CloudMigration: Create authapi service (#96581)

2025-08-02 09:42:13 +08:00 · 2024-11-21 15:46:06 -03:00
parent c8bc1f8637
commit e9fae5bd7f
17 changed files with 837 additions and 452 deletions
--- a/pkg/services/authapi/authapi.go
+++ b/pkg/services/authapi/authapi.go
@ -0,0 +1,398 @@
+// Package authapi contains the connector for Grafana internal auth service. This can be used instead of the GCOM service
+// to create access policies and access tokens
+package authapi
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/grafana/grafana/pkg/infra/log"
+)
+
+const LogPrefix = "auth-api.service"
+
+var ErrTokenNotFound = errors.New("auth-api: token not found")
+
+type Service interface {
+	CreateAccessPolicy(ctx context.Context, params CreateAccessPolicyParams, payload CreateAccessPolicyPayload) (AccessPolicy, error)
+	ListAccessPolicies(ctx context.Context, params ListAccessPoliciesParams) ([]AccessPolicy, error)
+	DeleteAccessPolicy(ctx context.Context, params DeleteAccessPolicyParams) (bool, error)
+	ListTokens(ctx context.Context, params ListTokenParams) ([]TokenView, error)
+	CreateToken(ctx context.Context, params CreateTokenParams, payload CreateTokenPayload) (Token, error)
+	DeleteToken(ctx context.Context, params DeleteTokenParams) error
+}
+
+type CreateAccessPolicyParams struct {
+	RequestID string
+	// this is needed until we fully migrate from gcom to authapi
+	Region string
+}
+
+type CreateAccessPolicyPayload struct {
+	Name        string   `json:"name"`
+	DisplayName string   `json:"displayName"`
+	Realms      []Realm  `json:"realms"`
+	Scopes      []string `json:"scopes"`
+}
+
+type Realm struct {
+	Identifier    string        `json:"identifier"`
+	LabelPolicies []LabelPolicy `json:"labelPolicies"`
+	Type          string        `json:"type"`
+}
+
+type LabelPolicy struct {
+	Selector string `json:"selector"`
+}
+
+type createAccessPolicyResponse struct {
+	Data AccessPolicy `json:"data"`
+}
+
+type AccessPolicy struct {
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+type ListAccessPoliciesParams struct {
+	RequestID string
+	Name      string
+	// this is needed until we fully migrate from gcom to authapi
+	Region string
+}
+
+type listAccessPoliciesResponse struct {
+	Data []AccessPolicy `json:"data"`
+}
+
+type DeleteAccessPolicyParams struct {
+	RequestID      string
+	AccessPolicyID string
+	// this is needed until we fully migrate from gcom to authapi
+	Region string
+}
+
+type ListTokenParams struct {
+	RequestID        string
+	AccessPolicyName string
+	TokenName        string
+	// this is needed until we fully migrate from gcom to authapi
+	Region string
+}
+
+type CreateTokenParams struct {
+	RequestID string
+	// this is needed until we fully migrate from gcom to authapi
+	Region string
+}
+
+type CreateTokenPayload struct {
+	AccessPolicyID string    `json:"accessPolicyId"`
+	DisplayName    string    `json:"displayName"`
+	Name           string    `json:"name"`
+	ExpiresAt      time.Time `json:"expiresAt"`
+}
+
+type createTokenResponse struct {
+	Data Token `json:"data"`
+}
+
+// Token returned by authapi api when a token gets created.
+type Token struct {
+	ID             string `json:"id"`
+	AccessPolicyID string `json:"accessPolicyId"`
+	Name           string `json:"name"`
+	Token          string `json:"token"`
+}
+
+type DeleteTokenParams struct {
+	RequestID string
+	TokenID   string
+	// this is needed until we fully migrate from gcom to authapi
+	Region string
+}
+
+// TokenView returned by authapi api for a GET token request.
+type TokenView struct {
+	ID             string `json:"id"`
+	AccessPolicyID string `json:"accessPolicyId"`
+	Name           string `json:"name"`
+	DisplayName    string `json:"displayName"`
+	ExpiresAt      string `json:"expiresAt"`
+	FirstUsedAt    string `json:"firstUsedAt"`
+	LastUsedAt     string `json:"lastUsedAt"`
+	CreatedAt      string `json:"createdAt"`
+}
+
+type listTokensResponse struct {
+	Data []TokenView `json:"data"`
+}
+
+var _ Service = (*AuthApiClient)(nil)
+
+type AuthApiClient struct {
+	log        log.Logger
+	cfg        Config
+	httpClient *http.Client
+}
+
+type Config struct {
+	ApiURL string
+	Token  string
+}
+
+func New(cfg Config, httpClient *http.Client) Service {
+	return &AuthApiClient{
+		log:        log.New(LogPrefix),
+		cfg:        cfg,
+		httpClient: httpClient,
+	}
+}
+
+func (client *AuthApiClient) CreateAccessPolicy(ctx context.Context, params CreateAccessPolicyParams, payload CreateAccessPolicyPayload) (AccessPolicy, error) {
+	endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies")
+	if err != nil {
+		return AccessPolicy{}, fmt.Errorf("building authapi access policy url: %w", err)
+	}
+
+	body, err := json.Marshal(&payload)
+	if err != nil {
+		return AccessPolicy{}, fmt.Errorf("marshaling request body: %w", err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return AccessPolicy{}, fmt.Errorf("creating http request: %w", err)
+	}
+
+	request.Header.Set("x-request-id", params.RequestID)
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token))
+
+	response, err := client.httpClient.Do(request)
+	if err != nil {
+		return AccessPolicy{}, fmt.Errorf("sending http request to create access policy: %w", err)
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			client.log.Error("closing http response body", "err", err.Error())
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(response.Body)
+		return AccessPolicy{}, fmt.Errorf("unexpected response when creating access policy: code=%d body=%s", response.StatusCode, body)
+	}
+
+	var capResp createAccessPolicyResponse
+	if err := json.NewDecoder(response.Body).Decode(&capResp); err != nil {
+		return AccessPolicy{}, fmt.Errorf("unmarshaling response body: %w", err)
+	}
+
+	return capResp.Data, nil
