Test our Postgres profileStore implementation.
Update all our test cases to use time.Now().Round(time.Millisecond), because Go
uses nanosecond precision on time values, but Postgres silently truncates that
to millisecond precision. This caused our tests to report false failures that
were just silent precision loss, not actual failures.
Set up our authd server to use the Postgres store for profiles and automatically
create a test scope when starting up.
Log errors when creating Clients through the API, instead of just swallowing
them and sending back cryptic act of god errors.
Add a NewPostgres helper that returns a postgres profileStore from a connection
string (passed through pq transparently).
Add an Empty() bool helper to ProfileChange and BulkProfileChange types, so we
can determine if there are any changes we need to act on easily.
Log errors when creating Pofiles through the API, instead of just swalloing them
and sending back cryptic act of god errors.
Remove the ` quotes around field and table names, which are not supported in
Postgres. This required adding a few functions/methods to pan.
Detect situations where a profile was expected and not found, and return
ErrProfileNotFound.
Detect pq errors thrown when the profiles_pkey constraint is violated, and
transform them to the ErrProfileAlreadyExists error.
Detect empty ProfileChange and BulkProfileChange variables and abort the
updateProfile and updateProfiles methods early, before invalid SQL is generated.
Detect pq errors thrown when the logins_pkey constraint is violated, and
transform them to the ErrLoginAlreadyExists error.
Detect when removing a Login and no rows were affected, and return an
ErrLoginNotFound.
Create an sql dir with a postgres_init script that will initialize the schema of
the tables expected in the database.
10 "code.secondbit.org/uuid.hg"
14 defaultTokenExpiration = 3600 // one hour
18 RegisterGrantType("refresh_token", GrantType{
19 Validate: refreshTokenValidate,
20 Invalidate: refreshTokenInvalidate,
22 ReturnToken: RenderJSONToken,
23 AuditString: refreshTokenAuditString,
28 // ErrNoTokenStore is returned when a Context tries to act on a tokenStore without setting one first.
29 ErrNoTokenStore = errors.New("no tokenStore was specified for the Context")
30 // ErrTokenNotFound is returned when a Token is requested but not found in a tokenStore.
31 ErrTokenNotFound = errors.New("token not found in tokenStore")
32 // ErrTokenAlreadyExists is returned when a Token is added to a tokenStore, but another Token with
33 // the same AccessToken property already exists in the tokenStore.
34 ErrTokenAlreadyExists = errors.New("token already exists in tokenStore")
37 // Token represents an access and/or refresh token that the Client can use to access user data
38 // or obtain a new access token.
53 type tokenStore interface {
54 getToken(token string, refresh bool) (Token, error)
55 saveToken(token Token) error
56 revokeToken(token string, refresh bool) error
57 getTokensByProfileID(profileID uuid.ID, num, offset int) ([]Token, error)
60 func (m *memstore) getToken(token string, refresh bool) (Token, error) {
62 t, err := m.lookupTokenByRefresh(token)
69 defer m.tokenLock.RUnlock()
70 result, ok := m.tokens[token]
72 return Token{}, ErrTokenNotFound
77 func (m *memstore) saveToken(token Token) error {
79 defer m.tokenLock.Unlock()
80 _, ok := m.tokens[token.AccessToken]
82 return ErrTokenAlreadyExists
84 m.tokens[token.AccessToken] = token
85 if token.RefreshToken != "" {
86 m.refreshTokenLookup[token.RefreshToken] = token.AccessToken
88 if _, ok = m.profileTokenLookup[token.ProfileID.String()]; ok {
89 m.profileTokenLookup[token.ProfileID.String()] = append(m.profileTokenLookup[token.ProfileID.String()], token.AccessToken)
91 m.profileTokenLookup[token.ProfileID.String()] = []string{token.AccessToken}
96 func (m *memstore) revokeToken(token string, refresh bool) error {
98 t, err := m.lookupTokenByRefresh(token)
105 defer m.tokenLock.Unlock()
106 t, ok := m.tokens[token]
108 return ErrTokenNotFound
111 t.RefreshRevoked = true
119 func (m *memstore) getTokensByProfileID(profileID uuid.ID, num, offset int) ([]Token, error) {
120 ids, err := m.lookupTokensByProfileID(profileID.String())
122 return []Token{}, err
124 if len(ids) > num+offset {
125 ids = ids[offset : num+offset]
126 } else if len(ids) > offset {
129 return []Token{}, nil
132 for _, id := range ids {
133 token, err := m.getToken(id, false)
135 return []Token{}, err
137 tokens = append(tokens, token)
142 func refreshTokenValidate(w http.ResponseWriter, r *http.Request, context Context) (scopes []string, profileID uuid.ID, valid bool) {
143 enc := json.NewEncoder(w)
144 refresh := r.PostFormValue("refresh_token")
146 w.WriteHeader(http.StatusBadRequest)
147 renderJSONError(enc, "invalid_request")
150 token, err := context.GetToken(refresh, true)
152 if err == ErrTokenNotFound {
153 w.WriteHeader(http.StatusBadRequest)
154 renderJSONError(enc, "invalid_grant")
157 log.Println("Error exchanging refresh token:", err)
158 w.WriteHeader(http.StatusInternalServerError)
159 renderJSONError(enc, "server_error")
162 clientID, _, ok := getClientAuth(w, r, true)
166 if !token.ClientID.Equal(clientID) {
167 w.WriteHeader(http.StatusBadRequest)
168 renderJSONError(enc, "invalid_grant")
171 if token.RefreshRevoked {
172 w.WriteHeader(http.StatusBadRequest)
173 renderJSONError(enc, "invalid_grant")
176 return token.Scopes, token.ProfileID, true
179 func refreshTokenInvalidate(r *http.Request, context Context) error {
180 refresh := r.PostFormValue("refresh_token")
182 return ErrTokenNotFound
184 return context.RevokeToken(refresh, true)
187 func refreshTokenAuditString(r *http.Request) string {
188 return "refresh_token:" + r.PostFormValue("refresh_token")
191 // BUG(paddy): We need to implement a handler for revoking a token.
192 // BUG(paddy): We need to implement a handler for listing active tokens.