Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feature: Basic auth support with fission router (#2292)

Browse Source
This commit is contained in:
Pradeep Lakshmi Narasimha
2022-02-01 19:40:40 +05:30
committed by GitHub
parent 4b307be939
commit 590eefaa52
18 changed files with 466 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/fission-all/templates/NOTES.txt
+9
View File
@@ -20,6 +20,15 @@ Windows:
# Register this function with Fission
$ fission function create --name hello --env nodejs --code hello.js
{{- if .Values.authentication.enabled }}
# Create token
$ FISSION_USERNAME=$(kubectl get secrets/router --template={{`{{.data.username}}`}} -n fission | base64 -d)
$ FISSION_PASSWORD=$(kubectl get secrets/router --template={{`{{.data.password}}`}} -n fission | base64 -d)
$ export FISSION_AUTH_TOKEN=$(fission token create --username $FISSION_USERNAME --password $FISSION_PASSWORD)
{{- end }}
# Run this function
$ fission function test --name hello
Hello, world!
charts/fission-all/templates/_helpers.tpl
+7
View File
@@ -31,6 +31,13 @@ canary:
prometheusSvc: {{ .Values.prometheus.serviceEndpoint | default "" | quote }}
{{- end }}
{{- printf "\n" -}}
auth:
enabled: {{ .Values.authentication.enabled | default false }}
{{- if .Values.authentication.enabled }}
authUriPath: {{ .Values.authentication.authUriPath | default "/auth/login" | quote}}
jwtExpiryTime: {{ .Values.authentication.jwtExpiryTime | default 120 }}
jwtIssuer: {{ .Values.authentication.jwtIssuer | default "fission" | quote }}
{{- end }}
{{- end -}}
{{/*
charts/fission-all/templates/router/deployment.yaml
+25
View File
@@ -35,6 +35,23 @@ spec:
command: ["/fission-bundle"]
args: ["--routerPort", "8888", "--executorUrl", "http://executor.{{ .Release.Namespace }}"]
env:
{{- if .Values.authentication.enabled }}
- name: AUTH_USERNAME
valueFrom:
secretKeyRef:
name: router
key: username
- name: AUTH_PASSWORD
valueFrom:
secretKeyRef:
name: router
key: password
- name: JWT_SIGNING_KEY
valueFrom:
secretKeyRef:
name: router
key: jwtSigningKey
{{- end }}
- name: POD_NAMESPACE
valueFrom:
fieldRef:
@@ -80,6 +97,10 @@ spec:
port: 8888
initialDelaySeconds: 35
periodSeconds: 5
volumeMounts:
- name: config-volume
mountPath: /etc/config/config.yaml
subPath: config.yaml
ports:
- containerPort: 8080
name: metrics
@@ -100,6 +121,10 @@ spec:
terminationMessagePolicy: {{ .Values.terminationMessagePolicy }}
{{- end }}
serviceAccountName: fission-svc
volumes:
- name: config-volume
configMap:
name: feature-config
{{- if .Values.router.priorityClassName }}
priorityClassName: {{ .Values.router.priorityClassName }}
{{- else if .Values.priorityClassName }}
charts/fission-all/templates/router/secret.yaml
+14
View File
@@ -0,0 +1,14 @@
{{- if .Values.authentication.enabled }}
apiVersion: v1
kind: Secret
metadata:
name: router
labels:
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
annotations:
"helm.sh/hook": pre-install
data:
username: {{ .Values.authentication.authUsername | b64enc | quote }}
password: {{ randAlphaNum 20 | b64enc | quote }}
jwtSigningKey: {{ .Values.authentication.jwtSigningKey | b64enc | quote }}
{{- end }}
charts/fission-all/values.yaml
+31 -1
View File
@@ -161,7 +161,6 @@ router:
