
||||
type listAccessPoliciesResponse struct { |
||||
Data []AccessPolicy `json:"data"` |
||||
} |
||||
|
||||
type DeleteAccessPolicyParams struct { |
||||
RequestID string |
||||
AccessPolicyID string |
||||
// this is needed until we fully migrate from gcom to authapi
|
||||
Region string |
||||
} |
||||
|
||||
type ListTokenParams struct { |
||||
RequestID string |
||||
AccessPolicyName string |
||||
TokenName string |
||||
// this is needed until we fully migrate from gcom to authapi
|
||||
Region string |
||||
} |
||||
|
||||
type CreateTokenParams struct { |
||||
RequestID string |
||||
// this is needed until we fully migrate from gcom to authapi
|
||||
Region string |
||||
} |
||||
|
||||
type CreateTokenPayload struct { |
||||
AccessPolicyID string `json:"accessPolicyId"` |
||||
DisplayName string `json:"displayName"` |
||||
Name string `json:"name"` |
||||
ExpiresAt time.Time `json:"expiresAt"` |
||||
} |
||||
|
||||
type createTokenResponse struct { |
||||
Data Token `json:"data"` |
||||
} |
||||
|
||||
// Token returned by authapi api when a token gets created.
|
||||
type Token struct { |
||||
ID string `json:"id"` |
||||
AccessPolicyID string `json:"accessPolicyId"` |
||||
Name string `json:"name"` |
||||
Token string `json:"token"` |
||||
} |
||||
|
||||
type DeleteTokenParams struct { |
||||
RequestID string |
||||
TokenID string |
||||
// this is needed until we fully migrate from gcom to authapi
|
||||
Region string |
||||
} |
||||
|
||||
// TokenView returned by authapi api for a GET token request.
|
||||
type TokenView struct { |
||||
ID string `json:"id"` |
||||
AccessPolicyID string `json:"accessPolicyId"` |
||||
Name string `json:"name"` |
||||
DisplayName string `json:"displayName"` |
||||
ExpiresAt string `json:"expiresAt"` |
||||
FirstUsedAt string `json:"firstUsedAt"` |
||||
LastUsedAt string `json:"lastUsedAt"` |
||||
CreatedAt string `json:"createdAt"` |
||||
} |
||||
|
||||
type listTokensResponse struct { |
||||
Data []TokenView `json:"data"` |
||||
} |
||||
|
||||
var _ Service = (*AuthApiClient)(nil) |
||||
|
||||
type AuthApiClient struct { |
||||
log log.Logger |
||||
cfg Config |
||||
httpClient *http.Client |
||||
} |
||||
|
||||
type Config struct { |
||||
ApiURL string |
||||
Token string |
||||
} |
||||
|
||||
func New(cfg Config, httpClient *http.Client) Service { |
||||
return &AuthApiClient{ |
||||
log: log.New(LogPrefix), |
||||
cfg: cfg, |
||||
httpClient: httpClient, |
||||
} |
||||
} |
||||
|
||||
func (client *AuthApiClient) CreateAccessPolicy(ctx context.Context, params CreateAccessPolicyParams, payload CreateAccessPolicyPayload) (AccessPolicy, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies") |
||||
if err != nil { |
||||
return AccessPolicy{}, fmt.Errorf("building authapi access policy url: %w", err) |
||||
} |
||||
|
||||
body, err := json.Marshal(&payload) |
||||
if err != nil { |
||||
return AccessPolicy{}, fmt.Errorf("marshaling request body: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body)) |
||||
if err != nil { |
||||
return AccessPolicy{}, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Content-Type", "application/json") |
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return AccessPolicy{}, fmt.Errorf("sending http request to create access policy: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode != http.StatusOK { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return AccessPolicy{}, fmt.Errorf("unexpected response when creating access policy: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
var capResp createAccessPolicyResponse |
||||
if err := json.NewDecoder(response.Body).Decode(&capResp); err != nil { |
||||
return AccessPolicy{}, fmt.Errorf("unmarshaling response body: %w", err) |
||||
} |
||||
|
||||
return capResp.Data, nil |
||||
} |
||||
|
||||
func (client *AuthApiClient) DeleteAccessPolicy(ctx context.Context, params DeleteAccessPolicyParams) (bool, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies/", params.AccessPolicyID) |
||||
if err != nil { |
||||
return false, fmt.Errorf("building authapi access policy url: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodDelete, endpoint, nil) |
||||
if err != nil { |
||||
return false, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return false, fmt.Errorf("sending http request to create access policy: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode == http.StatusNotFound { |
||||
return false, nil |
||||
} |
||||
|
||||
if response.StatusCode == http.StatusOK || response.StatusCode == http.StatusNoContent { |
||||
return true, nil |
||||
} |
||||
|
||||
body, _ := io.ReadAll(response.Body) |
||||
return false, fmt.Errorf("unexpected response when deleting access policy: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
func (client *AuthApiClient) ListAccessPolicies(ctx context.Context, params ListAccessPoliciesParams) ([]AccessPolicy, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies") |
