Restructured authmiddleware fn and added tests (#2410)
* Created separate file for authmiddleware fn * Optimize auth login and middleware * Added unittests for authmiddleware * Fixed authURL * Removed featureConfig as global variable * Fix integration test according to examples repo changes * Fix integration test path for go module-example Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>
This commit is contained in:
Ankit Chawla
co-authored by
Sanket Sudake
Sanket Sudake
parent
b98538ba24
commit
90c479b23c
+11
-165
@@ -18,16 +18,10 @@ package router
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v4"
|
||||
"github.com/gorilla/mux"
|
||||
"go.uber.org/zap"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
@@ -46,8 +40,6 @@ import (
|
||||
"github.com/fission/fission/pkg/utils/tracing"
|
||||
)
|
||||
|
||||
var featureConfig *config.FeatureConfig
|
||||
|
||||
// HTTPTriggerSet represents an HTTP trigger set
|
||||
type HTTPTriggerSet struct {
|
||||
*functionServiceMap
|
||||
@@ -69,20 +61,6 @@ type HTTPTriggerSet struct {
|
||||
unTapServiceTimeout time.Duration
|
||||
}
|
||||
|
||||
func init() {
|
||||
_ = loadFeatureConfigmap()
|
||||
}
|
||||
|
||||
func loadFeatureConfigmap() error {
|
||||
var err error
|
||||
featureConfig, err = config.GetFeatureConfig()
|
||||
if err != nil {
|
||||
fmt.Println(err)
|
||||
return errors.New("error while loading feature configmap")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func makeHTTPTriggerSet(logger *zap.Logger, fmap *functionServiceMap, fissionClient versioned.Interface,
|
||||
kubeClient kubernetes.Interface, executor *executorClient.Client, params *tsRoundTripperParams, isDebugEnv bool, unTapServiceTimeout time.Duration, actionThrottler *throttler.Throttler) *HTTPTriggerSet {
|
||||
|
||||
@@ -130,95 +108,19 @@ func defaultHomeHandler(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
}
|
||||
|
||||
func createErrorResponse(errMsg string, statusCode int) []byte {
|
||||
resp, _ := json.Marshal(map[string]interface{}{"statusCode": statusCode, "message": errMsg})
|
||||
return resp
|
||||
}
|
||||
|
||||
func routerHealthHandler(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
}
|
||||
|
||||
func authLoginHandler(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
body, err := io.ReadAll(r.Body)
|
||||
if err != nil {
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
_, _ = w.Write(createErrorResponse("Error while reading request body", http.StatusBadRequest))
|
||||
return
|
||||
}
|
||||
|
||||
var t fv1.AuthLogin
|
||||
|
||||
err = json.Unmarshal(body, &t)
|
||||
if err != nil {
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
_, _ = w.Write(createErrorResponse("Error while reading request body", http.StatusBadRequest))
|
||||
return
|
||||
}
|
||||
|
||||
username, ok := os.LookupEnv("AUTH_USERNAME")
|
||||
if !ok || len(username) == 0 {
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
_, _ = w.Write(createErrorResponse("Username not found or invalid", http.StatusBadRequest))
|
||||
return
|
||||
}
|
||||
|
||||
password, ok := os.LookupEnv("AUTH_PASSWORD")
|
||||
if !ok || len(password) == 0 {
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
_, _ = w.Write(createErrorResponse("Password not found or invalid", http.StatusBadRequest))
|
||||
return
|
||||
}
|
||||
|
||||
