This repository has been archived by the owner on Mar 11, 2021. It is now read-only.
/
token.go
300 lines (243 loc) · 8.89 KB
/
token.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
package repository
import (
"context"
"fmt"
"time"
permission "github.com/fabric8-services/fabric8-auth/authorization/permission/repository"
"github.com/fabric8-services/fabric8-auth/errors"
"github.com/fabric8-services/fabric8-auth/gormsupport"
"github.com/fabric8-services/fabric8-auth/log"
"github.com/goadesign/goa"
"github.com/jinzhu/gorm"
errs "github.com/pkg/errors"
"github.com/satori/go.uuid"
)
// Token represents a single instance of an oauth token
type Token struct {
gormsupport.Lifecycle
// This is the primary key value
TokenID uuid.UUID `sql:"type:uuid default uuid_generate_v4()" gorm:"primary_key;column:token_id"`
IdentityID uuid.UUID
Status int
TokenType string
// The timestamp when the token will expire
ExpiryTime time.Time
}
// TableName overrides the table name settings in Gorm to force a specific table name
// in the database.
func (m Token) TableName() string {
return "token"
}
func (m *Token) Valid() bool {
return m.Status == 0
}
func (m *Token) HasStatus(status int) bool {
return m.Status&status == status
}
func (m *Token) SetStatus(status int, value bool) {
if value {
m.Status |= status
} else {
m.Status &^= status
}
}
// TokenPrivilege is a simple many-to-many table used to link privileges to tokens
type TokenPrivilege struct {
TokenID uuid.UUID `sql:"type:uuid default uuid_generate_v4()" gorm:"primary_key;column:token_id"`
PrivilegeCacheID uuid.UUID `sql:"type:uuid default uuid_generate_v4()" gorm:"primary_key;column:privilege_cache_id"`
}
func (m TokenPrivilege) TableName() string {
return "token_privilege"
}
// GormTokenRepository is the implementation of the storage interface for Token.
type GormTokenRepository struct {
db *gorm.DB
}
// NewTokenRepository creates a new storage type.
func NewTokenRepository(db *gorm.DB) TokenRepository {
return &GormTokenRepository{db: db}
}
func (m *GormTokenRepository) TableName() string {
return "token"
}
func (m *GormTokenRepository) TokenPrivilegeTableName() string {
return "token_privilege"
}
// TokenRepository represents the storage interface.
type TokenRepository interface {
CheckExists(ctx context.Context, id uuid.UUID) (bool, error)
Load(ctx context.Context, id uuid.UUID) (*Token, error)
Create(ctx context.Context, token *Token) error
Save(ctx context.Context, token *Token) error
Delete(ctx context.Context, id uuid.UUID) error
ListForIdentity(ctx context.Context, id uuid.UUID) ([]Token, error)
CreatePrivilege(ctx context.Context, privilege *TokenPrivilege) error
ListPrivileges(ctx context.Context, tokenID uuid.UUID) ([]permission.PrivilegeCache, error)
SetStatusFlagsForIdentity(ctx context.Context, identityID uuid.UUID, status int) error
CleanupExpiredTokens(ctx context.Context, retentionHours int) error
}
// CRUD Functions
// CheckExists returns true if the given ID exists otherwise returns an error
func (m *GormTokenRepository) CheckExists(ctx context.Context, id uuid.UUID) (bool, error) {
defer goa.MeasureSince([]string{"goa", "db", "token", "exists"}, time.Now())
var exists bool
query := fmt.Sprintf(`
SELECT EXISTS (
SELECT 1 FROM %[1]s
WHERE
token_id=$1
)`, m.TableName())
err := m.db.CommonDB().QueryRow(query, id).Scan(&exists)
if err == nil && !exists {
return exists, errors.NewNotFoundError(m.TableName(), id.String())
}
if err != nil {
return false, errors.NewInternalError(errs.Wrapf(err, "unable to verify if %s exists", m.TableName()))
}
return exists, nil
}
// Load returns a single Token as a Database Model
func (m *GormTokenRepository) Load(ctx context.Context, id uuid.UUID) (*Token, error) {
defer goa.MeasureSince([]string{"goa", "db", "_token", "load"}, time.Now())
var native Token
err := m.db.Table(m.TableName()).Where("token_id = ?", id).Find(&native).Error
if err == gorm.ErrRecordNotFound {
return nil, errs.WithStack(errors.NewNotFoundError("token", id.String()))
}
return &native, errs.WithStack(err)
}
// Create creates a new record.
func (m *GormTokenRepository) Create(ctx context.Context, token *Token) error {
defer goa.MeasureSince([]string{"goa", "db", "token", "create"}, time.Now())
// If no identifier has been specified for the new token, then generate one
if token.TokenID == uuid.Nil {
token.TokenID = uuid.NewV4()
}
err := m.db.Create(token).Error
if err != nil {
if gormsupport.IsUniqueViolation(err, "token_pkey") {
return errors.NewDataConflictError(fmt.Sprintf("token with ID %s already exists", token.TokenID))
}
log.Error(ctx, map[string]interface{}{
"token_id": token.TokenID,
"err": err,
}, "unable to create the token")
return errs.WithStack(err)
}
log.Info(ctx, map[string]interface{}{
"token_id": token.TokenID,
}, "Token created!")
