auth

Paddy 2015-05-17 Parent:cf1aef6eb81f

173:b0d1b3e39fc8 Go to Latest

auth/authcode_postgres.go

Make client use our auth(n/z) scheme. Our auth(n/z) scheme can be loosely defined as "encrypted tokens that nginx transforms into headers" and "scopes for bypassing ACL". Our Go client, which is what we'll be using to have services communicate with each other, follows this paradigm now by auto-injecting the headers we'll need to identify ourselves. This will work behind our firewall, but will be useless for the rest of the world, which will need to go through the nginx bastion that can strip the headers and replace them with the headers appropriate to the token attached to the request. This did involve setting a static client ID as the client for our email_verification listener. Ideally, this would cause Client registration (using that ID) when the listener starts up, ignoring ErrClientAlreadyExists. I don't want to have to write the code that will allow us to bypass the Client ACL properly right now, though, so we're just going to have to remember to manually create that Client. Or not. I don't think it will do any harm (outside the OAuth flow) to be using a Client ID that doesn't actually point to a Client. I just think it'd be good for record-keeping purposes.

Download raw file
View source Diff to previous Annotate
History
paddy@156 1 package auth
paddy@156 2
paddy@156 3 import (
paddy@163 4 "code.secondbit.org/uuid.hg"
paddy@156 5 "github.com/lib/pq"
paddy@156 6 "github.com/secondbit/pan"
paddy@156 7 )
paddy@156 8
paddy@156 9 func (ac AuthorizationCode) GetSQLTableName() string {
paddy@156 10 return "authorization_codes"
paddy@156 11 }
paddy@156 12
paddy@156 13 func (p *postgres) getAuthorizationCodeSQL(code string) *pan.Query {
paddy@156 14 var ac AuthorizationCode
paddy@156 15 fields, _ := pan.GetFields(ac)
paddy@156 16 query := pan.New(pan.POSTGRES, "SELECT "+pan.QueryList(fields)+" FROM "+pan.GetTableName(ac))
paddy@156 17 query.IncludeWhere()
paddy@156 18 query.Include(pan.GetUnquotedColumn(ac, "Code")+" = ?", code)
paddy@156 19 return query.FlushExpressions(" ")
paddy@156 20 }
paddy@156 21
paddy@156 22 func (p *postgres) getAuthorizationCode(code string) (AuthorizationCode, error) {
paddy@156 23 query := p.getAuthorizationCodeSQL(code)
paddy@156 24 rows, err := p.db.Query(query.String(), query.Args...)
paddy@156 25 if err != nil {
paddy@156 26 return AuthorizationCode{}, err
paddy@156 27 }
paddy@156 28 var ac AuthorizationCode
paddy@156 29 var found bool
paddy@156 30 for rows.Next() {
paddy@156 31 err := pan.Unmarshal(rows, &ac)
paddy@156 32 if err != nil {
paddy@156 33 return ac, err
paddy@156 34 }
paddy@156 35 found = true
paddy@156 36 }
paddy@156 37 if err = rows.Err(); err != nil {
paddy@156 38 return ac, err
paddy@156 39 }
paddy@156 40 if !found {
paddy@156 41 return ac, ErrAuthorizationCodeNotFound
paddy@156 42 }
paddy@156 43 return ac, nil
paddy@156 44 }
paddy@156 45
paddy@156 46 func (p *postgres) saveAuthorizationCodeSQL(authCode AuthorizationCode) *pan.Query {
paddy@156 47 fields, values := pan.GetFields(authCode)
paddy@156 48 query := pan.New(pan.POSTGRES, "INSERT INTO "+pan.GetTableName(authCode))
paddy@156 49 query.Include("(" + pan.QueryList(fields) + ")")
paddy@156 50 query.Include("VALUES")
paddy@156 51 query.Include("("+pan.VariableList(len(values))+")", values...)
paddy@156 52 return query.FlushExpressions(" ")
paddy@156 53 }
paddy@156 54
paddy@156 55 func (p *postgres) saveAuthorizationCode(authCode AuthorizationCode) error {
paddy@156 56 query := p.saveAuthorizationCodeSQL(authCode)
paddy@156 57 _, err := p.db.Exec(query.String(), query.Args...)
paddy@156 58 if e, ok := err.(*pq.Error); ok && e.Constraint == "authorization_codes_pkey" {
paddy@156 59 err = ErrAuthorizationCodeAlreadyExists
paddy@156 60 }
paddy@156 61 return err
paddy@156 62 }
paddy@156 63
paddy@156 64 func (p *postgres) deleteAuthorizationCodeSQL(code string) *pan.Query {
