CloudMigration: Create authapi service (#96581)

2024-11-21 20:46:06 +02:00
parent c8bc1f8637
commit e9fae5bd7f
17 changed files with 837 additions and 452 deletions
@@ -0,0 +1,398 @@
+// Package authapi contains the connector for Grafana internal auth service. This can be used instead of the GCOM service
+// to create access policies and access tokens
+package authapi
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/grafana/grafana/pkg/infra/log"
+)
+
+const LogPrefix = "auth-api.service"
+
+var ErrTokenNotFound = errors.New("auth-api: token not found")
+
+type Service interface {
+	CreateAccessPolicy(ctx context.Context, params CreateAccessPolicyParams, payload CreateAccessPolicyPayload) (AccessPolicy, error)
+	ListAccessPolicies(ctx context.Context, params ListAccessPoliciesParams) ([]AccessPolicy, error)
+	DeleteAccessPolicy(ctx context.Context, params DeleteAccessPolicyParams) (bool, error)
+	ListTokens(ctx context.Context, params ListTokenParams) ([]TokenView, error)
+	CreateToken(ctx context.Context, params CreateTokenParams, payload CreateTokenPayload) (Token, error)
+	DeleteToken(ctx context.Context, params DeleteTokenParams) error
+}
+
+type CreateAccessPolicyParams struct {
+	RequestID string
+	// this is needed until we fully migrate from gcom to authapi
+	Region string
+}
+
+type CreateAccessPolicyPayload struct {
+	Name        string   `json:"name"`
+	DisplayName string   `json:"displayName"`
+	Realms      []Realm  `json:"realms"`
+	Scopes      []string `json:"scopes"`
+}
+
+type Realm struct {
+	Identifier    string        `json:"identifier"`
+	LabelPolicies []LabelPolicy `json:"labelPolicies"`
+	Type          string        `json:"type"`
+}
+
+type LabelPolicy struct {
+	Selector string `json:"selector"`
+}
+
+type createAccessPolicyResponse struct {
+	Data AccessPolicy `json:"data"`
+}
+
+type AccessPolicy struct {
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+type ListAccessPoliciesParams struct {
+	RequestID string
+	Name      string
+	// this is needed until we fully migrate from gcom to authapi
+	Region string
+}
+
+type listAccessPoliciesResponse struct {
+	Data []AccessPolicy `json:"data"`
+}
+
+type DeleteAccessPolicyParams struct {
+	RequestID      string
+	AccessPolicyID string
+	// this is needed until we fully migrate from gcom to authapi
+	Region string
+}
+
+type ListTokenParams struct {
+	RequestID        string
+	AccessPolicyName string
+	TokenName        string
+	// this is needed until we fully migrate from gcom to authapi
+	Region string
+}
+
+type CreateTokenParams struct {
+	RequestID string
+	// this is needed until we fully migrate from gcom to authapi
+	Region string
+}
+
+type CreateTokenPayload struct {
+	AccessPolicyID string    `json:"accessPolicyId"`
+	DisplayName    string    `json:"displayName"`
+	Name           string    `json:"name"`
+	ExpiresAt      time.Time `json:"expiresAt"`
+}
+
+type createTokenResponse struct {
+	Data Token `json:"data"`
+}
+
+// Token returned by authapi api when a token gets created.
+type Token struct {
+	ID             string `json:"id"`
+	AccessPolicyID string `json:"accessPolicyId"`
+	Name           string `json:"name"`
+	Token          string `json:"token"`
+}
+
+type DeleteTokenParams struct {
+	RequestID string
+	TokenID   string
+	// this is needed until we fully migrate from gcom to authapi
+	Region string
+}
+
+// TokenView returned by authapi api for a GET token request.