signingKey, ok := os.LookupEnv("JWT_SIGNING_KEY")
|
||||
if !ok || len(signingKey) == 0 {
|
||||
w.WriteHeader(http.StatusInternalServerError)
|
||||
_, _ = w.Write(createErrorResponse("Internal server error occurred", http.StatusInternalServerError))
|
||||
return
|
||||
}
|
||||
|
||||
rat := &fv1.RouterAuthToken{}
|
||||
|
||||
if t.Username == username && t.Password == password {
|
||||
|
||||
claims := &jwt.RegisteredClaims{
|
||||
ExpiresAt: jwt.NewNumericDate(jwt.TimeFunc().Add(featureConfig.AuthConfig.JWTExpiryTime * time.Second)),
|
||||
Issuer: featureConfig.AuthConfig.JWTIssuer,
|
||||
NotBefore: jwt.NewNumericDate(jwt.TimeFunc()),
|
||||
}
|
||||
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
||||
ss, err := token.SignedString([]byte(signingKey))
|
||||
if err != nil {
|
||||
w.WriteHeader(http.StatusInternalServerError)
|
||||
_, _ = w.Write(createErrorResponse("Internal server error occurred", http.StatusInternalServerError))
|
||||
return
|
||||
}
|
||||
rat.AccessToken = ss
|
||||
rat.TokenType = "Bearer"
|
||||
|
||||
} else {
|
||||
w.WriteHeader(http.StatusUnauthorized)
|
||||
_, _ = w.Write(createErrorResponse("Unauthorized: invalid username and/or password", http.StatusUnauthorized))
|
||||
return
|
||||
}
|
||||
|
||||
resp, err := json.Marshal(rat)
|
||||
if err != nil {
|
||||
w.WriteHeader(http.StatusInternalServerError)
|
||||
_, _ = w.Write(createErrorResponse("Internal server error occurred", http.StatusInternalServerError))
|
||||
return
|
||||
}
|
||||
|
||||
w.WriteHeader(http.StatusCreated)
|
||||
_, _ = w.Write(resp)
|
||||
|
||||
}
|
||||
|
||||
func (ts *HTTPTriggerSet) getRouter(fnTimeoutMap map[types.UID]int) *mux.Router {
|
||||
|
||||
featureConfig, _ := config.GetFeatureConfig()
|
||||
|
||||
muxRouter := mux.NewRouter()
|
||||
muxRouter.Use(metrics.HTTPMetricMiddleware())
|
||||
muxRouter.Use(metrics.HTTPMetricMiddleware)
|
||||
if featureConfig.AuthConfig.IsEnabled {
|
||||
muxRouter.Use(authMiddleware(featureConfig))
|
||||
}
|
||||
|
||||
openTracingEnabled := tracing.TracingEnabled(ts.logger)
|
||||
|
||||
@@ -306,12 +208,7 @@ func (ts *HTTPTriggerSet) getRouter(fnTimeoutMap map[types.UID]int) *mux.Router
|
||||
}
|
||||
ts.logger.Debug("add prefix route for function", zap.String("route", prefix), zap.Any("function", fh.function), zap.Strings("methods", methods))
|
||||
} else {
|
||||
var ht1 *mux.Route
|
||||
if featureConfig.AuthConfig.IsEnabled {
|
||||
ht1 = muxRouter.Handle(prefix, authMiddleware(handler))
|
||||
} else {
|
||||
ht1 = muxRouter.Handle(prefix, handler)
|
||||
}
|
||||
ht1 := muxRouter.Handle(prefix, handler)
|
||||
ht1.Methods(methods...)
|
||||
if trigger.Spec.Host != "" {
|
||||
ht1.Host(trigger.Spec.Host)
|
||||
@@ -324,12 +221,7 @@ func (ts *HTTPTriggerSet) getRouter(fnTimeoutMap map[types.UID]int) *mux.Router
|
||||
ts.logger.Debug("add prefix and handler route for function", zap.String("route", prefix), zap.Any("function", fh.function), zap.Strings("methods", methods))
|
||||
}
|
||||
} else {
|
||||
var ht *mux.Route
|
||||
if featureConfig.AuthConfig.IsEnabled {
|
||||
ht = muxRouter.Handle(trigger.Spec.RelativeURL, authMiddleware(handler))
|
||||
} else {
|
||||
ht = muxRouter.Handle(trigger.Spec.RelativeURL, handler)
|
||||
}
|
||||
ht := muxRouter.Handle(trigger.Spec.RelativeURL, handler)
|
||||
ht.Methods(methods...)
