From 2b0dc71f93d1428825c0331745620b41def08a6c Mon Sep 17 00:00:00 2001 From: Ziti-Ci Date: Tue, 5 Sep 2023 09:55:55 -0500 Subject: [PATCH] updates to the oauth work --- cmd/zrok/sharePublic.go | 23 +- controller/controller.go | 1 - controller/oauth.go | 87 ---- endpoints/publicProxy/config.go | 23 + endpoints/publicProxy/github.go | 151 +++++++ endpoints/publicProxy/google.go | 130 ++++++ endpoints/publicProxy/http.go | 144 ++++++- endpoints/publicProxy/unauthorizedUi/embed.go | 6 + .../publicProxy/unauthorizedUi/handler.go | 21 + .../publicProxy/unauthorizedUi/index.html | 400 ++++++++++++++++++ etc/http-frontend.yml | 16 + go.mod | 25 +- go.sum | 50 ++- .../share/oauth_authenticate_parameters.go | 25 +- .../share/oauth_authenticate_responses.go | 68 +++ rest_model_zrok/share_request.go | 14 +- rest_server_zrok/embedded_spec.go | 36 +- .../share/oauth_authenticate_parameters.go | 14 +- .../share/oauth_authenticate_responses.go | 47 ++ .../share/oauth_authenticate_urlbuilder.go | 7 +- specs/zrok.yml | 26 +- ui/src/api/share.js | 8 +- ui/src/api/types.js | 1 + 23 files changed, 1136 insertions(+), 187 deletions(-) delete mode 100644 controller/oauth.go create mode 100644 endpoints/publicProxy/github.go create mode 100644 endpoints/publicProxy/google.go create mode 100644 endpoints/publicProxy/unauthorizedUi/embed.go create mode 100644 endpoints/publicProxy/unauthorizedUi/handler.go create mode 100644 endpoints/publicProxy/unauthorizedUi/index.html diff --git a/cmd/zrok/sharePublic.go b/cmd/zrok/sharePublic.go index bf08e69f..b99edc97 100644 --- a/cmd/zrok/sharePublic.go +++ b/cmd/zrok/sharePublic.go @@ -6,6 +6,7 @@ import ( "os/signal" "strings" "syscall" + "time" tea "github.com/charmbracelet/bubbletea" "github.com/go-openapi/runtime" @@ -28,14 +29,15 @@ func init() { } type sharePublicCommand struct { - basicAuth []string - frontendSelection []string - backendMode string - headless bool - insecure bool - oauthProvider string - oauthEmailDomains []string - cmd *cobra.Command + basicAuth []string + frontendSelection []string + backendMode string + headless bool + insecure bool + oauthProvider string + oauthEmailDomains []string + oauthCheckInterval time.Duration + cmd *cobra.Command } func newSharePublicCommand() *sharePublicCommand { @@ -53,6 +55,8 @@ func newSharePublicCommand() *sharePublicCommand { cmd.Flags().StringVar(&command.oauthProvider, "provider", "", "Provider to authenticate against with oauth") cmd.Flags().StringArrayVar(&command.oauthEmailDomains, "oauth-domains", []string{}, "Valid email domains for oauth authentication") + cmd.Flags().DurationVar(&command.oauthCheckInterval, "oauth-check-interval", 3*time.Hour, "Max lifetime for oauth validation. Will force a recheck once time elapses for session") + cmd.MarkFlagsMutuallyExclusive("basic-auth", "provider") cmd.Run = command.run return command @@ -132,9 +136,8 @@ func (cmd *sharePublicCommand) run(_ *cobra.Command, args []string) { if cmd.oauthProvider != "" { req.Body.AuthScheme = string(model.Oauth) req.Body.OauthProvider = cmd.oauthProvider - } - if len(cmd.oauthEmailDomains) > 0 { req.Body.OauthEmailDomains = cmd.oauthEmailDomains + req.Body.OauthAuthorizationCheckInterval = cmd.oauthCheckInterval.String() } resp, err := zrok.Share.Share(req, auth) if err != nil { diff --git a/controller/controller.go b/controller/controller.go index d0e9dc69..12c554b1 100644 --- a/controller/controller.go +++ b/controller/controller.go @@ -70,7 +70,6 @@ func Run(inCfg *config.Config) error { api.MetadataOverviewHandler = newOverviewHandler() api.MetadataVersionHandler = metadata.VersionHandlerFunc(versionHandler) api.ShareAccessHandler = newAccessHandler() - api.ShareOauthAuthenticateHandler = newOauthHandler() api.ShareShareHandler = newShareHandler() api.ShareUnaccessHandler = newUnaccessHandler() api.ShareUnshareHandler = newUnshareHandler() diff --git a/controller/oauth.go b/controller/oauth.go deleted file mode 100644 index d0f5736c..00000000 --- a/controller/oauth.go +++ /dev/null @@ -1,87 +0,0 @@ -package controller - -import ( - "context" - "encoding/base64" - "fmt" - "io" - "io/ioutil" - "net/http" - "net/url" - "strings" - - "github.com/openziti/zrok/controller/oauth" - - "github.com/aws/aws-sdk-go-v2/config" - "github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider" - "github.com/go-openapi/runtime/middleware" - "github.com/openziti/zrok/rest_server_zrok/operations/share" - "github.com/sirupsen/logrus" -) - -type oauthHandler struct{} - -func newOauthHandler() *oauthHandler { - return &oauthHandler{} -} - -func (h *oauthHandler) Handle(params share.OauthAuthenticateParams) middleware.Responder { - ghandle := oauth.NewGoogleOauthHandler() - return ghandle.Handle(params) - awsUrl := "https:///oauth2/token" // COGNITO URL OR WHATEVER OAUTH PROVIDER URL - clientId := "" // PROVIDER CLIENT ID - secret := "" // PROVIDER CLIENT SECRET - auth := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", clientId, secret))) - grant := "authorization_code" - redirectUri := "http://localhost:18080/api/v1/oauth/authorize" - // scope := "email" - data := url.Values{} - data.Set("client_id", clientId) - data.Set("grant_type", grant) - // data.Set("scope", scope) - data.Set("code", params.Code) - data.Set("redirect_uri", redirectUri) - encodedData := data.Encode() - - c := http.Client{} - req := &http.Request{} - req.Method = http.MethodPost - req.URL, _ = url.Parse(awsUrl) - req.Body = io.NopCloser(strings.NewReader(encodedData)) - req.Header = http.Header{} - req.Header.Add("Content-Type", "application/x-www-form-urlencoded") - req.Header.Add("Authorization", fmt.Sprintf("Basic %s", auth)) - resp, err := c.Do(req) - // resp, err := http.Post(awsUrl, "application/x-www-form-urlencoded", strings.NewReader(encodedData)) - logrus.Error(err) - logrus.Error(resp) - b, err := ioutil.ReadAll(resp.Body) - logrus.Error(err) - logrus.Error(string(b)) - //user, err := cog.GetUser(&cognitoidentityprovider.GetUserInput{ - // AccessToken: aws.String(params.Code), - //}) - //if