## router resource utilization when under heavy workloads.
##
displayAccessLog: false
## svcAnnotations is the annotations to be added to the service resource created for router.
##
# svcAnnotations:
@@ -483,6 +482,37 @@ prometheus:
canaryDeployment:
enabled: false
## Enable authentication for fission function invocation via Fission router
##
authentication:
## set this flag to true if you need authentication
## for all function invocations
## default 'false'
##
enabled: false
## authUriPath defines authentication endpoint path
## via router
## default '/auth/login'
##
authUriPath:
## authUsername is used as a username for authentication
## default 'admin'
##
authUsername: admin
## jwtSigningKey is the signing key used for
## signing the JWT token
##
jwtSigningKey: serverless
## jwtExpiryTime is the JWT expiry time
## in seconds
## default '120'
##
jwtExpiryTime:
## jwtIssuer is the issuer of JWT
## default 'fission'
##
jwtIssuer: fission
## Use the following flags to enable OpenTracing.
## Note: OpenTracing support will be removed in an upcoming release.
## Please prefer using OpenTelemetry instead.
cmd/fission-cli/app/app.go
+2
View File
@@ -19,6 +19,7 @@ import (
"github.com/fission/fission/pkg/fission-cli/cmd/spec"
"github.com/fission/fission/pkg/fission-cli/cmd/support"
"github.com/fission/fission/pkg/fission-cli/cmd/timetrigger"
"github.com/fission/fission/pkg/fission-cli/cmd/token"
"github.com/fission/fission/pkg/fission-cli/cmd/version"
"github.com/fission/fission/pkg/fission-cli/console"
"github.com/fission/fission/pkg/fission-cli/flag"
@@ -77,6 +78,7 @@ func App() *cobra.Command {
})
groups := helptemplate.CommandGroups{}
groups = append(groups, helptemplate.CreateCmdGroup("Auth Commands(Note: Authentication should be enabled to use a command in this group.)", token.Commands()))
groups = append(groups, helptemplate.CreateCmdGroup("Basic Commands", environment.Commands(), _package.Commands(), function.Commands()))
groups = append(groups, helptemplate.CreateCmdGroup("Trigger Commands", httptrigger.Commands(), mqtrigger.Commands(), timetrigger.Commands(), kubewatch.Commands()))
groups = append(groups, helptemplate.CreateCmdGroup("Deploy Strategies Commands", canaryconfig.Commands()))
go.mod
+1
View File
@@ -22,6 +22,7 @@ require (
github.com/go-git/go-git/v5 v5.4.2
github.com/go-ini/ini v1.63.2 // indirect
github.com/go-openapi/spec v0.20.4
github.com/golang-jwt/jwt/v4 v4.2.0
github.com/gorilla/mux v1.8.0
github.com/gotestyourself/gotestyourself v2.2.0+incompatible // indirect
github.com/graymeta/stow v0.2.7
go.sum
+3
View File
@@ -492,7 +492,10 @@ github.com/gogo/protobuf v1.2.2-0.20190730201129-28a6bbf47e48/go.mod h1:SlYgWuQ5
github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
github.com/golang-jwt/jwt v3.2.1+incompatible h1:73Z+4BJcrTC+KczS6WvTPvRGOp1WmfEP4Q1lOd9Z/+c=
github.com/golang-jwt/jwt v3.2.1+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
github.com/golang-jwt/jwt/v4 v4.2.0 h1:besgBTC8w8HjP6NzQdxwKH9Z5oQMZ24ThTrHp3cZ8eU=
github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 h1:DACJavvAHhabrF08vX0COfcOBJRhZ8lUbR+ZWIs0Y5g=
github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
pkg/apis/core/v1/types.go
+12
View File
@@ -854,6 +854,18 @@ type (
GetObjectKind() schema.ObjectKind
GetObjectMeta() metav1.Object
}
// AuthLogin defines the body for router login
AuthLogin struct {
Username string `json:"username"`
Password string `json:"password"`
}
// RouterAuthToken defines the authorization token for accessing router
RouterAuthToken struct {
AccessToken string `json:"accesstoken"`
TokenType string `json:"tokentype"`
}
)
//IsEmpty checks if the archive byte and litreal are of length 0
pkg/error/httperror.go
+2
View File
@@ -60,6 +60,8 @@ func MakeErrorFromHTTP(resp *http.Response) error {
errCode = ErrorRequestTimeout
case http.StatusTooManyRequests:
errCode = ErrorTooManyRequests
case http.StatusUnauthorized:
errCode = ErrorNotAuthorized
default:
errCode = ErrorInternal
}
pkg/featureconfig/types.go
+10
View File
@@ -16,6 +16,8 @@ limitations under the License.