+type TokenView struct {
+	ID             string `json:"id"`
+	AccessPolicyID string `json:"accessPolicyId"`
+	Name           string `json:"name"`
+	DisplayName    string `json:"displayName"`
+	ExpiresAt      string `json:"expiresAt"`
+	FirstUsedAt    string `json:"firstUsedAt"`
+	LastUsedAt     string `json:"lastUsedAt"`
+	CreatedAt      string `json:"createdAt"`
+}
+
+type listTokensResponse struct {
+	Data []TokenView `json:"data"`
+}
+
+var _ Service = (*AuthApiClient)(nil)
+
+type AuthApiClient struct {
+	log        log.Logger
+	cfg        Config
+	httpClient *http.Client
+}
+
+type Config struct {
+	ApiURL string
+	Token  string
+}
+
+func New(cfg Config, httpClient *http.Client) Service {
+	return &AuthApiClient{
+		log:        log.New(LogPrefix),
+		cfg:        cfg,
+		httpClient: httpClient,
+	}
+}
+
+func (client *AuthApiClient) CreateAccessPolicy(ctx context.Context, params CreateAccessPolicyParams, payload CreateAccessPolicyPayload) (AccessPolicy, error) {
+	endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies")
+	if err != nil {
+		return AccessPolicy{}, fmt.Errorf("building authapi access policy url: %w", err)
+	}
+
+	body, err := json.Marshal(&payload)
+	if err != nil {
+		return AccessPolicy{}, fmt.Errorf("marshaling request body: %w", err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return AccessPolicy{}, fmt.Errorf("creating http request: %w", err)
+	}
+
+	request.Header.Set("x-request-id", params.RequestID)
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token))
+
+	response, err := client.httpClient.Do(request)
+	if err != nil {
+		return AccessPolicy{}, fmt.Errorf("sending http request to create access policy: %w", err)
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			client.log.Error("closing http response body", "err", err.Error())
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(response.Body)
+		return AccessPolicy{}, fmt.Errorf("unexpected response when creating access policy: code=%d body=%s", response.StatusCode, body)
+	}
+
+	var capResp createAccessPolicyResponse
+	if err := json.NewDecoder(response.Body).Decode(&capResp); err != nil {
+		return AccessPolicy{}, fmt.Errorf("unmarshaling response body: %w", err)
+	}
+
+	return capResp.Data, nil
+}
+
+func (client *AuthApiClient) DeleteAccessPolicy(ctx context.Context, params DeleteAccessPolicyParams) (bool, error) {
+	endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies/", params.AccessPolicyID)
+	if err != nil {
+		return false, fmt.Errorf("building authapi access policy url: %w", err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodDelete, endpoint, nil)
+	if err != nil {
+		return false, fmt.Errorf("creating http request: %w", err)
+	}
+
+	request.Header.Set("x-request-id", params.RequestID)
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token))
+
+	response, err := client.httpClient.Do(request)
+	if err != nil {
+		return false, fmt.Errorf("sending http request to create access policy: %w", err)
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			client.log.Error("closing http response body", "err", err.Error())
+		}
+	}()
+
+	if response.StatusCode == http.StatusNotFound {
+		return false, nil
+	}
+
+	if response.StatusCode == http.StatusOK || response.StatusCode == http.StatusNoContent {
+		return true, nil
+	}
+
+	body, _ := io.ReadAll(response.Body)
+	return false, fmt.Errorf("unexpected response when deleting access policy: code=%d body=%s", response.StatusCode, body)
+}
+
+func (client *AuthApiClient) ListAccessPolicies(ctx context.Context, params ListAccessPoliciesParams) ([]AccessPolicy, error) {
+	endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies")
+	if err != nil {
+		return nil, fmt.Errorf("building authapi access policy url: %w", err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, fmt.Errorf("creating http request: %w", err)
+	}
+
+	query := url.Values{}
+	query.Set("name", params.Name)
+	request.URL.RawQuery = query.Encode()
+	request.Header.Set("x-request-id", params.RequestID)
+	request.Header.Set("Accept", "application/json")
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token))
+
+	response, err := client.httpClient.Do(request)
+	if err != nil {
+		return nil, fmt.Errorf("sending http request to create access policy: %w", err)
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			client.log.Error("closing http response body", "err", err.Error())
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(response.Body)
+		return nil, fmt.Errorf("unexpected response when listing access policies: code=%d body=%s", response.StatusCode, body)
+	}
+
+	var lapResp listAccessPoliciesResponse
+	if err := json.NewDecoder(response.Body).Decode(&lapResp); err != nil {
+		return lapResp.Data, fmt.Errorf("unmarshaling response body: %w", err)
+	}
+	return lapResp.Data, nil
+}
+
+func (client *AuthApiClient) ListTokens(ctx context.Context, params ListTokenParams) ([]TokenView, error) {
+	endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens")
+	if err != nil {
+		return nil, fmt.Errorf("building authapi tokens url: %w", err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, fmt.Errorf("creating http request: %w", err)
+	}
+
+	query := url.Values{}
+	query.Set("accessPolicyName", params.AccessPolicyName)
+	query.Set("name", params.TokenName)
+
+	request.URL.RawQuery = query.Encode()
+	request.Header.Set("x-request-id", params.RequestID)
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token))
+