err != nil { - // logrus.Error(err) - //} - //logrus.Error(user) - logrus.Error("--------------") - return share.NewOauthAuthenticateOK() -} - -func old(params share.OauthAuthenticateParams) { - sdkConfig, err := config.LoadDefaultConfig(context.TODO()) - sdkConfig.Region = "us-east-1" - if err != nil { - fmt.Println("Couldn't load default configuration. Have you set up your AWS account?") - fmt.Println(err) - // return share.NewOauthAuthenticateOK() - } - - cog := cognitoidentityprovider.NewFromConfig(sdkConfig) - user, err := cog.GetUser(context.TODO(), &cognitoidentityprovider.GetUserInput{ - AccessToken: ¶ms.Code, - }) - logrus.Error(err) - logrus.Error(user) -} diff --git a/endpoints/publicProxy/config.go b/endpoints/publicProxy/config.go index fd6fe6c0..d32a74c2 100644 --- a/endpoints/publicProxy/config.go +++ b/endpoints/publicProxy/config.go @@ -9,6 +9,29 @@ type Config struct { Identity string Address string HostMatch string + Oauth *OauthConfig +} + +type OauthConfig struct { + Port int + RedirectUrl string + HashKeyRaw string + Providers []*OauthProviderSecrets +} + +func (oc *OauthConfig) GetProvider(name string) *OauthProviderSecrets { + for _, provider := range oc.Providers { + if provider.Name == name { + return provider + } + } + return nil +} + +type OauthProviderSecrets struct { + Name string + ClientId string + ClientSecret string } func DefaultConfig() *Config { diff --git a/endpoints/publicProxy/github.go b/endpoints/publicProxy/github.go new file mode 100644 index 00000000..39fa295f --- /dev/null +++ b/endpoints/publicProxy/github.go @@ -0,0 +1,151 @@ +package publicProxy + +import ( + "encoding/json" + "fmt" + "io" + "net/http" + "net/url" + "time" + + "github.com/golang-jwt/jwt/v5" + "github.com/google/uuid" + "github.com/sirupsen/logrus" + "github.com/zitadel/oidc/v2/pkg/client/rp" + zhttp "github.com/zitadel/oidc/v2/pkg/http" + "github.com/zitadel/oidc/v2/pkg/oidc" + "golang.org/x/oauth2" + githubOAuth "golang.org/x/oauth2/github" +) + +func configureGithubOauth(cfg *OauthConfig, tls bool) error { + scheme := "http" + if tls { + scheme = "https" + } + + providerCfg := cfg.GetProvider("github") + if providerCfg == nil { + logrus.Info("unable to find provider config for github. Skipping.") + return nil + } + clientID := providerCfg.ClientId + callbackPath := "/github/oauth" + port := cfg.Port + redirectUrl := fmt.Sprintf("%s://%s", scheme, cfg.RedirectUrl) + rpConfig := &oauth2.Config{ + ClientID: clientID, + ClientSecret: providerCfg.ClientSecret, + RedirectURL: fmt.Sprintf("%v:%v%v", redirectUrl, port, callbackPath), + Scopes: []string{"user:email"}, + Endpoint: githubOAuth.Endpoint, + } + + key := []byte(cfg.HashKeyRaw) + + cookieHandler := zhttp.NewCookieHandler(key, key, zhttp.WithUnsecure(), zhttp.WithDomain(cfg.RedirectUrl)) + + options := []rp.Option{ + rp.WithCookieHandler(cookieHandler), + rp.WithVerifierOpts(rp.WithIssuedAtOffset(5 * time.Second)), + //rp.WithPKCE(cookieHandler), //Github currently doesn't support pkce. Update when that changes. + } + + relyingParty, err := rp.NewRelyingPartyOAuth(rpConfig, options...) + if err != nil { + return err + } + + type IntermediateJWT struct { + State string `json:"state"` + Share string `json:"share"` + jwt.RegisteredClaims + } + + type githubUserResp struct { + Email string + Primary bool + Verified bool + Visibility string + } + + authHandlerWithQueryState := func(party rp.RelyingParty) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + rp.AuthURLHandler(func() string { + id := uuid.New().String() + t := jwt.NewWithClaims(jwt.SigningMethodHS256, IntermediateJWT{ + id, + r.URL.Query().Get("share"), + jwt.RegisteredClaims{ + ExpiresAt: jwt.NewNumericDate(time.Now().Add(24 * time.Hour)), + IssuedAt: jwt.NewNumericDate(time.Now()), + NotBefore: jwt.NewNumericDate(time.Now()), + Issuer: "zrok", + Subject: "intermediate_token", + ID: id, + }, + }) + s, err := t.SignedString(key) + if err != nil { + logrus.Errorf("Unable to sign intermediate JWT: %v", err) + } + return s + }, party, rp.WithURLParam("access_type", "offline"))(w, r) + } + } + + http.Handle("/github/login", authHandlerWithQueryState(relyingParty)) + getEmail := func(w http.ResponseWriter, r *http.Request, tokens *oidc.Tokens[*oidc.IDTokenClaims], state string, rp rp.RelyingParty) { + parsedUrl, err := url.Parse("https://api.github.com/user/emails") + if err != nil { + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + req := &http.Request{ + Method: http.MethodGet, + URL: parsedUrl, + Header: make(http.Header), + } + req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", tokens.AccessToken)) + resp, err := http.DefaultClient.Do(req) + if err != nil { + logrus.Error("Get: " + err.Error() + "\n") + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + defer resp.Body.Close() + response, err := io.ReadAll(resp.Body) + if err != nil { + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + rDat := []githubUserResp{} + err = json.Unmarshal(response, &rDat) + if err != nil { + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + + primaryEmail := "" + for _, email := range rDat { + if email.Primary { + primaryEmail = email.Email + break + } + } + + SetZrokCookie(w, primaryEmail, tokens.AccessToken, "github", 3*time.Hour, key) + + token, err := jwt.ParseWithClaims(state, &IntermediateJWT{}, func(t *jwt.Token) (interface{}, error) { + return key, nil + }) + if err != nil { + http.Error(w, fmt.Sprintf("After intermediate token parse: %v", err.Error()), http.StatusInternalServerError) + return + } + http.Redirect(w, r, fmt.Sprintf("%s://%s.%s:8080", scheme, token.Claims.