package featureconfig
import "time"
const (
FeatureConfigFile = "/etc/config/config.yaml"
CanaryFeature = "canary"
@@ -31,6 +33,7 @@ type (
FeatureConfig struct {
// In the future more such feature configs can be added here for each optional feature
CanaryConfig CanaryFeatureConfig `json:"canary"`
AuthConfig AuthFeatureConfig `json:"auth"`
}
// specific feature config
@@ -38,4 +41,11 @@ type (
IsEnabled bool `json:"enabled"`
PrometheusSvc string `json:"prometheusSvc"`
}
AuthFeatureConfig struct {
IsEnabled bool `json:"enabled"`
AuthUriPath string `json:"authUriPath"`
JWTExpiryTime time.Duration `json:"jwtExpiryTime"`
JWTIssuer string `json:"jwtIssuer"`
}
)
pkg/fission-cli/cmd/function/test.go
+7
View File
@@ -18,6 +18,7 @@ package function
import (
"context"
"fmt"
"io"
"net/http"
"net/url"
@@ -178,6 +179,11 @@ func doHTTPRequest(ctx context.Context, url string, headers []string, method, bo
return nil, errors.Wrap(err, "error creating HTTP request")
}
accesstoken, ok := os.LookupEnv(util.FISSION_AUTH_TOKEN)
if ok && len(accesstoken) != 0 {
req.Header.Set("Authorization", fmt.Sprintf("Bearer %v", accesstoken))
}
for _, header := range headers {
headerKeyValue := strings.SplitN(header, ":", 2)
if len(headerKeyValue) != 2 {
@@ -185,6 +191,7 @@ func doHTTPRequest(ctx context.Context, url string, headers []string, method, bo
}
req.Header.Set(headerKeyValue[0], headerKeyValue[1])
}
hc := &http.Client{Transport: otelhttp.NewTransport(http.DefaultTransport)}
resp, err := hc.Do(req.WithContext(ctx))
if err != nil {
pkg/fission-cli/cmd/token/command.go
+45
View File
@@ -0,0 +1,45 @@
/*
Copyright 2022 The Fission Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package token
import (
"github.com/spf13/cobra"
wrapper "github.com/fission/fission/pkg/fission-cli/cliwrapper/driver/cobra"
"github.com/fission/fission/pkg/fission-cli/flag"
)
func Commands() *cobra.Command {
createCmd := &cobra.Command{
Use: "create",
Short: "Create a JWT token for function invocation",
RunE: wrapper.Wrapper(Create),
}
wrapper.SetFlags(createCmd, flag.FlagSet{
Required: []flag.Flag{flag.TokUsername, flag.TokPassword},
Optional: []flag.Flag{flag.TokAuthURI},
})
command := &cobra.Command{
Use: "token",
Short: "Create a JWT token for function invocation",
}
command.AddCommand(createCmd)
return command
}
pkg/fission-cli/cmd/token/create.go
+114
View File
@@ -0,0 +1,114 @@
/*
Copyright 2022 The Fission Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package token
import (
"bytes"
"encoding/json"
"fmt"
"io"
"net/http"
"net/url"
"os"
"github.com/pkg/errors"
fv1 "github.com/fission/fission/pkg/apis/core/v1"
"github.com/fission/fission/pkg/fission-cli/cliwrapper/cli"
"github.com/fission/fission/pkg/fission-cli/cmd"
flagkey "github.com/fission/fission/pkg/fission-cli/flag/key"
"github.com/fission/fission/pkg/fission-cli/util"
)
type CreateSubCommand struct {
cmd.CommandActioner
}
func Create(input cli.Input) error {
return (&CreateSubCommand{}).do(input)
}
func (opts *CreateSubCommand) do(input cli.Input) error {
return opts.run(input)
}
func (opts *CreateSubCommand) run(input cli.Input) error {
lb := &fv1.AuthLogin{}
username := input.String(flagkey.TokUsername)
if len(username) != 0 {
lb.Username = username
}
password := input.String(flagkey.TokPassword)
if len(password) != 0 {
lb.Password = password
}
values := map[string]string{"username": username, "password": password}
jsonValue, _ := json.Marshal(values)
kubeContext := input.String(flagkey.KubeContext)
// Portforward to the fission router
localRouterPort, err := util.SetupPortForward(util.GetFissionNamespace(), "application=fission-router", kubeContext)
if err != nil {
return err
}
authURI, _ := os.LookupEnv("FISSION_AUTH_URI")