+	response, err := client.httpClient.Do(request)
+	if err != nil {
+		return nil, fmt.Errorf("sending http request to list access tokens: %w", err)
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			client.log.Error("closing http response body", "err", err.Error())
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(response.Body)
+		return nil, fmt.Errorf("unexpected response when fetching access tokens: code=%d body=%s", response.StatusCode, body)
+	}
+
+	var body listTokensResponse
+	if err := json.NewDecoder(response.Body).Decode(&body); err != nil {
+		return nil, fmt.Errorf("unmarshaling response body: %w", err)
+	}
+	return body.Data, nil
+}
+
+func (client *AuthApiClient) CreateToken(ctx context.Context, params CreateTokenParams, payload CreateTokenPayload) (Token, error) {
+	endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens")
+	if err != nil {
+		return Token{}, fmt.Errorf("building authapi tokens url: %w", err)
+	}
+
+	body, err := json.Marshal(&payload)
+	if err != nil {
+		return Token{}, fmt.Errorf("marshaling request body: %w", err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return Token{}, fmt.Errorf("creating http request: %w", err)
+	}
+
+	request.Header.Set("x-request-id", params.RequestID)
+	request.Header.Set("Content-Type", "application/json")
+
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token))
+
+	response, err := client.httpClient.Do(request)
+	if err != nil {
+		return Token{}, fmt.Errorf("sending http request to create access token: %w", err)
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			client.log.Error("closing http response body", "err", err.Error())
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(response.Body)
+		return Token{}, fmt.Errorf("unexpected response when creating access token: code=%d body=%s", response.StatusCode, body)
+	}
+
+	var ctResp createTokenResponse
+	if err := json.NewDecoder(response.Body).Decode(&ctResp); err != nil {
+		return Token{}, fmt.Errorf("unmarshaling response body: %w", err)
+	}
+
+	return ctResp.Data, nil
+}
+
+func (client *AuthApiClient) DeleteToken(ctx context.Context, params DeleteTokenParams) error {
+	endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens", params.TokenID)
+	if err != nil {
+		return fmt.Errorf("building authapi tokens url: %w", err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodDelete, endpoint, nil)
+	if err != nil {
+		return fmt.Errorf("creating http request: %w", err)
+	}
+
+	request.Header.Set("x-request-id", params.RequestID)
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token))
+
+	response, err := client.httpClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("sending http request to delete access token: %w", err)
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			client.log.Error("closing http response body", "err", err.Error())
+		}
+	}()
+
+	if response.StatusCode == http.StatusNotFound {
+		return fmt.Errorf("token id: %s %w", params.TokenID, ErrTokenNotFound)
+	}
+
+	if response.StatusCode != http.StatusOK && response.StatusCode != http.StatusNoContent {
+		body, _ := io.ReadAll(response.Body)
+		return fmt.Errorf("unexpected response when deleting access token: code=%d body=%s", response.StatusCode, body)
+	}
+
+	return nil
+}
@@ -0,0 +1,69 @@
+package fake
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/grafana/grafana/pkg/services/authapi"
+	"github.com/grafana/grafana/pkg/util"
+)
+
+var _ authapi.Service = (*AuthapiStub)(nil)
+
+type AuthapiStub struct {
+	// The cloud migration token created by this stub.
+	Token    *authapi.TokenView
+	Policies map[string]authapi.AccessPolicy
+}
+
+func (client *AuthapiStub) CreateAccessPolicy(_ context.Context, _ authapi.CreateAccessPolicyParams, _ authapi.CreateAccessPolicyPayload) (authapi.AccessPolicy, error) {
+	randStr := fmt.Sprintf("random-policy-%s", util.GenerateShortUID())
+	policy := authapi.AccessPolicy{
+		ID:   randStr,
+		Name: randStr,
+	}
+	client.Policies[policy.ID] = policy
+	return policy, nil
+}
+
+func (client *AuthapiStub) DeleteAccessPolicy(_ context.Context, params authapi.DeleteAccessPolicyParams) (bool, error) {
+	delete(client.Policies, params.AccessPolicyID)
+	return true, nil
+}
+
+func (client *AuthapiStub) ListAccessPolicies(_ context.Context, _ authapi.ListAccessPoliciesParams) ([]authapi.AccessPolicy, error) {
+	items := make([]authapi.AccessPolicy, 0)
+	for _, v := range client.Policies {
+		items = append(items, v)
+	}
+	return items, nil
+}
+
+func (client *AuthapiStub) ListTokens(_ context.Context, _ authapi.ListTokenParams) ([]authapi.TokenView, error) {
+	if client.Token == nil {
+		return []authapi.TokenView{}, nil
+	}
+
+	return []authapi.TokenView{*client.Token}, nil
+}
+
+func (client *AuthapiStub) CreateToken(_ context.Context, _ authapi.CreateTokenParams, payload authapi.CreateTokenPayload) (authapi.Token, error) {
+	token := authapi.Token{
+		ID:             fmt.Sprintf("random-token-%s", util.GenerateShortUID()),
+		Name:           payload.Name,
+		AccessPolicyID: payload.AccessPolicyID,
+		Token:          fmt.Sprintf("completely_fake_token_%s", util.GenerateShortUID()),
+	}
+	client.Token = &authapi.TokenView{
+		ID:             token.ID,
+		Name:           token.Name,
+		AccessPolicyID: token.AccessPolicyID,
+		DisplayName:    token.Name,
+	}
+	return token, nil
+}
+
+func (client *AuthapiStub) DeleteToken(_ context.Context, _ authapi.DeleteTokenParams) error {
+	client.Token = nil
+	return nil
+}