(*IntermediateJWT).Share, cfg.RedirectUrl), http.StatusFound) + } + + http.Handle(callbackPath, rp.CodeExchangeHandler(getEmail, relyingParty)) + return nil +} diff --git a/endpoints/publicProxy/google.go b/endpoints/publicProxy/google.go new file mode 100644 index 00000000..ced5f834 --- /dev/null +++ b/endpoints/publicProxy/google.go @@ -0,0 +1,130 @@ +package publicProxy + +import ( + "encoding/json" + "fmt" + "io" + "net/http" + "net/url" + "time" + + "github.com/golang-jwt/jwt/v5" + "github.com/google/uuid" + "github.com/sirupsen/logrus" + "github.com/zitadel/oidc/v2/pkg/client/rp" + zhttp "github.com/zitadel/oidc/v2/pkg/http" + "github.com/zitadel/oidc/v2/pkg/oidc" + "golang.org/x/oauth2" + googleOauth "golang.org/x/oauth2/google" +) + +func configureGoogleOauth(cfg *OauthConfig, tls bool) error { + scheme := "http" + if tls { + scheme = "https" + } + + providerCfg := cfg.GetProvider("google") + if providerCfg == nil { + logrus.Info("unable to find provider config for google. Skipping.") + return nil + } + + clientID := providerCfg.ClientId + callbackPath := "/google/oauth" + port := cfg.Port + redirectUrl := fmt.Sprintf("%s://%s", scheme, cfg.RedirectUrl) + rpConfig := &oauth2.Config{ + ClientID: clientID, + ClientSecret: providerCfg.ClientSecret, + RedirectURL: fmt.Sprintf("%v:%v%v", redirectUrl, port, callbackPath), + Scopes: []string{"https://www.googleapis.com/auth/userinfo.email"}, + Endpoint: googleOauth.Endpoint, + } + + key := []byte(cfg.HashKeyRaw) + + cookieHandler := zhttp.NewCookieHandler(key, key, zhttp.WithUnsecure(), zhttp.WithDomain(cfg.RedirectUrl)) + + options := []rp.Option{ + rp.WithCookieHandler(cookieHandler), + rp.WithVerifierOpts(rp.WithIssuedAtOffset(5 * time.Second)), + rp.WithPKCE(cookieHandler), + } + + relyingParty, err := rp.NewRelyingPartyOAuth(rpConfig, options...) + if err != nil { + return err + } + + type IntermediateJWT struct { + State string `json:"state"` + Share string `json:"share"` + jwt.RegisteredClaims + } + + type googleOauthEmailResp struct { + Email string + } + + authHandlerWithQueryState := func(party rp.RelyingParty) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + rp.AuthURLHandler(func() string { + id := uuid.New().String() + t := jwt.NewWithClaims(jwt.SigningMethodHS256, IntermediateJWT{ + id, + r.URL.Query().Get("share"), + jwt.RegisteredClaims{ + ExpiresAt: jwt.NewNumericDate(time.Now().Add(24 * time.Hour)), + IssuedAt: jwt.NewNumericDate(time.Now()), + NotBefore: jwt.NewNumericDate(time.Now()), + Issuer: "zrok", + Subject: "intermediate_token", + ID: id, + }, + }) + s, err := t.SignedString(key) + if err != nil { + logrus.Errorf("Unable to sign intermediate JWT: %v", err) + } + return s + }, party, rp.WithURLParam("access_type", "offline"))(w, r) + } + } + + http.Handle("/google/login", authHandlerWithQueryState(relyingParty)) + getEmail := func(w http.ResponseWriter, r *http.Request, tokens *oidc.Tokens[*oidc.IDTokenClaims], state string, rp rp.RelyingParty) { + resp, err := http.Get("https://www.googleapis.com/oauth2/v2/userinfo?access_token=" + url.QueryEscape(tokens.AccessToken)) + if err != nil { + logrus.Error("Get: " + err.Error() + "\n") + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + defer resp.Body.Close() + response, err := io.ReadAll(resp.Body) + if err != nil { + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + rDat := googleOauthEmailResp{} + err = json.Unmarshal(response, &rDat) + if err != nil { + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + + SetZrokCookie(w, rDat.Email, tokens.AccessToken, "google", 3*time.Hour, key) + + token, err := jwt.ParseWithClaims(state, &IntermediateJWT{}, func(t *jwt.Token) (interface{}, error) { + return key, nil + }) + if err != nil { + http.Error(w, fmt.Sprintf("After intermediate token parse: %v", err.Error()), http.StatusInternalServerError) + return + } + http.Redirect(w, r, fmt.Sprintf("%s://%s.%s:8080", scheme, token.Claims.(*IntermediateJWT).Share, cfg.RedirectUrl), http.StatusFound) + } + + http.Handle(callbackPath, rp.CodeExchangeHandler(getEmail, relyingParty)) + return nil +} diff --git a/endpoints/publicProxy/http.go b/endpoints/publicProxy/http.go index 6fd6b977..2edf9b52 100644 --- a/endpoints/publicProxy/http.go +++ b/endpoints/publicProxy/http.go @@ -8,16 +8,20 @@ import ( "net/http/httputil" "net/url" "strings" + "time" + "github.com/golang-jwt/jwt/v5" "github.com/openziti/sdk-golang/ziti" "github.com/openziti/zrok/endpoints" "github.com/openziti/zrok/endpoints/publicProxy/healthUi" "github.com/openziti/zrok/endpoints/publicProxy/notFoundUi" + "github.com/openziti/zrok/endpoints/publicProxy/unauthorizedUi" "github.com/openziti/zrok/model" "github.com/openziti/zrok/util" "github.com/openziti/zrok/zrokdir" "github.com/pkg/errors" "github.com/sirupsen/logrus" + zhttp "github.com/zitadel/oidc/v2/pkg/http" ) type httpFrontend struct { @@ -49,7 +53,9 @@ func NewHTTP(cfg *Config) (*httpFrontend, error) { return nil, err } proxy.Transport = zTransport - + if err := configureOauthHandlers(context.Background(), cfg, false); err != nil { + return nil, err + } handler := authHandler(util.NewProxyHandler(proxy), "zrok", cfg, zCtx) return &httpFrontend{ cfg: cfg, @@ -125,9 +131,9 @@ func hostTargetReverseProxy(cfg *Config, ctx ziti.Context) *httputil.ReverseProx return &httputil.ReverseProxy{Director: director} } -func authHandler(handler http.Handler, realm string, cfg *Config, ctx ziti.Context) http.HandlerFunc { +func authHandler(handler http.Handler, realm string, pcfg *Config, ctx ziti.Context) http.HandlerFunc { return func(w http.ResponseWriter, r *http.Request) { - shrToken := resolveService(cfg.HostMatch, r.Host) + shrToken := resolveService(pcfg.HostMatch, r.Host) if shrToken != "" { if svc, found := endpoints.GetRefreshedService(shrToken, ctx); found { if cfg, found := svc.Config[model.ZrokProxyConfig]; found { @@ -183,17 +189,80 @@ func authHandler(handler http.Handler, realm string, cfg *Config, ctx ziti.Conte handler.ServeHTTP(w, r) case string(model.Oauth): - logrus.Debugf("auth scheme oauth '%v'", shrToken) - awsUrl := "https://oauth2/authorize" // COGNITO URL OR WHATEVER OAUTH PROVIDER URL - responseType := "code" - clientId := "" // PROVIDER CLIENT ID - scope := "email" - redirectUri := "http://localhost:18080/api/v1/oauth/authorize" - redirectUrl := fmt.Sprintf("%s?response_type=%s&client_id=%s&redirect_uri=%s&state=STATE&scope=%s", awsUrl, responseType, clientId, redirectUri, scope) - http.Redirect(w, r, redirectUrl, http.StatusFound) - handler.ServeHTTP(w, r) - return - + if oauthCfg, found := cfg["oauth"]; found { + if provider, found := oauthCfg.