Skip to content

Commit e5ee5ff

Browse files
ponachteponachte
committed
auth code flow integration test
1 parent 5fbd880 commit e5ee5ff

14 files changed

Lines changed: 559 additions & 467 deletions

File tree

‎containers/aggregator-server/model/registration.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ type RegistrationResponse struct {
4848

4949
// AuthorizationCodeStartResponse represents the response for authorization_code start phase
5050
type AuthorizationCodeStartResponse struct {
51-
AggregatorClientID string `json:"client_id"`
51+
AggregatorClientID string `json:"aggregator_client_id"`
5252
CodeChallenge string `json:"code_challenge"`
5353
CodeChallengeMethod string `json:"code_challenge_method"`
5454
State string `json:"state"`

‎containers/aggregator-server/registration/registration.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,11 @@ func handleRegistrationDelete(w http.ResponseWriter, r *http.Request) {
148148
}
149149
logrus.Infof("Kubernetes resources deleted for aggregator: %s", req.AggregatorID)
150150

151+
// Delete user tokens
152+
if inst.RegistrationType != "none" {
153+
deleteTokens(inst.OwnerID)
154+
}
155+
151156
// Delete from storage
152157
logrus.Infof("Deleting aggregator instance from storage: %s", req.AggregatorID)
153158
if err := instance.DeleteAggregatorInstance(req.AggregatorID); err != nil {

‎containers/aggregator-server/registration/registration_authorization_code.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,7 @@ func handleAuthorizationCodeFinish(w http.ResponseWriter, req model.Registration
220220
var inst *instance.AggregatorInstance
221221
if isUpdate {
222222
// Check if aggregator exists
223-
inst, err := instance.GetAggregatorInstance(storedData.AggregatorID)
223+
inst, err = instance.GetAggregatorInstance(storedData.AggregatorID)
224224
if err != nil {
225225
logrus.WithError(err).Error("Failed to retrieve aggregator for update")
226226
http.Error(w, "Aggregator not found for update", http.StatusNotFound)

‎containers/aggregator-server/registration/tokens.go‎

Lines changed: 38 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"fmt"
99
"io"
1010
"net/http"
11+
"net/url"
1112
"time"
1213
)
1314

@@ -21,6 +22,7 @@ type TokenResponse struct {
2122
}
2223

2324
type StoreRequest struct {
25+
UserID string `json:"user_id"`
2426
AccessToken string `json:"access_token"`
2527
RefreshToken string `json:"refresh_token"`
2628
IDToken string `json:"id_token"`
@@ -41,6 +43,7 @@ func storeTokens(
4143
expiryUnix := time.Now().Add(time.Duration(tok.ExpiresIn) * time.Second).Unix()
4244

4345
reqBody := StoreRequest{
46+
UserID: userID,
4447
AccessToken: tok.AccessToken,
4548
RefreshToken: tok.RefreshToken,
4649
IDToken: tok.IDToken,
@@ -55,16 +58,10 @@ func storeTokens(
5558
return err
5659
}
5760

58-
url := fmt.Sprintf(
59-
"http://token-service.%s.svc.cluster.local:8080/token/%s",
60-
model.Namespace,
61-
userID,
62-
)
63-
6461
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
6562
defer cancel()
6663

67-
req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewBuffer(data))
64+
req, err := http.NewRequestWithContext(ctx, http.MethodPost, "http://token-service:8080/token", bytes.NewBuffer(data))
6865
if err != nil {
6966
return err
7067
}
@@ -94,6 +91,7 @@ func updateTokens(
9491
expiryUnix := time.Now().Add(time.Duration(tok.ExpiresIn) * time.Second).Unix()
9592

9693
reqBody := StoreRequest{
94+
UserID: userID,
9795
AccessToken: tok.AccessToken,
9896
RefreshToken: tok.RefreshToken,
9997
IDToken: tok.IDToken,
@@ -108,16 +106,10 @@ func updateTokens(
108106
return err
109107
}
110108