||||
if err != nil { |
||||
return nil, fmt.Errorf("building authapi access policy url: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) |
||||
if err != nil { |
||||
return nil, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
query := url.Values{} |
||||
query.Set("name", params.Name) |
||||
request.URL.RawQuery = query.Encode() |
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Accept", "application/json") |
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return nil, fmt.Errorf("sending http request to create access policy: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode != http.StatusOK { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return nil, fmt.Errorf("unexpected response when listing access policies: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
var lapResp listAccessPoliciesResponse |
||||
if err := json.NewDecoder(response.Body).Decode(&lapResp); err != nil { |
||||
return lapResp.Data, fmt.Errorf("unmarshaling response body: %w", err) |
||||
} |
||||
return lapResp.Data, nil |
||||
} |
||||
|
||||
func (client *AuthApiClient) ListTokens(ctx context.Context, params ListTokenParams) ([]TokenView, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens") |
||||
if err != nil { |
||||
return nil, fmt.Errorf("building authapi tokens url: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) |
||||
if err != nil { |
||||
return nil, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
query := url.Values{} |
||||
query.Set("accessPolicyName", params.AccessPolicyName) |
||||
query.Set("name", params.TokenName) |
||||
|
||||
request.URL.RawQuery = query.Encode() |
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Content-Type", "application/json") |
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return nil, fmt.Errorf("sending http request to list access tokens: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode != http.StatusOK { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return nil, fmt.Errorf("unexpected response when fetching access tokens: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
var body listTokensResponse |
||||
if err := json.NewDecoder(response.Body).Decode(&body); err != nil { |
||||
return nil, fmt.Errorf("unmarshaling response body: %w", err) |
||||
} |
||||
return body.Data, nil |
||||
} |
||||
|
||||
func (client *AuthApiClient) CreateToken(ctx context.Context, params CreateTokenParams, payload CreateTokenPayload) (Token, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens") |
||||
if err != nil { |
||||
return Token{}, fmt.Errorf("building authapi tokens url: %w", err) |
||||
} |
||||
|
||||
body, err := json.Marshal(&payload) |
||||
if err != nil { |
||||
return Token{}, fmt.Errorf("marshaling request body: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body)) |
||||
if err != nil { |
||||
return Token{}, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Content-Type", "application/json") |
||||
|
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return Token{}, fmt.Errorf("sending http request to create access token: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode != http.StatusOK { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return Token{}, fmt.Errorf("unexpected response when creating access token: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
var ctResp createTokenResponse |
||||
if err := json.NewDecoder(response.Body).Decode(&ctResp); err != nil { |
||||
return Token{}, fmt.Errorf("unmarshaling response body: %w", err) |
||||
} |
||||
|
||||
return ctResp.Data, nil |
||||
} |
||||
|
||||
func (client *AuthApiClient) DeleteToken(ctx context.Context, params DeleteTokenParams) error { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens", params.TokenID) |
||||
if err != nil { |
||||
return fmt.Errorf("building authapi tokens url: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodDelete, endpoint, nil) |
||||
if err != nil { |
||||
return fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return fmt.Errorf("sending http request to delete access token: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode == http.StatusNotFound { |
||||
return fmt.Errorf("token id: %s %w", params.TokenID, ErrTokenNotFound) |
||||
} |
||||
|
||||
if response.StatusCode != http.StatusOK && response.StatusCode != http.StatusNoContent { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return fmt.Errorf("unexpected response when deleting access token: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
return nil |
||||
} |
||||
@ -0,0 +1,69 @@ |
||||
package fake |
||||
|
||||
import ( |
||||
"context" |
||||
"fmt" |
||||
|
||||
"github.com/grafana/grafana/pkg/services/authapi" |
||||
"github.com/grafana/grafana/pkg/util" |
||||
) |
||||
|
||||
var _ authapi.Service = (*AuthapiStub)(nil) |
||||
|
||||
type AuthapiStub struct { |
||||
// The cloud migration token created by this stub.