if input.IsSet(flagkey.TokAuthURI) {
authURI = input.String(flagkey.TokAuthURI)
}
if len(authURI) == 0 {
authURI = util.FISSION_AUTH_URI
}
relativeURL, _ := url.Parse(authURI)
serverURL, _ := url.Parse("http://127.0.0.1:" + localRouterPort)
authAuthenticatorUrl := serverURL.ResolveReference(relativeURL)
resp, err := http.Post(authAuthenticatorUrl.String(), "application/json", bytes.NewBuffer(jsonValue))
if err != nil {
return err
}
defer resp.Body.Close()
body, err := io.ReadAll(resp.Body)
if err != nil {
return errors.Wrap(err, "error creating token")
}
if resp.StatusCode == http.StatusCreated {
var rat fv1.RouterAuthToken
err = json.Unmarshal(body, &rat)
if err != nil {
return err
}
fmt.Println(rat.AccessToken)
} else if resp.StatusCode == http.StatusNotFound {
fmt.Printf("%s. Please check if authentication is enabled and correct auth URI is mentioned via --authuri or FISSION_AUTH_URI.\n", resp.Status)
} else {
fmt.Println(resp.Status)
}
return nil
}
pkg/fission-cli/flag/flag.go
+4
View File
@@ -142,6 +142,10 @@ var (
HtPrefix = Flag{Type: String, Name: flagkey.HtPrefix, Usage: "Prefix with which functions are exposed. NOTE: Prefix takes precedence over URL/RelativeURL [DEPRECATED for 'fn create', use 'route create' instead]"}
HtKeepPrefix = Flag{Type: Bool, Name: flagkey.HtKeepPrefix, Usage: "Keep the prefix in the URL while forwarding request to the function"}
TokUsername = Flag{Type: String, Name: flagkey.TokUsername, Usage: "Username to generate token for function invocation"}
TokPassword = Flag{Type: String, Name: flagkey.TokPassword, Usage: "Password to generate token for function invocation"}
TokAuthURI = Flag{Type: String, Name: flagkey.TokAuthURI, Usage: "Relative URI path to generate token"}
TtName = Flag{Type: String, Name: flagkey.TtName, Usage: "Time Trigger name"}
TtCron = Flag{Type: String, Name: flagkey.TtCron, Usage: "Time trigger cron spec with each asterisk representing respectively second, minute, hour, the day of the month, month and day of the week. Also supports readable formats like '@every 5m', '@hourly'"}
TtFnName = Flag{Type: String, Name: flagkey.TtFnName, Usage: "Function name"}
pkg/fission-cli/flag/key/key.go
+4
View File
@@ -92,6 +92,10 @@ const (
HtPrefix = "prefix"
HtKeepPrefix = "keepprefix"
TokUsername = "username"
TokPassword = "password"
TokAuthURI = "authuri"
TtName = resourceName
TtCron = "cron"
TtFnName = "function"
pkg/fission-cli/util/constants.go
+4 -2
View File
@@ -18,6 +18,8 @@ package util
// fission-cli options
const (
SPEC_IGNORE_FILE = ".specignore"
COMMIT_LABEL = "commit"
SPEC_IGNORE_FILE = ".specignore"
COMMIT_LABEL = "commit"
FISSION_AUTH_URI = "/auth/login"
FISSION_AUTH_TOKEN = "FISSION_AUTH_TOKEN"
)
pkg/router/httpTriggers.go
+172 -3
View File
@@ -18,10 +18,16 @@ package router
import (
"context"
"encoding/json"
"errors"
"fmt"
"io"
"net/http"
"os"
"strings"
"time"
"github.com/golang-jwt/jwt/v4"
"github.com/gorilla/mux"
"go.uber.org/zap"
"k8s.io/apimachinery/pkg/types"
@@ -31,6 +37,7 @@ import (
fv1 "github.com/fission/fission/pkg/apis/core/v1"
"github.com/fission/fission/pkg/crd"
executorClient "github.com/fission/fission/pkg/executor/client"
config "github.com/fission/fission/pkg/featureconfig"
genInformer "github.com/fission/fission/pkg/generated/informers/externalversions"
"github.com/fission/fission/pkg/throttler"
"github.com/fission/fission/pkg/utils"
@@ -38,6 +45,8 @@ import (
"github.com/fission/fission/pkg/utils/tracing"
)
var featureConfig *config.FeatureConfig
// HTTPTriggerSet represents an HTTP trigger set
type HTTPTriggerSet struct {
*functionServiceMap
@@ -59,6 +68,20 @@ type HTTPTriggerSet struct {
unTapServiceTimeout time.Duration
}
func init() {