111-
url := fmt.Sprintf(
112-
"http://token-service.%s.svc.cluster.local:8080/token/%s",
113-
model.Namespace,
114-
userID,
115-
)
116-
117109
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
118110
defer cancel()
119111

120-
req, err := http.NewRequestWithContext(ctx, http.MethodPut, url, bytes.NewBuffer(data))
112+
req, err := http.NewRequestWithContext(ctx, http.MethodPut, "http://token-service:8080/token", bytes.NewBuffer(data))
121113
if err != nil {
122114
return err
123115
}
@@ -129,10 +121,41 @@ func updateTokens(
129121
}
130122
defer resp.Body.Close()
131123

132-
if resp.StatusCode != http.StatusCreated {
124+
if resp.StatusCode != http.StatusOK {
133125
body, _ := io.ReadAll(resp.Body)
134126
return fmt.Errorf("token service returned %d: %s", resp.StatusCode, string(body))
135127
}
136128

137129
return nil
138130
}
131+
132+
func deleteTokens(userID string) error {
133+
encodedID := url.QueryEscape(userID)
134+
135+
endpoint := fmt.Sprintf(
136+
"http://token-service:8080/token?id=%s",
137+
encodedID,
138+
)
139+
140+
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
141+
defer cancel()
142+
143+
req, err := http.NewRequestWithContext(ctx, http.MethodDelete, endpoint, nil)
144+
if err != nil {
145+
return err
146+
}
147+
148+
resp, err := model.HttpClient.Do(req)
149+
if err != nil {
150+
return err
151+
}
152+
defer resp.Body.Close()
153+
154+
if resp.StatusCode != http.StatusNoContent &&
155+
resp.StatusCode != http.StatusOK &&
156+
resp.StatusCode != http.StatusNotFound {
157+
return fmt.Errorf("unexpected status from token service: %d", resp.StatusCode)
158+
}
159+
160+
return nil
161+
}

‎containers/aggregator/config/description.go‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"encoding/json"
77
"fmt"
88
"net/http"
9+
"net/url"
910
"os"
1011
"strings"
1112
"time"
@@ -71,10 +72,13 @@ func handleAggregatorDescription(w http.ResponseWriter, r *http.Request) {
7172
}
7273

7374
func checkLoginStatus() bool {
75+
// URL-encode the userID for safe use as a query parameter
76+
encodedID := url.QueryEscape(model.Owner.UserId)
77+
7478
url := fmt.Sprintf(
75-
"http://token-service.%s.svc.cluster.local:8080/loginstatus/%s",
79+
"http://token-service.%s.svc.cluster.local:8080/loginstatus?id=%s",
7680
model.Namespace,
77-
model.Owner.UserId,
81+
encodedID,
7882
)
7983

8084
req, err := http.NewRequest(http.MethodGet, url, nil)

‎containers/egress-uma/tokens.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"errors"
77
"fmt"
88
"net/http"
9+
"net/url"
910

1011
"github.com/sirupsen/logrus"
1112
)
@@ -16,7 +17,13 @@ func getAccessToken() (string, error) {
1617
"component": "token_service",
1718
})
1819

19-
url := fmt.Sprintf("http://token-service:8080/token/%s", UserId)
20+
// URL-encode the userID for safe use as a query parameter
21+
encodedID := url.QueryEscape(UserId)
22+
23+
url := fmt.Sprintf(
24+
"http://token-service:8080/token?id=%s",
25+
encodedID,
26+
)
2027

2128
req, err := http.NewRequest("GET", url, nil)
2229
if err != nil {

‎containers/ingress-uma/auth/credentials.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"fmt"
99
"ingress-uma/model"
1010
"net/http"
11+
"net/url"
1112
"sync"
1213
"time"
1314

@@ -371,7 +372,13 @@ func getIDToken(userId string) (string, error) {
371372
"component": "token_service",
372373
})
373374