|
||||
Token *authapi.TokenView |
||||
Policies map[string]authapi.AccessPolicy |
||||
} |
||||
|
||||
func (client *AuthapiStub) CreateAccessPolicy(_ context.Context, _ authapi.CreateAccessPolicyParams, _ authapi.CreateAccessPolicyPayload) (authapi.AccessPolicy, error) { |
||||
randStr := fmt.Sprintf("random-policy-%s", util.GenerateShortUID()) |
||||
policy := authapi.AccessPolicy{ |
||||
ID: randStr, |
||||
Name: randStr, |
||||
} |
||||
client.Policies[policy.ID] = policy |
||||
return policy, nil |
||||
} |
||||
|
||||
func (client *AuthapiStub) DeleteAccessPolicy(_ context.Context, params authapi.DeleteAccessPolicyParams) (bool, error) { |
||||
delete(client.Policies, params.AccessPolicyID) |
||||
return true, nil |
||||
} |
||||
|
||||
func (client *AuthapiStub) ListAccessPolicies(_ context.Context, _ authapi.ListAccessPoliciesParams) ([]authapi.AccessPolicy, error) { |
||||
items := make([]authapi.AccessPolicy, 0) |
||||
for _, v := range client.Policies { |
||||
items = append(items, v) |
||||
} |
||||
return items, nil |
||||
} |
||||
|
||||
func (client *AuthapiStub) ListTokens(_ context.Context, _ authapi.ListTokenParams) ([]authapi.TokenView, error) { |
||||
if client.Token == nil { |
||||
return []authapi.TokenView{}, nil |
||||
} |
||||
|
||||
return []authapi.TokenView{*client.Token}, nil |
||||
} |
||||
|
||||
func (client *AuthapiStub) CreateToken(_ context.Context, _ authapi.CreateTokenParams, payload authapi.CreateTokenPayload) (authapi.Token, error) { |
||||
token := authapi.Token{ |
||||
ID: fmt.Sprintf("random-token-%s", util.GenerateShortUID()), |
||||
Name: payload.Name, |
||||
AccessPolicyID: payload.AccessPolicyID, |
||||
Token: fmt.Sprintf("completely_fake_token_%s", util.GenerateShortUID()), |
||||
} |
||||
client.Token = &authapi.TokenView{ |
||||
ID: token.ID, |
||||
Name: token.Name, |
||||
AccessPolicyID: token.AccessPolicyID, |
||||
DisplayName: token.Name, |
||||
} |
||||
return token, nil |
||||
} |
||||
|
||||
func (client *AuthapiStub) DeleteToken(_ context.Context, _ authapi.DeleteTokenParams) error { |
||||
client.Token = nil |
||||
return nil |
||||
} |
||||
|
@ -0,0 +1,289 @@ |
||||
package gcom |
||||
|
||||
import ( |
||||
"bytes" |
||||
"context" |
||||
"encoding/json" |
||||
"fmt" |
||||
"io" |
||||
"net/http" |
||||
"net/url" |
||||
|
||||
"github.com/grafana/grafana/pkg/services/authapi" |
||||
) |
||||
|
||||
// this will be removed when service in authapi is fully enabled
|
||||
|
||||
type listTokensResponse struct { |
||||
Items []authapi.TokenView `json:"items"` |
||||
} |
||||
|
||||
type listAccessPoliciesResponse struct { |
||||
Items []authapi.AccessPolicy `json:"items"` |
||||
} |
||||
|
||||
var _ authapi.Service = (*GcomClient)(nil) |
||||
|
||||
func (client *GcomClient) CreateAccessPolicy(ctx context.Context, params authapi.CreateAccessPolicyParams, payload authapi.CreateAccessPolicyPayload) (authapi.AccessPolicy, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies") |
||||
if err != nil { |
||||
return authapi.AccessPolicy{}, fmt.Errorf("building gcom access policy url: %w", err) |
||||
} |
||||
|
||||
body, err := json.Marshal(&payload) |
||||
if err != nil { |
||||
return authapi.AccessPolicy{}, fmt.Errorf("marshaling request body: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body)) |
||||
if err != nil { |
||||
return authapi.AccessPolicy{}, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
query := url.Values{} |
||||
query.Set("region", params.Region) |
||||
|
||||
request.URL.RawQuery = query.Encode() |
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Content-Type", "application/json") |
||||
|
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return authapi.AccessPolicy{}, fmt.Errorf("sending http request to create access policy: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode != http.StatusOK { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return authapi.AccessPolicy{}, fmt.Errorf("unexpected response when creating access policy: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
var accessPolicy authapi.AccessPolicy |
||||
if err := json.NewDecoder(response.Body).Decode(&accessPolicy); err != nil { |
||||
return accessPolicy, fmt.Errorf("unmarshaling response body: %w", err) |
||||
} |
||||
|
||||
return accessPolicy, nil |
||||
} |
||||
|
||||
func (client *GcomClient) DeleteAccessPolicy(ctx context.Context, params authapi.DeleteAccessPolicyParams) (bool, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies/", params.AccessPolicyID) |
||||
if err != nil { |
||||
return false, fmt.Errorf("building gcom access policy url: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodDelete, endpoint, nil) |
||||
if err != nil { |
||||
return false, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
query := url.Values{} |
||||
query.Set("region", params.Region) |
||||
|
||||
request.URL.RawQuery = query.Encode() |
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return false, fmt.Errorf("sending http request to create access policy: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode == http.StatusNotFound { |
||||
return false, nil |
||||
} |
||||
|
||||
if response.StatusCode == http.StatusOK || response.StatusCode == http.StatusNoContent { |
||||
return true, nil |
||||
} |
||||
|
||||
body, _ := io.ReadAll(response.Body) |
||||