_ = loadFeatureConfigmap()
}
func loadFeatureConfigmap() error {
var err error
featureConfig, err = config.GetFeatureConfig()
if err != nil {
fmt.Println(err)
return errors.New("error while loading feature configmap")
}
return nil
}
func makeHTTPTriggerSet(logger *zap.Logger, fmap *functionServiceMap, fissionClient *crd.FissionClient,
kubeClient *kubernetes.Clientset, executor *executorClient.Client, params *tsRoundTripperParams, isDebugEnv bool, unTapServiceTimeout time.Duration, actionThrottler *throttler.Throttler) *HTTPTriggerSet {
@@ -106,10 +129,92 @@ func defaultHomeHandler(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
}
func createErrorResponse(errMsg string, statusCode int) []byte {
resp, _ := json.Marshal(map[string]interface{}{"statusCode": statusCode, "message": errMsg})
return resp
}
func routerHealthHandler(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
}
func authLoginHandler(w http.ResponseWriter, r *http.Request) {
body, err := io.ReadAll(r.Body)
if err != nil {
w.WriteHeader(http.StatusBadRequest)
_, _ = w.Write(createErrorResponse("Error while reading request body", http.StatusBadRequest))
return
}
var t fv1.AuthLogin
err = json.Unmarshal(body, &t)
if err != nil {
w.WriteHeader(http.StatusBadRequest)
_, _ = w.Write(createErrorResponse("Error while reading request body", http.StatusBadRequest))
return
}
username, ok := os.LookupEnv("AUTH_USERNAME")
if !ok || len(username) == 0 {
w.WriteHeader(http.StatusBadRequest)
_, _ = w.Write(createErrorResponse("Username not found or invalid", http.StatusBadRequest))
return
}
password, ok := os.LookupEnv("AUTH_PASSWORD")
if !ok || len(password) == 0 {
w.WriteHeader(http.StatusBadRequest)
_, _ = w.Write(createErrorResponse("Password not found or invalid", http.StatusBadRequest))
return
}
signingKey, ok := os.LookupEnv("JWT_SIGNING_KEY")
if !ok || len(signingKey) == 0 {
w.WriteHeader(http.StatusInternalServerError)
_, _ = w.Write(createErrorResponse("Internal server error occurred", http.StatusInternalServerError))
return
}
rat := &fv1.RouterAuthToken{}
if t.Username == username && t.Password == password {
claims := &jwt.RegisteredClaims{
ExpiresAt: jwt.NewNumericDate(jwt.TimeFunc().Add(featureConfig.AuthConfig.JWTExpiryTime * time.Second)),
Issuer: featureConfig.AuthConfig.JWTIssuer,
NotBefore: jwt.NewNumericDate(jwt.TimeFunc()),
}
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
ss, err := token.SignedString([]byte(signingKey))
if err != nil {
w.WriteHeader(http.StatusInternalServerError)
_, _ = w.Write(createErrorResponse("Internal server error occurred", http.StatusInternalServerError))
return
}
rat.AccessToken = ss
rat.TokenType = "Bearer"
} else {
w.WriteHeader(http.StatusUnauthorized)
_, _ = w.Write(createErrorResponse("Unauthorized: invalid username and/or password", http.StatusUnauthorized))
return
}
resp, err := json.Marshal(rat)
if err != nil {
w.WriteHeader(http.StatusInternalServerError)
_, _ = w.Write(createErrorResponse("Internal server error occurred", http.StatusInternalServerError))
return
}
w.WriteHeader(http.StatusCreated)
_, _ = w.Write(resp)
}
func (ts *HTTPTriggerSet) getRouter(fnTimeoutMap map[types.UID]int) *mux.Router {
muxRouter := mux.NewRouter()
@@ -199,7 +304,12 @@ func (ts *HTTPTriggerSet) getRouter(fnTimeoutMap map[types.UID]int) *mux.Router
}
ts.logger.Debug("add prefix route for function", zap.String("route", prefix), zap.Any("function", fh.function), zap.Strings("methods", methods))
} else {
ht1 := muxRouter.Handle(prefix, handler)
var ht1 *mux.Route
if featureConfig.AuthConfig.IsEnabled {
ht1 = muxRouter.Handle(prefix, authMiddleware(handler))
} else {
ht1 = muxRouter.Handle(prefix, handler)
}
ht1.Methods(methods...)
