unkin-agent
9161558334
ci/woodpecker/tag/docker Pipeline was successful
Remote and virtual configuration writes are unauthenticated, so anything that can reach the API can repoint or delete repos. Vault identity OIDC tokens give callers a verifiable identity. - add `ARTIFACTAPI_OIDC_ISSUER`/`ARTIFACTAPI_OIDC_AUDIENCE`; unset issuer keeps auth off - require a JWKS-verified bearer token on POST/PUT/DELETE of `/api/v2/remotes` and `/api/v2/virtuals`, 401 otherwise - leave uploads, object deletes, probe, reads and `/v2` open - discover the issuer lazily with a 10s client timeout; fail fast with 503 for 15s after a failed discovery - log the verified `sub`; allow `Authorization` in CORS Reviewed-on: #136 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
74 lines
2.0 KiB
Go
74 lines
2.0 KiB
Go
package testsupport
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"crypto/rsa"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"time"
|
|
|
|
"github.com/go-jose/go-jose/v4"
|
|
"github.com/go-jose/go-jose/v4/jwt"
|
|
)
|
|
|
|
// OIDCIssuer is a minimal OIDC issuer serving discovery and JWKS, signing
|
|
// RS256 tokens with a generated key.
|
|
type OIDCIssuer struct {
|
|
*httptest.Server
|
|
key *rsa.PrivateKey
|
|
}
|
|
|
|
func NewOIDCIssuer() *OIDCIssuer {
|
|
key, err := rsa.GenerateKey(rand.Reader, 2048)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
iss := &OIDCIssuer{key: key}
|
|
mux := http.NewServeMux()
|
|
mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
|
|
_ = json.NewEncoder(w).Encode(map[string]any{
|
|
"issuer": iss.URL,
|
|
"jwks_uri": iss.URL + "/keys",
|
|
"id_token_signing_alg_values_supported": []string{"RS256"},
|
|
})
|
|
})
|
|
mux.HandleFunc("/keys", func(w http.ResponseWriter, r *http.Request) {
|
|
_ = json.NewEncoder(w).Encode(jose.JSONWebKeySet{Keys: []jose.JSONWebKey{
|
|
{Key: &key.PublicKey, KeyID: "k1", Algorithm: "RS256", Use: "sig"},
|
|
}})
|
|
})
|
|
iss.Server = httptest.NewServer(mux)
|
|
return iss
|
|
}
|
|
|
|
// Token signs a token for aud and sub. Pass a nil key to use the issuer's own;
|
|
// expiry is relative to now.
|
|
func (o *OIDCIssuer) Token(key *rsa.PrivateKey, aud, sub string, expiry time.Duration) string {
|
|
now := time.Now()
|
|
return o.Sign(key, jwt.Claims{
|
|
Issuer: o.URL,
|
|
Subject: sub,
|
|
Audience: jwt.Audience{aud},
|
|
IssuedAt: jwt.NewNumericDate(now.Add(-time.Minute)),
|
|
Expiry: jwt.NewNumericDate(now.Add(expiry)),
|
|
})
|
|
}
|
|
|
|
// Sign signs arbitrary claims with RS256. Pass a nil key to use the issuer's own.
|
|
func (o *OIDCIssuer) Sign(key *rsa.PrivateKey, claims jwt.Claims) string {
|
|
if key == nil {
|
|
key = o.key
|
|
}
|
|
sig, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: key},
|
|
(&jose.SignerOptions{}).WithType("JWT").WithHeader("kid", "k1"))
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
tok, err := jwt.Signed(sig).Claims(claims).Serialize()
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
return tok
|
|
}
|