(map[string]interface{})["provider"]; found { + cookie, err := r.Cookie("zrok-access") + if err != nil { + logrus.Errorf("Unable to get access cookie: %v", err) + http.Redirect(w, r, fmt.Sprintf("http://%s.%s:28080/%s/login?share=%s", shrToken, pcfg.HostMatch, provider.(string), shrToken), http.StatusFound) + return + } + tkn, err := jwt.ParseWithClaims(cookie.Value, &ZrokClaims{}, func(t *jwt.Token) (interface{}, error) { + if pcfg.Oauth == nil { + return nil, fmt.Errorf("Missing oauth configuration for access point. Unable to parse jwt") + } + return pcfg.Oauth.HashKeyRaw, nil + }) + if err != nil { + logrus.Errorf("Unable to parse JWT: %v", err) + http.Redirect(w, r, fmt.Sprintf("http://%s.%s:28080/%s/login?share=%s", shrToken, pcfg.HostMatch, provider.(string), shrToken), http.StatusFound) + return + } + claims := tkn.Claims.(*ZrokClaims) + if claims.Provider != provider { + logrus.Error("Provider mismatch. Redoing auth flow") + http.Redirect(w, r, fmt.Sprintf("http://%s.%s:28080/%s/login?share=%s", shrToken, pcfg.HostMatch, provider.(string), shrToken), http.StatusFound) + return + } + var authCheckInterval time.Duration + if checkInterval, found := oauthCfg.(map[string]interface{})["authorization_check_interval"]; !found { + logrus.Errorf("Missing authorization check interval in share config. Defaulting to 3 hours") + authCheckInterval = 3 * time.Hour + } else { + i, err := time.ParseDuration(checkInterval.(string)) + if err != nil { + logrus.Errorf("unable to parse authorization check interval in share config (%v). Defaulting to 3 hours", checkInterval) + authCheckInterval = 3 * time.Hour + } else { + authCheckInterval = i + } + } + if claims.AuthorizationCheckInterval != authCheckInterval { + logrus.Error("Authorization check interval mismatch. Redoing auth flow") + http.Redirect(w, r, fmt.Sprintf("http://%s.%s:28080/%s/login?share=%s", shrToken, pcfg.HostMatch, provider.(string), shrToken), http.StatusFound) + return + } + if validDomains, found := oauthCfg.(map[string]interface{})["email_domains"]; found { + if castedDomains, ok := validDomains.([]interface{}); !ok { + logrus.Error("Invalid format for valid email domains") + return + } else { + if len(castedDomains) > 0 { + found := false + for _, domain := range castedDomains { + if strings.HasSuffix(claims.Email, domain.(string)) { + found = true + break + } + } + if !found { + logrus.Warnf("Email not a valid domain") + unauthorizedUi.WriteUnauthorized(w) + return + } + } + } + } + handler.ServeHTTP(w, r) + return + } else { + logrus.Warnf("%v -> no provider for '%v'", r.RemoteAddr, provider) + notFoundUi.WriteNotFound(w) + } + } else { + logrus.Warnf("%v -> no oauth cfg for '%v'", r.RemoteAddr, shrToken) + notFoundUi.WriteNotFound(w) + } default: logrus.Infof("invalid auth scheme '%v'", scheme) writeUnauthorizedResponse(w, realm) @@ -218,6 +287,53 @@ func authHandler(handler http.Handler, realm string, cfg *Config, ctx ziti.Conte } } +func configureOauthHandlers(ctx context.Context, cfg *Config, tls bool) error { + if cfg.Oauth == nil { + logrus.Info("No oauth config for access point. Skipping spin up.") + return nil + } + if err := configureGoogleOauth(cfg.Oauth, tls); err != nil { + return err + } + if err := configureGithubOauth(cfg.Oauth, tls); err != nil { + return err + } + zhttp.StartServer(ctx, "0.0.0.0:28080") + return nil +} + +type ZrokClaims struct { + Email string `json:"email"` + AccessToken string `json:"accessToken"` + Provider string `json:"provider"` + AuthorizationCheckInterval time.Duration `json:"authorizationCheckInterval"` + jwt.RegisteredClaims +} + +func SetZrokCookie(w http.ResponseWriter, email, accessToken, provider string, checkInterval time.Duration, key []byte) { + tkn := jwt.NewWithClaims(jwt.SigningMethodHS256, ZrokClaims{ + Email: email, + AccessToken: accessToken, + Provider: provider, + AuthorizationCheckInterval: checkInterval, + }) + sTkn, err := tkn.SignedString(key) + if err != nil { + http.Error(w, fmt.Sprintf("After signing cookie token: %v", err.Error()), http.StatusInternalServerError) + return + } + + http.SetCookie(w, &http.Cookie{ + Name: "zrok-access", + Value: sTkn, + MaxAge: 3000, + Domain: "localzrok.io", + Path: "/", + Expires: time.Now().Add(checkInterval), + //Secure: true, //When tls gets added have this be configured on if tls + }) +} + func writeUnauthorizedResponse(w http.ResponseWriter, realm string) { w.Header().Set("WWW-Authenticate", `Basic realm="`+realm+`"`) w.WriteHeader(401) diff --git a/endpoints/publicProxy/unauthorizedUi/embed.go b/endpoints/publicProxy/unauthorizedUi/embed.go new file mode 100644 index 00000000..c280963b --- /dev/null +++ b/endpoints/publicProxy/unauthorizedUi/embed.go @@ -0,0 +1,6 @@ +package unauthorizedUi + +import "embed" + +//go:embed index.html +var FS embed.FS diff --git a/endpoints/publicProxy/unauthorizedUi/handler.go b/endpoints/publicProxy/unauthorizedUi/handler.go new file mode 100644 index 00000000..e64e348b --- /dev/null +++ b/endpoints/publicProxy/unauthorizedUi/handler.go @@ -0,0 +1,21 @@ +package unauthorizedUi + +import ( + "github.com/sirupsen/logrus" + "net/http" +) + +func WriteUnauthorized(w http.ResponseWriter) { + if data, err := FS.ReadFile("index.html"); err == nil { + w.WriteHeader(http.StatusNotFound) + n, err := w.Write(data) + if n != len(data) { + logrus.Errorf("short write") + return + } + if err != nil { + logrus.Error(err) + return + } + } +} diff --git a/endpoints/publicProxy/unauthorizedUi/index.html b/endpoints/publicProxy/unauthorizedUi/index.html new file mode 100644 index 00000000..b2920124 --- /dev/null +++ b/endpoints/publicProxy/unauthorizedUi/index.html @@ -0,0 +1,400 @@ + + + + + + + + + + + zrok + + + +
+ +
+
+

Unauthorized

+
+
+
