GoogleCloudMonitoring: use grafana-google-sdk-go for auth (#40490)

2021-10-21 16:29:56 -04:00
parent 624d7631e6
commit 97df4a57f4
6 changed files with 45 additions and 198 deletions
@@ -2,95 +2,46 @@ package pluginproxy

 import (
 	"context"
-	"fmt"
-	"sync"
-	"time"

+	googletokenprovider "github.com/grafana/grafana-google-sdk-go/pkg/tokenprovider"
 	"github.com/grafana/grafana/pkg/plugins"
-	"golang.org/x/oauth2"
-	"golang.org/x/oauth2/jwt"
 )

-var (
-	oauthJwtTokenCache = oauthJwtTokenCacheType{
-		cache: map[string]*oauth2.Token{},
-	}
-)
-
-type oauthJwtTokenCacheType struct {
-	cache map[string]*oauth2.Token
-	sync.Mutex
-}
-
 type jwtAccessTokenProvider struct {
-	datasourceId      int64
-	datasourceUpdated time.Time
-	ctx               context.Context
-	route             *plugins.AppPluginRoute
-	authParams        *plugins.JwtTokenAuth
+	source googletokenprovider.TokenProvider
+	ctx    context.Context
 }

 func newJwtAccessTokenProvider(ctx context.Context, ds DSInfo, pluginRoute *plugins.AppPluginRoute,
 	authParams *plugins.JwtTokenAuth) *jwtAccessTokenProvider {
+	jwtConf := &googletokenprovider.JwtTokenConfig{}
+	if val, ok := authParams.Params["client_email"]; ok {
+		jwtConf.Email = val
+	}
+
+	if val, ok := authParams.Params["private_key"]; ok {
+		jwtConf.PrivateKey = []byte(val)
+	}
+
+	if val, ok := authParams.Params["token_uri"]; ok {
+		jwtConf.URI = val
+	}
+
+	cfg := googletokenprovider.Config{
+		RoutePath:         pluginRoute.Path,
+		RouteMethod:       pluginRoute.Method,
+		DataSourceID:      ds.ID,
+		DataSourceUpdated: ds.Updated,
+		Scopes:            authParams.Scopes,
+		JwtTokenConfig:    jwtConf,
+	}
+
 	return &jwtAccessTokenProvider{
-		datasourceId:      ds.ID,
-		datasourceUpdated: ds.Updated,
-		ctx:               ctx,
-		route:             pluginRoute,
-		authParams:        authParams,
+		source: googletokenprovider.NewJwtAccessTokenProvider(cfg),
+		ctx:    ctx,
 	}
 }

 func (provider *jwtAccessTokenProvider) GetAccessToken() (string, error) {
-	oauthJwtTokenCache.Lock()
-	defer oauthJwtTokenCache.Unlock()
-	if cachedToken, found := oauthJwtTokenCache.cache[provider.getAccessTokenCacheKey()]; found {
-		if cachedToken.Expiry.After(timeNow().Add(time.Second * 10)) {
-			logger.Debug("Using token from cache")
-			return cachedToken.AccessToken, nil
-		}
-	}
-
-	conf := &jwt.Config{}
-
-	if val, ok := provider.authParams.Params["client_email"]; ok {
-		conf.Email = val
-	}
-
-	if val, ok := provider.authParams.Params["private_key"]; ok {
-		conf.PrivateKey = []byte(val)
-	}
-
-	if val, ok := provider.authParams.Params["token_uri"]; ok {
-		conf.TokenURL = val
-	}
-
-	conf.Scopes = provider.authParams.Scopes
-
-	token, err := getTokenSource(conf, provider.ctx)
-	if err != nil {
-		return "", err
-	}
-
-	oauthJwtTokenCache.cache[provider.getAccessTokenCacheKey()] = token
-
-	logger.Info("Got new access token", "ExpiresOn", token.Expiry)
-
-	return token.AccessToken, nil
-}
-
-// getTokenSource gets a token source.
-// Stubbable by tests.
-var getTokenSource = func(conf *jwt.Config, ctx context.Context) (*oauth2.Token, error) {
-	tokenSrc := conf.TokenSource(ctx)
-	token, err := tokenSrc.Token()
-	if err != nil {
-		return nil, err
-	}
-
-	return token, nil
-}
-
-func (provider *jwtAccessTokenProvider) getAccessTokenCacheKey() string {
-	return fmt.Sprintf("%v_%v_%v_%v", provider.datasourceId, provider.datasourceUpdated.Unix(), provider.route.Path, provider.route.Method)
+	return provider.source.GetAccessToken(provider.ctx)
 }