auth

Paddy 2015-05-17 Parent:8ecb60d29b0d Child:4b68bac597b7

173:b0d1b3e39fc8 Go to Latest

auth/client/client.go

Make client use our auth(n/z) scheme. Our auth(n/z) scheme can be loosely defined as "encrypted tokens that nginx transforms into headers" and "scopes for bypassing ACL". Our Go client, which is what we'll be using to have services communicate with each other, follows this paradigm now by auto-injecting the headers we'll need to identify ourselves. This will work behind our firewall, but will be useless for the rest of the world, which will need to go through the nginx bastion that can strip the headers and replace them with the headers appropriate to the token attached to the request. This did involve setting a static client ID as the client for our email_verification listener. Ideally, this would cause Client registration (using that ID) when the listener starts up, ignoring ErrClientAlreadyExists. I don't want to have to write the code that will allow us to bypass the Client ACL properly right now, though, so we're just going to have to remember to manually create that Client. Or not. I don't think it will do any harm (outside the OAuth flow) to be using a Client ID that doesn't actually point to a Client. I just think it'd be good for record-keeping purposes.

Download raw file
View source Diff to previous Annotate
History
1 package client
2
3 import (
4 "bytes"
5 "encoding/json"
6 "errors"
7 "io"
8 "net/http"
9 "strings"
10 "time"
11
12 "code.secondbit.org/auth.hg"
13 "code.secondbit.org/uuid.hg"
14 )
15
16 var (
17 ErrNilClient = errors.New("nil client wrapper")
18 ErrNilHTTPClient = errors.New("nil client")
19 )
20
21 type Client struct {
22 client *http.Client
23 address string
24 ID uuid.ID
25 }
26
27 func New(address string, id uuid.ID) *Client {
28 address = strings.TrimRight(address, "/")
29 return &Client{
30 address: address,
31 client: &http.Client{},
32 ID: id,
33 }
34 }
35
36 func (c *Client) do(method, url string, request interface{}, scopes []string, subject uuid.ID) (auth.Response, error) {
37 if c == nil {
38 return auth.Response{}, ErrNilClient
39 }
40 if c.client == nil {
41 return auth.Response{}, ErrNilHTTPClient
42 }
43 var response auth.Response
44 if !strings.HasPrefix(url, "http") {
45 url = strings.TrimLeft(url, "/")
46 url = "/" + url
47 url = c.address + url
48 }
49 var body io.Reader
50 if request != nil {
51 data, err := json.Marshal(request)
52 if err != nil {
53 return response, err
54 }
55 body = bytes.NewBuffer(data)
56 }
57 req, err := http.NewRequest(method, url, body)
58 if err != nil {
59 return response, err
60 }
61 req.Header.Set("Ducky-Scope", strings.Join(scopes, " "))
62 req.Header.Set("Ducky-Issuer", c.ID.String())
63 if subject != nil {
64 req.Header.Set("Ducky-Subject", subject.String())
65 }
66 req.Header.Set("Ducky-Expires", time.Now().Add(time.Hour).String())
67 req.Header.Set("Ducky-Issued-At", time.Now().String())
68 req.Header.Set("Ducky-Not-Before", time.Now().Add(-5*time.Minute).String())
69 resp, err := c.client.Do(req)
70 if err != nil {
71 return response, err
72 }
73 defer resp.Body.Close()
74 switch resp.Header.Get("Content-Type") {
75 case "application/json":
76 dec := json.NewDecoder(resp.Body)
77 err = dec.Decode(&response)
78 if err != nil {
79 return response, err
80 }
81 default:
82 dec := json.NewDecoder(resp.Body)
83 err = dec.Decode(&response)
84 if err != nil {
85 return response, err
86 }
87 }
88 return response, nil
89 }
90
91 func (c *Client) Get(url string, scopes []string, subject uuid.ID) (auth.Response, error) {
92 return c.do("GET", url, nil, scopes, subject)
93 }