if trigger.Spec.Host != "" {
ht1.Host(trigger.Spec.Host)
@@ -212,7 +322,12 @@ func (ts *HTTPTriggerSet) getRouter(fnTimeoutMap map[types.UID]int) *mux.Router
ts.logger.Debug("add prefix and handler route for function", zap.String("route", prefix), zap.Any("function", fh.function), zap.Strings("methods", methods))
}
} else {
ht := muxRouter.Handle(trigger.Spec.RelativeURL, handler)
var ht *mux.Route
if featureConfig.AuthConfig.IsEnabled {
ht = muxRouter.Handle(trigger.Spec.RelativeURL, authMiddleware(handler))
} else {
ht = muxRouter.Handle(trigger.Spec.RelativeURL, handler)
}
ht.Methods(methods...)
if trigger.Spec.Host != "" {
ht.Host(trigger.Spec.Host)
@@ -259,17 +374,71 @@ func (ts *HTTPTriggerSet) getRouter(fnTimeoutMap map[types.UID]int) *mux.Router
} else {
handler = otel.GetHandlerWithOTEL(http.HandlerFunc(fh.handler), internalRoute)
}
muxRouter.Handle(internalRoute, handler)
if featureConfig.AuthConfig.IsEnabled {
muxRouter.Handle(internalRoute, authMiddleware(handler))
} else {
muxRouter.Handle(internalRoute, handler)
}
muxRouter.PathPrefix(internalPrefixRoute).Handler(handler)
ts.logger.Debug("add internal handler and prefix route for function", zap.String("router", internalRoute), zap.Any("function", fn))
}
if featureConfig.AuthConfig.IsEnabled {
path := featureConfig.AuthConfig.AuthUriPath
if len(path) == 0 {
path = "/auth/login"
}
// Auth endpoint for the router.
muxRouter.HandleFunc(path, authLoginHandler).Methods("POST")
}
// Healthz endpoint for the router.
muxRouter.HandleFunc("/router-healthz", routerHealthHandler).Methods("GET")
return muxRouter
}
func authMiddleware(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
authHeader := strings.Split(r.Header.Get("Authorization"), "Bearer ")
if len(authHeader) != 2 || len(authHeader[1]) == 0 {
// malformed token
w.WriteHeader(http.StatusUnauthorized)
_, _ = w.Write(createErrorResponse("Unauthorized: malformed Token", http.StatusUnauthorized))
} else {
jwtToken := authHeader[1]
token, err := jwt.Parse(jwtToken, func(token *jwt.Token) (interface{}, error) {
return []byte(os.Getenv("JWT_SIGNING_KEY")), nil
})
if token != nil && token.Valid {
// valid token
next.ServeHTTP(w, r)
} else if ve, ok := err.(*jwt.ValidationError); ok {
w.WriteHeader(http.StatusUnauthorized)
if ve.Errors&jwt.ValidationErrorMalformed != 0 {
// malformed token
_, _ = w.Write(createErrorResponse("Unauthorized: malformed Token", http.StatusUnauthorized))
} else if ve.Errors&(jwt.ValidationErrorExpired|jwt.ValidationErrorNotValidYet) != 0 {
// token is either expired or not active yet
_, _ = w.Write(createErrorResponse("Unauthorized: token is either expired or not active yet", http.StatusUnauthorized))
} else {
_, _ = w.Write(createErrorResponse(fmt.Sprintf("Unauthorized: %v", err.Error()), http.StatusUnauthorized))
}
} else {
w.WriteHeader(http.StatusUnauthorized)
_, _ = w.Write(createErrorResponse("Unauthorized", http.StatusUnauthorized))
}
}
})
}
func (ts *HTTPTriggerSet) updateTriggerStatusFailed(ht *fv1.HTTPTrigger, err error) {
// TODO
}