From 616b31c95961ebdd0fb66f78427119f02bb04caf Mon Sep 17 00:00:00 2001 From: Livio Amstutz Date: Wed, 18 May 2022 10:49:16 +0200 Subject: [PATCH] fix: token check and error unwrapping (#3648) * fix: token check and error unwrapping * remove unused code --- internal/api/authz/token.go | 33 +------------------ .../eventstore/token_verifier.go | 2 +- internal/errors/already_exists.go | 4 +++ internal/errors/deadline_exceeded.go | 4 +++ internal/errors/internal.go | 4 +++ internal/errors/invalid_argument.go | 4 +++ internal/errors/not_found.go | 4 +++ internal/errors/permission_denied.go | 4 +++ internal/errors/precondition_failed.go | 4 +++ internal/errors/unauthenticated.go | 4 +++ internal/errors/unavailable.go | 4 +++ internal/errors/unimplemented.go | 4 +++ internal/errors/unknown.go | 4 +++ 13 files changed, 46 insertions(+), 33 deletions(-) diff --git a/internal/api/authz/token.go b/internal/api/authz/token.go index eae35b52e..fc2694c02 100644 --- a/internal/api/authz/token.go +++ b/internal/api/authz/token.go @@ -32,11 +32,7 @@ func Start(authZRepo authZRepo) (v *TokenVerifier) { } func (v *TokenVerifier) VerifyAccessToken(ctx context.Context, token string, method string) (userID, clientID, agentID, prefLang, resourceOwner string, err error) { - verifierClientID, projectID, err := v.clientIDAndProjectIDFromMethod(ctx, method) - if err != nil { - return "", "", "", "", "", err - } - userID, agentID, clientID, prefLang, resourceOwner, err = v.authZRepo.VerifyAccessToken(ctx, token, verifierClientID, projectID) + userID, agentID, clientID, prefLang, resourceOwner, err = v.authZRepo.VerifyAccessToken(ctx, token, "", GetInstance(ctx).ProjectID()) return userID, clientID, agentID, prefLang, resourceOwner, err } @@ -56,33 +52,6 @@ func (v *TokenVerifier) RegisterServer(appName, methodPrefix string, mappings Me } } -func prefixFromMethod(method string) (string, bool) { - parts := strings.Split(method, "/") - if len(parts) < 2 { - return "", false - } - return parts[1], true -} - -func (v *TokenVerifier) clientIDAndProjectIDFromMethod(ctx context.Context, method string) (clientID, projectID string, err error) { - ctx, span := tracing.NewSpan(ctx) - defer func() { span.EndWithError(err) }() - - prefix, ok := prefixFromMethod(method) - if !ok { - return "", "", caos_errs.ThrowPermissionDenied(nil, "AUTHZ-GRD2Q", "Errors.Internal") - } - app, ok := v.clients.Load(prefix) - if !ok { - return "", "", caos_errs.ThrowPermissionDenied(nil, "AUTHZ-G2qrh", "Errors.Internal") - } - c := app.(*client) - c.id, c.projectID, err = v.authZRepo.VerifierClientID(ctx, c.name) - if err != nil { - return "", "", caos_errs.ThrowPermissionDenied(err, "AUTHZ-ptTIF2", "Errors.Internal") - } - return c.id, c.projectID, nil -} func (v *TokenVerifier) SearchMyMemberships(ctx context.Context) (_ []*Membership, err error) { ctx, span := tracing.NewSpan(ctx) defer func() { span.EndWithError(err) }() diff --git a/internal/authz/repository/eventsourcing/eventstore/token_verifier.go b/internal/authz/repository/eventsourcing/eventstore/token_verifier.go index 60a50b6ed..848f20a28 100644 --- a/internal/authz/repository/eventsourcing/eventstore/token_verifier.go +++ b/internal/authz/repository/eventsourcing/eventstore/token_verifier.go @@ -89,7 +89,7 @@ func (repo *TokenVerifierRepo) VerifyAccessToken(ctx context.Context, tokenStrin return token.UserID, "", "", "", token.ResourceOwner, nil } for _, aud := range token.Audience { - if verifierClientID == aud || projectID == aud || authz.GetInstance(ctx).ProjectID() == aud { + if verifierClientID == aud || projectID == aud { return token.UserID, token.UserAgentID, token.ApplicationID, token.PreferredLanguage, token.ResourceOwner, nil } } diff --git a/internal/errors/already_exists.go b/internal/errors/already_exists.go index 10ea010ec..83f95a2be 100644 --- a/internal/errors/already_exists.go +++ b/internal/errors/already_exists.go @@ -38,3 +38,7 @@ func IsErrorAlreadyExists(err error) bool { _, ok := err.