+ + diff --git a/etc/http-frontend.yml b/etc/http-frontend.yml index 3bd07f0b..0b735772 100644 --- a/etc/http-frontend.yml +++ b/etc/http-frontend.yml @@ -3,3 +3,19 @@ # purposes, and will allow `Host` headers that match the configured DNS name to be routed through `zrok`. # host_match: zrok.io + +#tls: +# cert_path: "/Path/To/Cert/zrok.crt" +# key_path: "/Path/To/Cert/zrok.key" + +#oauth: +# port: 28080 +# redirect_url: zrok.io +# hash_key_raw: "test1234test1234" +# providers: +# - name: google +# client_id: +# client_secret: +# - name: github +# client_id: +# client_secret: \ No newline at end of file diff --git a/go.mod b/go.mod index 6cc7277c..083a0d24 100644 --- a/go.mod +++ b/go.mod @@ -15,6 +15,7 @@ require ( github.com/go-openapi/strfmt v0.21.7 github.com/go-openapi/swag v0.22.4 github.com/go-openapi/validate v0.22.1 + github.com/google/uuid v1.3.0 github.com/gorilla/websocket v1.5.0 github.com/iancoleman/strcase v0.2.0 github.com/influxdata/influxdb-client-go/v2 v2.11.0 @@ -42,13 +43,17 @@ require ( github.com/spf13/cobra v1.7.0 github.com/stretchr/testify v1.8.4 github.com/wneessen/go-mail v0.2.7 - golang.org/x/crypto v0.10.0 - golang.org/x/net v0.11.0 + github.com/zitadel/oidc/v2 v2.7.0 + golang.org/x/crypto v0.11.0 + golang.org/x/net v0.12.0 + golang.org/x/oauth2 v0.10.0 golang.org/x/time v0.3.0 nhooyr.io/websocket v1.8.7 ) require ( + cloud.google.com/go/compute v1.20.1 // indirect + cloud.google.com/go/compute/metadata v0.2.3 // indirect github.com/Jeffail/gabs v1.4.0 // indirect github.com/antlr/antlr4/runtime/Go/antlr v0.0.0-20211106181442-e4c1a74c66bd // indirect github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect @@ -81,8 +86,11 @@ require ( github.com/go-openapi/jsonpointer v0.19.6 // indirect github.com/go-openapi/jsonreference v0.20.2 // indirect github.com/golang-jwt/jwt v3.2.2+incompatible // indirect - github.com/google/uuid v1.3.0 // indirect + github.com/golang-jwt/jwt/v5 v5.0.0 // indirect + github.com/golang/protobuf v1.5.3 // indirect github.com/gorilla/mux v1.8.0 // indirect + github.com/gorilla/schema v1.2.0 // indirect + github.com/gorilla/securecookie v1.1.1 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/influxdata/line-protocol v0.0.0-20200327222509-2487e7298839 // indirect github.com/josharian/intern v1.0.0 // indirect @@ -104,6 +112,7 @@ require ( github.com/muesli/ansi v0.0.0-20211018074035-2e021307bc4b // indirect github.com/muesli/cancelreader v0.2.2 // indirect github.com/muesli/termenv v0.13.0 // indirect + github.com/muhlemmer/gu v0.3.1 // indirect github.com/oklog/ulid v1.3.1 // indirect github.com/opentracing/opentracing-go v1.2.0 // indirect github.com/openziti/foundation/v2 v2.0.26 // indirect @@ -129,10 +138,12 @@ require ( go.opentelemetry.io/otel/metric v1.16.0 // indirect go.opentelemetry.io/otel/trace v1.16.0 // indirect golang.org/x/exp v0.0.0-20230425010034-47ecfdc1ba53 // indirect - golang.org/x/sys v0.9.0 // indirect - golang.org/x/term v0.9.0 // indirect - golang.org/x/text v0.10.0 // indirect - google.golang.org/protobuf v1.30.0 // indirect + golang.org/x/sys v0.10.0 // indirect + golang.org/x/term v0.10.0 // indirect + golang.org/x/text v0.11.0 // indirect + google.golang.org/appengine v1.6.7 // indirect + google.golang.org/protobuf v1.31.0 // indirect + gopkg.in/square/go-jose.v2 v2.6.0 // indirect gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/go.sum b/go.sum index 8096cff3..252203d0 100644 --- a/go.sum +++ b/go.sum @@ -24,6 +24,10 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg= cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc= cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ= +cloud.google.com/go/compute v1.20.1 h1:6aKEtlUiwEpJzM001l0yFkpXmUVXaN8W+fbkb2AZNbg= +cloud.google.com/go/compute v1.20.1/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM= +cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY= +cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA= cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE= cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk= cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk= @@ -251,6 +255,8 @@ github.com/godror/godror v0.24.2/go.mod h1:wZv/9vPiUib6tkoDl+AZ/QLf5YZgMravZ7jxH github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY= github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I= +github.com/golang-jwt/jwt/v5 v5.0.0 h1:1n1XNM9hk7O9mnQoNBGolZvzebBQ7p93ULHRc28XJUE= +github.com/golang-jwt/jwt/v5 v5.0.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk= github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= @@ -264,6 +270,7 @@ github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw= github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4= github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8= +github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs= github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= @@ -280,8 +287,9 @@ github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM= -github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw= github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg= +github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= github.com/golangci/lint-1 v0.0.0-20181222135242-d2cdd8c08219/go.mod h1:/X8TswGSh1pIozq4ZwCfxS0WA5JGXguxk94ar/4c87Y= github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= @@ -298,6 +306,7 @@ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/ github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= @@ -325,6 +334,10 @@ github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5m github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY= github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI= github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So= +github.com/gorilla/schema v1.2.0 h1:YufUaxZYCKGFuAq3c96BOhjgd5nmXiOY9NGzF247Tsc= +github.com/gorilla/schema v1.2.0/go.mod h1:kgLaKoK1FELgZqMAVxx/5cbj0kT+57qxUrAlIO2eleU= +github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ= +github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4= github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc= github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= @@ -367,6 +380,7 @@ github.com/jaevor/go-nanoid v1.3.0 h1:nD+iepesZS6pr3uOVf20vR9GdGgJW1HPaR46gtrxzk github.com/jaevor/go-nanoid v1.3.0/go.mod h1:SI+jFaPuddYkqkVQoNGHs81navCtH388TcrH0RqFKgY= github.com/jedib0t/go-pretty/v6 v6.4.3 h1:2n9BZ0YQiXGESUSR+6FLg0WWWE80u+mIz35f0uHWcIE= github.com/jedib0t/go-pretty/v6 v6.4.3/go.mod h1:MgmISkTWDSFu0xOqiZ0mKNntMQ2mDgOcwOkwBEkMDJI= +github.com/jeremija/gosubmit v0.2.7 h1:At0OhGCFGPXyjPYAsCchoBUhE099pcBXmsb4iZqROIc= github.com/jessevdk/go-flags v1.5.0 h1:1jKYvbxEjfUl0fmqTCOfonvskHHXMjBySTLW4y9LFvc= github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4= github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo= @@ -508,6 +522,8 @@ github.com/muesli/termenv v0.11.1-0.20220204035834-5ac8409525e0/go.mod h1:Bd5NYQ github.com/muesli/termenv v0.11.1-0.20220212125758-44cd13922739/go.mod h1:Bd5NYQ7pd+SrtBSrSNoBBmXlcY8+Xj4BMJgh8qcZrvs= github.com/muesli/termenv v0.13.0 h1:wK20DRpJdDX8b7Ek2QfhvqhRQFZ237RGRO0RQ/Iqdy0= github.com/muesli/termenv v0.13.0/go.mod h1:sP1+uffeLaEYpyOTb8pLCUctGcGLnoFjSn4YJK5e2bc= +github.com/muhlemmer/gu v0.3.1 h1:7EAqmFrW7n3hETvuAdmFmn4hS8W+z3LgKtrnow+YzNM= +github.com/muhlemmer/gu v0.3.1/go.mod h1:YHtHR+gxM+bKEIIs7Hmi9sPT3ZDUvTN/i88wQpZkrdM= github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A= github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE= @@ -583,6 +599,7 @@ github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFR github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE= github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8= github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= +github.com/rs/cors v1.9.0 h1:l9HGsTsHJcvW14Nk7J9KFz8bzeAWXn3CG6bgt7LsrAE= github.com/rubenv/sql-migrate v1.1.2 h1:9M6oj4e//owVVHYrFISmY9LBRw6gzkCNmD9MV36tZeQ= github.com/rubenv/sql-migrate v1.1.2/go.mod h1:/7TZymwxN8VWumcIxw1jjHEcR1djpdkMHQPT4FWdnbQ= github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= @@ -666,6 +683,8 @@ github.com/yuin/goldmark v1.4.0/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw= github.com/yusufpapurcu/wmi v1.2.3/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0= +github.com/zitadel/oidc/v2 v2.7.0 h1:IGX4EDk6tegTjUSsZDWeTfLseFU0BdJ/Glf1tgys2lU= +github.com/zitadel/oidc/v2 v2.7.0/go.mod h1:zkUkVJS0sDVy9m0UA9RgO3f8i/C0rtjvXU36UJj7T+0= github.com/ziutek/mymysql v1.5.4 h1:GB0qdRGsTwQSBVYuVShFBKaXSnSnYYC2d9knnE1LHFs= github.com/ziutek/mymysql v1.5.4/go.mod h1:LMSpPZ6DbqWFxNCHW77HeMg9I646SAhApZ/wKdgO/C0= go.etcd.io/bbolt v1.3.7 h1:j+zJOnnEjF/kyHlDDgGnVL/AIqIJPq8UoB2GSNfkUfQ= @@ -715,8 +734,8 @@ golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWP golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw= -golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM= -golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I= +golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA= +golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -799,8 +818,8 @@ golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qx golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco= -golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU= -golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ= +golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50= +golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -813,6 +832,8 @@ golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= +golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8= +golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -900,14 +921,14 @@ golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s= -golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA= +golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28= -golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo= +golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c= +golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -918,8 +939,8 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58= -golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= +golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4= +golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -1017,6 +1038,7 @@ google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7 google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0= google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= +google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= @@ -1091,8 +1113,8 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= -google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng= -google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= +google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8= +google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= @@ -1103,6 +1125,8 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EV gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI= gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/ini.v1 v1.62.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= +gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI= +gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= diff --git a/rest_client_zrok/share/oauth_authenticate_parameters.go b/rest_client_zrok/share/oauth_authenticate_parameters.go index 284d9007..cc305f14 100644 --- a/rest_client_zrok/share/oauth_authenticate_parameters.go +++ b/rest_client_zrok/share/oauth_authenticate_parameters.go @@ -65,7 +65,7 @@ type OauthAuthenticateParams struct { Code string // State. - State string + State *string timeout time.Duration Context context.Context @@ -132,13 +132,13 @@ func (o *OauthAuthenticateParams) SetCode(code string) { } // WithState adds the state to the oauth authenticate params -func (o *OauthAuthenticateParams) WithState(state string) *OauthAuthenticateParams { +func (o *OauthAuthenticateParams) WithState(state *string) *OauthAuthenticateParams { o.SetState(state) return o } // SetState adds the state to the oauth authenticate params -func (o *OauthAuthenticateParams) SetState(state string) { +func (o *OauthAuthenticateParams) SetState(state *string) { o.State = state } @@ -160,13 +160,20 @@ func (o *OauthAuthenticateParams) WriteToRequest(r runtime.ClientRequest, reg st } } - // query param state - qrState := o.State - qState := qrState - if qState != "" { + if o.State != nil { - if err := r.SetQueryParam("state", qState); err != nil { - return err + // query param state + var qrState string + + if o.State != nil { + qrState = *o.State + } + qState := qrState + if qState != "" { + + if err := r.SetQueryParam("state", qState); err != nil { + return err + } } } diff --git a/rest_client_zrok/share/oauth_authenticate_responses.go b/rest_client_zrok/share/oauth_authenticate_responses.go index 88e8f210..c4457878 100644 --- a/rest_client_zrok/share/oauth_authenticate_responses.go +++ b/rest_client_zrok/share/oauth_authenticate_responses.go @@ -26,6 +26,12 @@ func (o *OauthAuthenticateReader) ReadResponse(response runtime.ClientResponse, return nil, err } return result, nil + case 302: + result := NewOauthAuthenticateFound() + if err := result.readResponse(response, consumer, o.formats); err != nil { + return nil, err + } + return nil, result case 500: result := NewOauthAuthenticateInternalServerError() if err := result.readResponse(response, consumer, o.formats); err != nil { @@ -88,6 +94,68 @@ func (o *OauthAuthenticateOK) readResponse(response runtime.ClientResponse, cons return nil } +// NewOauthAuthenticateFound creates a OauthAuthenticateFound with default headers values +func NewOauthAuthenticateFound() *OauthAuthenticateFound { + return &OauthAuthenticateFound{} +} + +/* +OauthAuthenticateFound describes a response with status code 302, with default header values. + +redirect back to share +*/ +type OauthAuthenticateFound struct { + + /* Redirect URL + */ + Location string +} + +// IsSuccess returns true when this oauth authenticate found response has a 2xx status code +func (o *OauthAuthenticateFound) IsSuccess() bool { + return false +} + +// IsRedirect returns true when this oauth authenticate found response has a 3xx status code +func (o *OauthAuthenticateFound) IsRedirect() bool { + return true +} + +// IsClientError returns true when this oauth authenticate found response has a 4xx status code +func (o *OauthAuthenticateFound) IsClientError() bool { + return false +} + +// IsServerError returns true when this oauth authenticate found response has a 5xx status code +func (o *OauthAuthenticateFound) IsServerError() bool { + return false +} + +// IsCode returns true when this oauth authenticate found response a status code equal to that given +func (o *OauthAuthenticateFound) IsCode(code int) bool { + return code == 302 +} + +func (o *OauthAuthenticateFound) Error() string { + return fmt.Sprintf("[GET /oauth/authorize][%d] oauthAuthenticateFound ", 302) +} + +func (o *OauthAuthenticateFound) String() string { + return fmt.Sprintf("[GET /oauth/authorize][%d] oauthAuthenticateFound ", 302) +} + +func (o *OauthAuthenticateFound) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error { + + // hydrates response header location + hdrLocation := response.GetHeader("location") + + if hdrLocation != "" { + o.Location = hdrLocation + } + + return nil +} + // NewOauthAuthenticateInternalServerError creates a OauthAuthenticateInternalServerError with default headers values func NewOauthAuthenticateInternalServerError() *OauthAuthenticateInternalServerError { return &OauthAuthenticateInternalServerError{} diff --git a/rest_model_zrok/share_request.go b/rest_model_zrok/share_request.go index d935697d..0a5d34b0 100644 --- a/rest_model_zrok/share_request.go +++ b/rest_model_zrok/share_request.go @@ -40,11 +40,14 @@ type ShareRequest struct { // frontend selection FrontendSelection []string `json:"frontendSelection"` + // oauth authorization check interval + OauthAuthorizationCheckInterval string `json:"oauthAuthorizationCheckInterval,omitempty"` + // oauth email domains OauthEmailDomains []string `json:"oauthEmailDomains"` // oauth provider - // Enum: [amazon] + // Enum: [github google] OauthProvider string `json:"oauthProvider,omitempty"` // reserved @@ -159,7 +162,7 @@ var shareRequestTypeOauthProviderPropEnum []interface{} func init() { var res []string - if err := json.Unmarshal([]byte(`["amazon"]`), &res); err != nil { + if err := json.Unmarshal([]byte(`["github","google"]`), &res); err != nil { panic(err) } for _, v := range res { @@ -169,8 +172,11 @@ func init() { const ( - // ShareRequestOauthProviderAmazon captures enum value "amazon" - ShareRequestOauthProviderAmazon string = "amazon" + // ShareRequestOauthProviderGithub captures enum value "github" + ShareRequestOauthProviderGithub string = "github" + + // ShareRequestOauthProviderGoogle captures enum value "google" + ShareRequestOauthProviderGoogle string = "google" ) // prop value enum diff --git a/rest_server_zrok/embedded_spec.go b/rest_server_zrok/embedded_spec.go index cad94033..8dc6b898 100644 --- a/rest_server_zrok/embedded_spec.go +++ b/rest_server_zrok/embedded_spec.go @@ -712,8 +712,7 @@ func init() { { "type": "string", "name": "state", - "in": "query", - "required": true + "in": "query" }, { "type": "string", @@ -726,6 +725,15 @@ func init() { "200": { "description": "testing" }, + "302": { + "description": "redirect back to share", + "headers": { + "location": { + "type": "string", + "description": "Redirect URL" + } + } + }, "500": { "description": "internal server error" } @@ -1516,6 +1524,9 @@ func init() { "type": "string" } }, + "oauthAuthorizationCheckInterval": { + "type": "string" + }, "oauthEmailDomains": { "type": "array", "items": { @@ -1525,7 +1536,8 @@ func init() { "oauthProvider": { "type": "string", "enum": [ - "amazon" + "github", + "google" ] }, "reserved": { @@ -2353,8 +2365,7 @@ func init() { { "type": "string", "name": "state", - "in": "query", - "required": true + "in": "query" }, { "type": "string", @@ -2367,6 +2378,15 @@ func init() { "200": { "description": "testing" }, + "302": { + "description": "redirect back to