paddy@156 65 var authCode AuthorizationCode
paddy@156 66 query := pan.New(pan.POSTGRES, "DELETE FROM "+pan.GetTableName(authCode))
paddy@156 67 query.IncludeWhere()
paddy@156 68 query.Include(pan.GetUnquotedColumn(authCode, "Code")+" = ?", code)
paddy@156 69 return query.FlushExpressions(" ")
paddy@156 70 }
paddy@156 71
paddy@156 72 func (p *postgres) deleteAuthorizationCode(code string) error {
paddy@156 73 query := p.deleteAuthorizationCodeSQL(code)
paddy@156 74 res, err := p.db.Exec(query.String(), query.Args...)
paddy@156 75 if err != nil {
paddy@156 76 return err
paddy@156 77 }
paddy@156 78 rows, err := res.RowsAffected()
paddy@156 79 if err != nil {
paddy@156 80 return err
paddy@156 81 }
paddy@156 82 if rows == 0 {
paddy@156 83 return ErrAuthorizationCodeNotFound
paddy@156 84 }
paddy@163 85 return nil
paddy@163 86 }
paddy@163 87
paddy@163 88 func (p *postgres) deleteAuthorizationCodesByProfileIDSQL(profileID uuid.ID) *pan.Query {
paddy@163 89 var authCode AuthorizationCode
paddy@163 90 query := pan.New(pan.POSTGRES, "DELETE FROM "+pan.GetTableName(authCode))
paddy@163 91 query.IncludeWhere()
paddy@163 92 query.Include(pan.GetUnquotedColumn(authCode, "ProfileID")+" = ?", profileID)
paddy@163 93 return query.FlushExpressions(" ")
paddy@163 94 }
paddy@163 95
paddy@163 96 func (p *postgres) deleteAuthorizationCodesByProfileID(profileID uuid.ID) error {
paddy@163 97 query := p.deleteAuthorizationCodesByProfileIDSQL(profileID)
paddy@163 98 res, err := p.db.Exec(query.String(), query.Args...)
paddy@163 99 if err != nil {
paddy@163 100 return err
paddy@163 101 }
paddy@163 102 rows, err := res.RowsAffected()
paddy@163 103 if err != nil {
paddy@163 104 return err
paddy@163 105 }
paddy@163 106 if rows == 0 {
paddy@163 107 return ErrProfileNotFound
paddy@163 108 }
paddy@163 109 return nil
paddy@156 110 }
paddy@156 111
paddy@164 112 func (p *postgres) deleteAuthorizationCodesByClientIDSQL(clientID uuid.ID) *pan.Query {
paddy@164 113 var authCode AuthorizationCode
paddy@164 114 query := pan.New(pan.POSTGRES, "DELETE FROM "+pan.GetTableName(authCode))
paddy@164 115 query.IncludeWhere()
paddy@164 116 query.Include(pan.GetUnquotedColumn(authCode, "ClientID")+" = ?", clientID)
paddy@164 117 return query.FlushExpressions(" ")
paddy@164 118 }
paddy@164 119
paddy@164 120 func (p *postgres) deleteAuthorizationCodesByClientID(clientID uuid.ID) error {
paddy@164 121 query := p.deleteAuthorizationCodesByClientIDSQL(clientID)
paddy@164 122 res, err := p.db.Exec(query.String(), query.Args...)
paddy@164 123 if err != nil {
paddy@164 124 return err
paddy@164 125 }
paddy@164 126 rows, err := res.RowsAffected()
paddy@164 127 if err != nil {
paddy@164 128 return err
paddy@164 129 }
paddy@164 130 if rows == 0 {
paddy@164 131 return ErrClientNotFound
paddy@164 132 }
paddy@164 133 return nil
paddy@164 134 }
paddy@164 135
paddy@156 136 func (p *postgres) useAuthorizationCodeSQL(code string) *pan.Query {
paddy@156 137 var authCode AuthorizationCode
paddy@156 138 query := pan.New(pan.POSTGRES, "UPDATE "+pan.GetTableName(authCode)+" SET ")
paddy@156 139 query.Include(pan.GetUnquotedColumn(authCode, "Used")+" = ?", true)
paddy@156 140 query.IncludeWhere()
paddy@156 141 query.Include(pan.GetUnquotedColumn(authCode, "Code")+" = ?", code)
paddy@156 142 return query.FlushExpressions(" ")
paddy@156 143 }
paddy@156 144
paddy@156 145 func (p *postgres) useAuthorizationCode(code string) error {
paddy@156 146 query := p.useAuthorizationCodeSQL(code)
paddy@156 147 res, err := p.db.Exec(query.String(), query.Args...)
paddy@156 148 if err != nil {
paddy@156 149 return err
paddy@156 150 }
paddy@156 151 rows, err := res.RowsAffected()
paddy@156 152 if err != nil {
paddy@156 153 return err
paddy@156 154 }
paddy@156 155 if rows == 0 {
paddy@156 156 return ErrAuthorizationCodeNotFound
paddy@156 157 }
paddy@156 158 return nil
paddy@156 159 }