(AlreadyExists) return ok } + +func (err *AlreadyExistsError) Unwrap() error { + return err.CaosError +} diff --git a/internal/errors/deadline_exceeded.go b/internal/errors/deadline_exceeded.go index fdfc7901a..9efe842c7 100644 --- a/internal/errors/deadline_exceeded.go +++ b/internal/errors/deadline_exceeded.go @@ -40,3 +40,7 @@ func (err *DeadlineExceededError) Is(target error) bool { } return err.CaosError.Is(t.CaosError) } + +func (err *DeadlineExceededError) Unwrap() error { + return err.CaosError +} diff --git a/internal/errors/internal.go b/internal/errors/internal.go index ab42f9e09..0b0a4272a 100644 --- a/internal/errors/internal.go +++ b/internal/errors/internal.go @@ -40,3 +40,7 @@ func (err *InternalError) Is(target error) bool { } return err.CaosError.Is(t.CaosError) } + +func (err *InternalError) Unwrap() error { + return err.CaosError +} diff --git a/internal/errors/invalid_argument.go b/internal/errors/invalid_argument.go index 31cddeeaf..431885dca 100644 --- a/internal/errors/invalid_argument.go +++ b/internal/errors/invalid_argument.go @@ -38,3 +38,7 @@ func (err *InvalidArgumentError) Is(target error) bool { } return err.CaosError.Is(t.CaosError) } + +func (err *InvalidArgumentError) Unwrap() error { + return err.CaosError +} diff --git a/internal/errors/not_found.go b/internal/errors/not_found.go index fed445127..c53edeeee 100644 --- a/internal/errors/not_found.go +++ b/internal/errors/not_found.go @@ -33,3 +33,7 @@ func (err *NotFoundError) Is(target error) bool { } return err.CaosError.Is(t.CaosError) } + +func (err *NotFoundError) Unwrap() error { + return err.CaosError +} diff --git a/internal/errors/permission_denied.go b/internal/errors/permission_denied.go index d12e04fbe..466530884 100644 --- a/internal/errors/permission_denied.go +++ b/internal/errors/permission_denied.go @@ -40,3 +40,7 @@ func (err *PermissionDeniedError) Is(target error) bool { } return err.CaosError.Is(t.CaosError) } + +func (err *PermissionDeniedError) Unwrap() error { + return err.CaosError +} diff --git a/internal/errors/precondition_failed.go b/internal/errors/precondition_failed.go index 999555996..2deee47aa 100644 --- a/internal/errors/precondition_failed.go +++ b/internal/errors/precondition_failed.go @@ -40,3 +40,7 @@ func (err *PreconditionFailedError) Is(target error) bool { } return err.CaosError.Is(t.CaosError) } + +func (err *PreconditionFailedError) Unwrap() error { + return err.CaosError +} diff --git a/internal/errors/unauthenticated.go b/internal/errors/unauthenticated.go index dcb28075a..29237657e 100644 --- a/internal/errors/unauthenticated.go +++ b/internal/errors/unauthenticated.go @@ -40,3 +40,7 @@ func (err *UnauthenticatedError) Is(target error) bool { } return err.CaosError.Is(t.CaosError) } + +func (err *UnauthenticatedError) Unwrap() error { + return err.CaosError +} diff --git a/internal/errors/unavailable.go b/internal/errors/unavailable.go index e6c34e692..b4b30ab7f 100644 --- a/internal/errors/unavailable.go +++ b/internal/errors/unavailable.go @@ -40,3 +40,7 @@ func (err *UnavailableError) Is(target error) bool { } return err.CaosError.Is(t.CaosError) } + +func (err *UnavailableError) Unwrap() error { + return err.CaosError +} diff --git a/internal/errors/unimplemented.go b/internal/errors/unimplemented.go index 71b4cd80b..1d0b77ed2 100644 --- a/internal/errors/unimplemented.go +++ b/internal/errors/unimplemented.go @@ -40,3 +40,7 @@ func (err *UnimplementedError) Is(target error) bool { } return err.CaosError.Is(t.CaosError) } + +func (err *UnimplementedError) Unwrap() error { + return err.CaosError +} diff --git a/internal/errors/unknown.go b/internal/errors/unknown.go index 9e48385f5..78eda816a 100644 --- a/internal/errors/unknown.go +++ b/internal/errors/unknown.go @@ -40,3 +40,7 @@ func (err *UnknownError) Is(target error) bool { } return err.CaosError.Is(t.CaosError) } + +func (err *UnknownError) Unwrap() error { + return err.CaosError +}