share", + "headers": { + "location": { + "type": "string", + "description": "Redirect URL" + } + } + }, "500": { "description": "internal server error" } @@ -3157,6 +3177,9 @@ func init() { "type": "string" } }, + "oauthAuthorizationCheckInterval": { + "type": "string" + }, "oauthEmailDomains": { "type": "array", "items": { @@ -3166,7 +3189,8 @@ func init() { "oauthProvider": { "type": "string", "enum": [ - "amazon" + "github", + "google" ] }, "reserved": { diff --git a/rest_server_zrok/operations/share/oauth_authenticate_parameters.go b/rest_server_zrok/operations/share/oauth_authenticate_parameters.go index ff9bb2b5..e7fe0e18 100644 --- a/rest_server_zrok/operations/share/oauth_authenticate_parameters.go +++ b/rest_server_zrok/operations/share/oauth_authenticate_parameters.go @@ -38,10 +38,9 @@ type OauthAuthenticateParams struct { */ Code string /* - Required: true In: query */ - State string + State *string } // BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface @@ -93,21 +92,18 @@ func (o *OauthAuthenticateParams) bindCode(rawData []string, hasKey bool, format // bindState binds and validates parameter State from query. func (o *OauthAuthenticateParams) bindState(rawData []string, hasKey bool, formats strfmt.Registry) error { - if !hasKey { - return errors.Required("state", "query", rawData) - } var raw string if len(rawData) > 0 { raw = rawData[len(rawData)-1] } - // Required: true + // Required: false // AllowEmptyValue: false - if err := validate.RequiredString("state", "query", raw); err != nil { - return err + if raw == "" { // empty values pass all other validations + return nil } - o.State = raw + o.State = &raw return nil } diff --git a/rest_server_zrok/operations/share/oauth_authenticate_responses.go b/rest_server_zrok/operations/share/oauth_authenticate_responses.go index 027f4df0..7965c0b0 100644 --- a/rest_server_zrok/operations/share/oauth_authenticate_responses.go +++ b/rest_server_zrok/operations/share/oauth_authenticate_responses.go @@ -36,6 +36,53 @@ func (o *OauthAuthenticateOK) WriteResponse(rw http.ResponseWriter, producer run rw.WriteHeader(200) } +// OauthAuthenticateFoundCode is the HTTP code returned for type OauthAuthenticateFound +const OauthAuthenticateFoundCode int = 302 + +/* +OauthAuthenticateFound redirect back to share + +swagger:response oauthAuthenticateFound +*/ +type OauthAuthenticateFound struct { + /*Redirect URL + + */ + Location string `json:"location"` +} + +// NewOauthAuthenticateFound creates OauthAuthenticateFound with default headers values +func NewOauthAuthenticateFound() *OauthAuthenticateFound { + + return &OauthAuthenticateFound{} +} + +// WithLocation adds the location to the oauth authenticate found response +func (o *OauthAuthenticateFound) WithLocation(location string) *OauthAuthenticateFound { + o.Location = location + return o +} + +// SetLocation sets the location to the oauth authenticate found response +func (o *OauthAuthenticateFound) SetLocation(location string) { + o.Location = location +} + +// WriteResponse to the client +func (o *OauthAuthenticateFound) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) { + + // response header location + + location := o.Location + if location != "" { + rw.Header().Set("location", location) + } + + rw.Header().Del(runtime.HeaderContentType) //Remove Content-Type on empty responses + + rw.WriteHeader(302) +} + // OauthAuthenticateInternalServerErrorCode is the HTTP code returned for type OauthAuthenticateInternalServerError const OauthAuthenticateInternalServerErrorCode int = 500 diff --git a/rest_server_zrok/operations/share/oauth_authenticate_urlbuilder.go b/rest_server_zrok/operations/share/oauth_authenticate_urlbuilder.go index 0bb5335b..505fdba6 100644 --- a/rest_server_zrok/operations/share/oauth_authenticate_urlbuilder.go +++ b/rest_server_zrok/operations/share/oauth_authenticate_urlbuilder.go @@ -14,7 +14,7 @@ import ( // OauthAuthenticateURL generates an URL for the oauth authenticate operation type OauthAuthenticateURL struct { Code string - State string + State *string _basePath string // avoid unkeyed usage @@ -55,7 +55,10 @@ func (o *OauthAuthenticateURL) Build() (*url.URL, error) { qs.Set("code", codeQ) } - stateQ := o.State + var stateQ string + if o.State != nil { + stateQ = *o.State + } if stateQ != "" { qs.Set("state", stateQ) } diff --git a/specs/zrok.yml b/specs/zrok.yml index 757a31d3..a819926f 100644 --- a/specs/zrok.yml +++ b/specs/zrok.yml @@ -556,27 +556,6 @@ paths: 500: description: internal server error - /oauth/authorize: - get: - tags: - - share - operationId: oauthAuthenticate - parameters: - - name: state - in: query - type: string - required: true - - name: code - in: query - type: string - required: true - responses: - 200: - description: testing - 500: - description: internal server error - - /share: post: tags: @@ -1003,11 +982,14 @@ definitions: $ref: "#/definitions/authUser" oauthProvider: type: string - enum: [amazon,google] + enum: [github,google] oauthEmailDomains: type: array items: type: string + oauthAuthorizationCheckInterval: + type: string + reserved: type: boolean diff --git a/ui/src/api/share.js b/ui/src/api/share.js index 021355ef..7293eb23 100644 --- a/ui/src/api/share.js +++ b/ui/src/api/share.js @@ -18,14 +18,16 @@ export function access(options) { } /** - * @param {string} state * @param {string} code + * @param {object} options Optional options + * @param {string} [options.state] * @return {Promise} testing */ -export function oauthAuthenticate(state, code) { +export function oauthAuthenticate(code, options) { + if (!options) options = {} const parameters = { query: { - state, + state: options.state, code } } diff --git a/ui/src/api/types.js b/ui/src/api/types.js index d3276391..5f06119b 100644 --- a/ui/src/api/types.js +++ b/ui/src/api/types.js @@ -255,6 +255,7 @@ * @property {module:types.authUser[]} authUsers * @property {string} oauthProvider * @property {string[]} oauthEmailDomains + * @property {string} oauthAuthorizationCheckInterval * @property {boolean} reserved */