return nil
}
// Save modifies a single record.
func (m *GormTokenRepository) Save(ctx context.Context, token *Token) error {
defer goa.MeasureSince([]string{"goa", "db", "token", "save"}, time.Now())
obj, err := m.Load(ctx, token.TokenID)
if err != nil {
log.Error(ctx, map[string]interface{}{
"token_id": token.TokenID,
"err": err,
}, "unable to update token")
return errs.WithStack(err)
}
err = m.db.Model(obj).Updates(token).Error
if err != nil {
log.Error(ctx, map[string]interface{}{
"token_id": token.TokenID,
"err": err,
}, "unable to update the token")
return errs.WithStack(err)
}
log.Debug(ctx, map[string]interface{}{
"token_id": token.TokenID,
}, "Token saved!")
return nil
}
// Delete removes a single record.
func (m *GormTokenRepository) Delete(ctx context.Context, id uuid.UUID) error {
defer goa.MeasureSince([]string{"goa", "db", "token", "delete"}, time.Now())
obj := Token{TokenID: id}
result := m.db.Delete(obj)
if result.Error != nil {
log.Error(ctx, map[string]interface{}{
"token_id": id,
"err": result.Error,
}, "unable to delete the token")
return errs.WithStack(result.Error)
}
if result.RowsAffected == 0 {
return errors.NewNotFoundError("token", id.String())
}
log.Debug(ctx, map[string]interface{}{
"token_id": id,
}, "Token deleted!")
return nil
}
func (m *GormTokenRepository) ListForIdentity(ctx context.Context, identityID uuid.UUID) ([]Token, error) {
defer goa.MeasureSince([]string{"goa", "db", "token", "ListForIdentity"}, time.Now())
var rows []Token
err := m.db.Model(&Token{}).Where("identity_id = ?", identityID).Find(&rows).Error
if err != nil && err != gorm.ErrRecordNotFound {
return nil, errs.WithStack(err)
}
return rows, nil
}
func (m *GormTokenRepository) CreatePrivilege(ctx context.Context, privilege *TokenPrivilege) error {
defer goa.MeasureSince([]string{"goa", "db", "token", "CreatePrivilege"}, time.Now())
err := m.db.Create(privilege).Error
if err != nil {
log.Error(ctx, map[string]interface{}{
"token_id": privilege.TokenID,
"privilege_cache_id": privilege.PrivilegeCacheID,
"err": err,
}, "unable to create the token privilege")
return errs.WithStack(err)
}
log.Info(ctx, map[string]interface{}{
"token_id": privilege.TokenID,
"privilege_cache_id": privilege.PrivilegeCacheID,
}, "Token privilege created!")
return nil
}
func (m *GormTokenRepository) ListPrivileges(ctx context.Context, tokenID uuid.UUID) ([]permission.PrivilegeCache, error) {
defer goa.MeasureSince([]string{"goa", "db", "token", "ListPrivileges"}, time.Now())
var rows []permission.PrivilegeCache
err := m.db.Table("privilege_cache").Where(fmt.Sprintf(`
deleted_at IS NULL AND privilege_cache_id IN (SELECT tp.privilege_cache_id FROM %s tp WHERE tp.token_id = ?)
`, m.TokenPrivilegeTableName()),
tokenID).Scan(&rows).Error
if err != nil && err != gorm.ErrRecordNotFound {
return nil, errs.WithStack(err)
}
return rows, nil
}
func (m *GormTokenRepository) SetStatusFlagsForIdentity(ctx context.Context, identityID uuid.UUID, status int) error {
defer goa.MeasureSince([]string{"goa", "db", "token", "SetStatusFlagsForIdentity"}, time.Now())
err := m.db.Exec("UPDATE token SET status = status | ? WHERE identity_id = ? AND deleted_at IS NULL", status, identityID).Error
if err != nil {
log.Error(ctx, map[string]interface{}{
"identity_id": identityID.String(),
"status": status,
"err": err,
}, "unable to update token status")
return errs.WithStack(err)
}
log.Info(ctx, map[string]interface{}{
"identity_id": identityID.String(),
"status": status,
}, "Token status values updated")
return nil
}
func (m *GormTokenRepository) CleanupExpiredTokens(ctx context.Context, retentionHours int) error {
defer goa.MeasureSince([]string{"goa", "db", "token", "CleanupExpiredTokens"}, time.Now())
threshold := time.Now().Add(time.Duration(-retentionHours) * time.Hour)
err := m.db.Exec("DELETE FROM token WHERE expiry_time < ?", threshold).Error
if err != nil {
log.Error(ctx, map[string]interface{}{
"err": err,
}, "unable to cleanup expired tokens")
return errs.WithStack(err)
}
log.Info(ctx, map[string]interface{}{}, "Expired tokens cleaned up")
return nil
}