374-
url := fmt.Sprintf("http://token-service:8080/token/%s", userId)
375+
// URL-encode the userID for safe use as a query parameter
376+
encodedID := url.QueryEscape(userId)
377+
378+
url := fmt.Sprintf(
379+
"http://token-service:8080/token?id=%s",
380+
encodedID,
381+
)
375382

376383
req, err := http.NewRequest("GET", url, nil)
377384
if err != nil {

‎containers/token-service/main.go‎

Lines changed: 69 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"fmt"
88
"net"
99
"net/http"
10+
"net/url"
1011
"os"
1112
"os/signal"
1213
"strings"
@@ -51,8 +52,8 @@ func main() {
5152

5253
log.Info("Starting token service")
5354

54-
http.HandleFunc("/token/", tokenHandler)
55-
http.HandleFunc("/loginstatus/", authorizedHandler)
55+
http.HandleFunc("/token", tokenHandler)
56+
http.HandleFunc("/loginstatus", authorizedHandler)
5657
http.HandleFunc("/healthz", healthHandler)
5758

5859
// Listen for SIGTERM
@@ -96,22 +97,22 @@ func healthHandler(w http.ResponseWriter, r *http.Request) {
9697
}
9798

9899
func tokenHandler(w http.ResponseWriter, r *http.Request) {
99-
userID := r.URL.Path[len("/token/"):]
100100
switch r.Method {
101101
case http.MethodPost:
102-
handleStore(w, r, userID)
102+
handleStore(w, r)
103103
case http.MethodPut:
104-
handleUpdate(w, r, userID)
104+
handleUpdate(w, r)
105105
case http.MethodGet:
106-
handleGet(w, r, userID)
106+
handleGet(w, r)
107107
case http.MethodDelete:
108-
handleDelete(w, r, userID)
108+
handleDelete(w, r)
109109
default:
110110
w.WriteHeader(http.StatusMethodNotAllowed)
111111
}
112112
}
113113

114114
type StoreRequest struct {
115+
UserID string `json:"user_id"`
115116
AccessToken string `json:"access_token"`
116117
RefreshToken string `json:"refresh_token"`
117118
IDToken string `json:"id_token"`
@@ -121,21 +122,21 @@ type StoreRequest struct {
121122
ClientSecret string `json:"client_secret"`
122123
}
123124

124-
func handleStore(w http.ResponseWriter, r *http.Request, userID string) {
125-
_, exists := store.tokens[userID]
126-
if exists {
127-
log.WithField("user_id", userID).Warn("Token store requested but existing token found")
128-
http.Error(w, "User tokens already exists. Use PUT to update a token", 409)
129-
return
130-
}
131-
125+
func handleStore(w http.ResponseWriter, r *http.Request) {
132126
var req StoreRequest
133127
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
134128
log.WithError(err).Warn("Invalid store request")
135129
http.Error(w, err.Error(), 400)
136130
return
137131
}
138132

133+
_, exists := store.tokens[req.UserID]
134+
if exists {
135+
log.WithField("user_id", req.UserID).Warn("Token store requested but existing token found")
136+
http.Error(w, "User tokens already exists. Use PUT to update a token", 409)
137+
return
138+
}
139+
139140
provider, err := oidc.NewProvider(ctx, req.Issuer)
140141
if err != nil {
141142
http.Error(w, err.Error(), 400)
@@ -159,26 +160,26 @@ func handleStore(w http.ResponseWriter, r *http.Request, userID string) {
159160
Expiry: time.Unix(req.Expiry, 0),
160161
}
161162

162-
storeToken(userID, token, req.IDToken, oauthConfig, req.Issuer)
163+
storeToken(req.UserID, token, req.IDToken, oauthConfig, req.Issuer)
163164