|
||||
if trigger.Spec.Host != "" {
|
||||
ht.Host(trigger.Spec.Host)
|
||||
@@ -377,11 +269,7 @@ func (ts *HTTPTriggerSet) getRouter(fnTimeoutMap map[types.UID]int) *mux.Router
|
||||
handler = otel.GetHandlerWithOTEL(http.HandlerFunc(fh.handler), internalRoute)
|
||||
}
|
||||
|
||||
if featureConfig.AuthConfig.IsEnabled {
|
||||
muxRouter.Handle(internalRoute, authMiddleware(handler))
|
||||
} else {
|
||||
muxRouter.Handle(internalRoute, handler)
|
||||
}
|
||||
muxRouter.Handle(internalRoute, handler)
|
||||
muxRouter.PathPrefix(internalPrefixRoute).Handler(handler)
|
||||
ts.logger.Debug("add internal handler and prefix route for function", zap.String("router", internalRoute), zap.Any("function", fn))
|
||||
}
|
||||
@@ -389,12 +277,8 @@ func (ts *HTTPTriggerSet) getRouter(fnTimeoutMap map[types.UID]int) *mux.Router
|
||||
if featureConfig.AuthConfig.IsEnabled {
|
||||
|
||||
path := featureConfig.AuthConfig.AuthUriPath
|
||||
if len(path) == 0 {
|
||||
path = "/auth/login"
|
||||
}
|
||||
|
||||
// Auth endpoint for the router.
|
||||
muxRouter.HandleFunc(path, authLoginHandler).Methods("POST")
|
||||
muxRouter.HandleFunc(path, authLoginHandler(featureConfig)).Methods("POST")
|
||||
}
|
||||
|
||||
// Healthz endpoint for the router.
|
||||
@@ -403,44 +287,6 @@ func (ts *HTTPTriggerSet) getRouter(fnTimeoutMap map[types.UID]int) *mux.Router
|
||||
return muxRouter
|
||||
}
|
||||
|
||||
func authMiddleware(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
authHeader := strings.Split(r.Header.Get("Authorization"), "Bearer ")
|
||||
if len(authHeader) != 2 || len(authHeader[1]) == 0 {
|
||||
// malformed token
|
||||
w.WriteHeader(http.StatusUnauthorized)
|
||||
_, _ = w.Write(createErrorResponse("Unauthorized: malformed Token", http.StatusUnauthorized))
|
||||
} else {
|
||||
jwtToken := authHeader[1]
|
||||
token, err := jwt.Parse(jwtToken, func(token *jwt.Token) (interface{}, error) {
|
||||
return []byte(os.Getenv("JWT_SIGNING_KEY")), nil
|
||||
})
|
||||
|
||||
if token != nil && token.Valid {
|
||||
// valid token
|
||||
next.ServeHTTP(w, r)
|
||||
} else if ve, ok := err.(*jwt.ValidationError); ok {
|
||||
w.WriteHeader(http.StatusUnauthorized)
|
||||
if ve.Errors&jwt.ValidationErrorMalformed != 0 {
|
||||
// malformed token
|
||||
_, _ = w.Write(createErrorResponse("Unauthorized: malformed Token", http.StatusUnauthorized))
|
||||
} else if ve.Errors&(jwt.ValidationErrorExpired|jwt.ValidationErrorNotValidYet) != 0 {
|
||||
// token is either expired or not active yet
|
||||
_, _ = w.Write(createErrorResponse("Unauthorized: token is either expired or not active yet", http.StatusUnauthorized))
|
||||
} else {
|
||||
_, _ = w.Write(createErrorResponse(fmt.Sprintf("Unauthorized: %v", err.Error()), http.StatusUnauthorized))
|
||||
}
|
||||
} else {
|
||||
w.WriteHeader(http.StatusUnauthorized)
|
||||
_, _ = w.Write(createErrorResponse("Unauthorized", http.StatusUnauthorized))
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
})
|
||||
}
|
||||
|
||||
func (ts *HTTPTriggerSet) updateTriggerStatusFailed(ht *fv1.HTTPTrigger, err error) {
|
||||
// TODO
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user