return false, fmt.Errorf("unexpected response when deleting access policy: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
func (client *GcomClient) ListAccessPolicies(ctx context.Context, params authapi.ListAccessPoliciesParams) ([]authapi.AccessPolicy, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies") |
||||
if err != nil { |
||||
return nil, fmt.Errorf("building gcom access policy url: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) |
||||
if err != nil { |
||||
return nil, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
query := url.Values{} |
||||
query.Set("region", params.Region) |
||||
query.Set("name", params.Name) |
||||
request.URL.RawQuery = query.Encode() |
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Accept", "application/json") |
||||
|
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return nil, fmt.Errorf("sending http request to create access policy: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode != http.StatusOK { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return nil, fmt.Errorf("unexpected response when listing access policies: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
var responseBody listAccessPoliciesResponse |
||||
if err := json.NewDecoder(response.Body).Decode(&responseBody); err != nil { |
||||
return responseBody.Items, fmt.Errorf("unmarshaling response body: %w", err) |
||||
} |
||||
|
||||
return responseBody.Items, nil |
||||
} |
||||
|
||||
func (client *GcomClient) ListTokens(ctx context.Context, params authapi.ListTokenParams) ([]authapi.TokenView, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens") |
||||
if err != nil { |
||||
return nil, fmt.Errorf("building gcom tokens url: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) |
||||
if err != nil { |
||||
return nil, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
query := url.Values{} |
||||
query.Set("region", params.Region) |
||||
query.Set("accessPolicyName", params.AccessPolicyName) |
||||
query.Set("name", params.TokenName) |
||||
|
||||
request.URL.RawQuery = query.Encode() |
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Content-Type", "application/json") |
||||
|
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return nil, fmt.Errorf("sending http request to list access tokens: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode != http.StatusOK { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return nil, fmt.Errorf("unexpected response when fetching access tokens: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
var body listTokensResponse |
||||
if err := json.NewDecoder(response.Body).Decode(&body); err != nil { |
||||
return nil, fmt.Errorf("unmarshaling response body: %w", err) |
||||
} |
||||
|
||||
return body.Items, nil |
||||
} |
||||
|
||||
func (client *GcomClient) CreateToken(ctx context.Context, params authapi.CreateTokenParams, payload authapi.CreateTokenPayload) (authapi.Token, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens") |
||||
if err != nil { |
||||
return authapi.Token{}, fmt.Errorf("building gcom tokens url: %w", err) |
||||
} |
||||
|
||||
body, err := json.Marshal(&payload) |
||||
if err != nil { |
||||
return authapi.Token{}, fmt.Errorf("marshaling request body: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body)) |
||||
if err != nil { |
||||
return authapi.Token{}, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
query := url.Values{} |
||||
query.Set("region", params.Region) |
||||
|
||||
request.URL.RawQuery = query.Encode() |
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Content-Type", "application/json") |
||||
|
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return authapi.Token{}, fmt.Errorf("sending http request to create access token: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode != http.StatusOK { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return authapi.Token{}, fmt.Errorf("unexpected response when creating access token: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
var token authapi.Token |
||||
if err := json.NewDecoder(response.Body).Decode(&token); err != nil { |
||||
return token, fmt.Errorf("unmarshaling response body: %w", err) |
||||
} |
||||
|
||||
return token, nil |
||||
} |
||||
|
||||
func (client *GcomClient) DeleteToken(ctx context.Context, params authapi.DeleteTokenParams) error { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens", params.TokenID) |
||||
if err != nil { |
||||
return fmt.Errorf("building gcom tokens url: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodDelete, endpoint, nil) |
||||
if err != nil { |
||||
return fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
query := url.Values{} |
||||
query.Set("region", params.Region) |
||||
|
||||
request.URL.RawQuery = query.Encode() |
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return fmt.Errorf("sending http request to delete access token: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode == http.StatusNotFound { |
||||
return fmt.Errorf("token id: %s %w", params.TokenID, ErrTokenNotFound) |
||||
} |
||||
|
||||
if response.StatusCode != http.StatusOK && response.StatusCode != http.StatusNoContent { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return fmt.Errorf("unexpected response when deleting access token: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
return nil |
||||
} |
||||
Loading…
Reference in new issue