164165
w.WriteHeader(http.StatusCreated)
165166
}
166167

167-
func handleUpdate(w http.ResponseWriter, r *http.Request, userID string) {
168-
_, exists := store.tokens[userID]
169-
if !exists {
170-
log.WithField("user_id", userID).Warn("Token update requested but no existing token found")
171-
http.Error(w, "User tokens not found. Use POST to create a token", 404)
172-
return
173-
}
174-
168+
func handleUpdate(w http.ResponseWriter, r *http.Request) {
175169
var req StoreRequest
176170
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
177171
log.WithError(err).Warn("Invalid update request")
178172
http.Error(w, err.Error(), 400)
179173
return
180174
}
181175

176+
_, exists := store.tokens[req.UserID]
177+
if !exists {
178+
log.WithField("user_id", req.UserID).Warn("Token update requested but no existing token found")
179+
http.Error(w, "User tokens not found. Use POST to create a token", 404)
180+
return
181+
}
182+
182183
provider, err := oidc.NewProvider(ctx, req.Issuer)
183184
if err != nil {
184185
http.Error(w, err.Error(), 400)
@@ -202,7 +203,7 @@ func handleUpdate(w http.ResponseWriter, r *http.Request, userID string) {
202203
Expiry: time.Unix(req.Expiry, 0),
203204
}
204205

205-
storeToken(userID, token, req.IDToken, oauthConfig, req.Issuer)
206+
storeToken(req.UserID, token, req.IDToken, oauthConfig, req.Issuer)
206207

207208
w.WriteHeader(http.StatusOK)
208209
}
@@ -220,7 +221,21 @@ func storeToken(userID string, token *oauth2.Token, idToken string, config *oaut
220221
log.WithField("user_id", userID).Info("Stored token")
221222
}
222223

223-
func handleGet(w http.ResponseWriter, _ *http.Request, userID string) {
224+
func handleGet(w http.ResponseWriter, r *http.Request) {
225+
// Get the userID from the query parameter
226+
encodedID := r.URL.Query().Get("id")
227+
if encodedID == "" {
228+
http.Error(w, "Missing 'id' query parameter", http.StatusBadRequest)
229+
return
230+
}
231+
232+
// URL-decode the userID
233+
userID, err := url.QueryUnescape(encodedID)
234+
if err != nil {
235+
http.Error(w, "Invalid 'id' query parameter", http.StatusBadRequest)
236+
return
237+
}
238+
224239
entry, err := getEntry(userID)
225240
if err != nil {
226241
log.WithField("user_id", userID).Warn("Token not found")
@@ -241,7 +256,21 @@ func handleGet(w http.ResponseWriter, _ *http.Request, userID string) {
241256
})
242257
}
243258

244-
func handleDelete(w http.ResponseWriter, _ *http.Request, userID string) {
259+
func handleDelete(w http.ResponseWriter, r *http.Request) {
260+
// Get the userID from the query parameter
261+
encodedID := r.URL.Query().Get("id")
262+
if encodedID == "" {
263+
http.Error(w, "Missing 'id' query parameter", http.StatusBadRequest)
264+
return
265+
}
266+
267+
// URL-decode the userID
268+
userID, err := url.QueryUnescape(encodedID)
269+
if err != nil {
270+
http.Error(w, "Invalid 'id' query parameter", http.StatusBadRequest)
271+
return
272+
}
273+
245274
store.mu.Lock()
246275
delete(store.tokens, userID)
247276
store.mu.Unlock()
@@ -256,7 +285,19 @@ func authorizedHandler(w http.ResponseWriter, r *http.Request) {
256285
return
257286
}
258287

259-
userID := r.URL.Path[len("/loginstatus/"):]
288+
// Get the userID from the query parameter
289+
encodedID := r.URL.Query().Get("id")
290+
if encodedID == "" {
291+
http.Error(w, "Missing 'id' query parameter", http.StatusBadRequest)
292+
return
293+
}
294+
295+
// URL-decode the userID
296+
userID, err := url.QueryUnescape(encodedID)
297+
if err != nil {
298+
http.Error(w, "Invalid 'id' query parameter", http.StatusBadRequest)
299+
return
300+
}
260301

261302
entry, err := getEntry(userID)
262303
if err != nil {

0 commit comments

Comments
 (0)