+}
+
+func (client *AuthApiClient) DeleteAccessPolicy(ctx context.Context, params DeleteAccessPolicyParams) (bool, error) {
+	endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies/", params.AccessPolicyID)
+	if err != nil {
+		return false, fmt.Errorf("building authapi access policy url: %w", err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodDelete, endpoint, nil)
+	if err != nil {
+		return false, fmt.Errorf("creating http request: %w", err)
+	}
+
+	request.Header.Set("x-request-id", params.RequestID)
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token))
+
+	response, err := client.httpClient.Do(request)
+	if err != nil {
+		return false, fmt.Errorf("sending http request to create access policy: %w", err)
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			client.log.Error("closing http response body", "err", err.Error())
+		}
+	}()
+
+	if response.StatusCode == http.StatusNotFound {
+		return false, nil
+	}
+
+	if response.StatusCode == http.StatusOK || response.StatusCode == http.StatusNoContent {
+		return true, nil
+	}
+
+	body, _ := io.ReadAll(response.Body)
+	return false, fmt.Errorf("unexpected response when deleting access policy: code=%d body=%s", response.StatusCode, body)
+}
+
+func (client *AuthApiClient) ListAccessPolicies(ctx context.Context, params ListAccessPoliciesParams) ([]AccessPolicy, error) {
+	endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies")
+	if err != nil {
+		return nil, fmt.Errorf("building authapi access policy url: %w", err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, fmt.Errorf("creating http request: %w", err)
+	}
+
+	query := url.Values{}
+	query.Set("name", params.Name)
+	request.URL.RawQuery = query.Encode()
+	request.Header.Set("x-request-id", params.RequestID)
+	request.Header.Set("Accept", "application/json")
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token))
+
+	response, err := client.httpClient.Do(request)
+	if err != nil {
+		return nil, fmt.Errorf("sending http request to create access policy: %w", err)
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			client.log.Error("closing http response body", "err", err.Error())
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(response.Body)
+		return nil, fmt.Errorf("unexpected response when listing access policies: code=%d body=%s", response.StatusCode, body)
+	}
+
+	var lapResp listAccessPoliciesResponse
+	if err := json.NewDecoder(response.Body).Decode(&lapResp); err != nil {
+		return lapResp.Data, fmt.Errorf("unmarshaling response body: %w", err)
+	}
+	return lapResp.Data, nil
+}
+
+func (client *AuthApiClient) ListTokens(ctx context.Context, params ListTokenParams) ([]TokenView, error) {
+	endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens")
+	if err != nil {
+		return nil, fmt.Errorf("building authapi tokens url: %w", err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, fmt.Errorf("creating http request: %w", err)
+	}
+
+	query := url.Values{}
+	query.Set("accessPolicyName", params.AccessPolicyName)
+	query.Set("name", params.TokenName)
+
+	request.URL.RawQuery = query.Encode()
+	request.Header.Set("x-request-id", params.RequestID)
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token))
+
+	response, err := client.httpClient.Do(request)
+	if err != nil {
+		return nil, fmt.Errorf("sending http request to list access tokens: %w", err)
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			client.log.Error("closing http response body", "err", err.Error())
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(response.Body)
+		return nil, fmt.Errorf("unexpected response when fetching access tokens: code=%d body=%s", response.StatusCode, body)
+	}
+
+	var body listTokensResponse
+	if err := json.NewDecoder(response.Body).Decode(&body); err != nil {
+		return nil, fmt.Errorf("unmarshaling response body: %w", err)
+	}
+	return body.Data, nil
+}
+
+func (client *AuthApiClient) CreateToken(ctx context.Context, params CreateTokenParams, payload CreateTokenPayload) (Token, error) {
+	endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens")
+	if err != nil {
+		return Token{}, fmt.Errorf("building authapi tokens url: %w", err)
+	}
+
+	body, err := json.Marshal(&payload)
+	if err != nil {
+		return Token{}, fmt.Errorf("marshaling request body: %w", err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return Token{}, fmt.Errorf("creating http request: %w", err)
+	}
+
+	request.Header.Set("x-request-id", params.RequestID)
+	request.Header.Set("Content-Type", "application/json")
+
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token))
+
+	response, err := client.httpClient.Do(request)
+	if err != nil {
+		return Token{}, fmt.Errorf("sending http request to create access token: %w", err)
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			client.log.Error("closing http response body", "err", err.Error())
+		}
+	}()
+
+	if response.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(response.Body)
+		return Token{}, fmt.Errorf("unexpected response when creating access token: code=%d body=%s", response.StatusCode, body)
+	}
+
+	var ctResp createTokenResponse
+	if err := json.NewDecoder(response.Body).Decode(&ctResp); err != nil {
+		return Token{}, fmt.Errorf("unmarshaling response body: %w", err)
+	}
+
+	return ctResp.Data, nil
+}
+
+func (client *AuthApiClient) DeleteToken(ctx context.Context, params DeleteTokenParams) error {
+	endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens", params.TokenID)
+	if err != nil {
+		return fmt.Errorf("building authapi tokens url: %w", err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodDelete, endpoint, nil)
+	if err != nil {
+		return fmt.Errorf("creating http request: %w", err)
+	}
+
+	request.Header.Set("x-request-id", params.RequestID)
+	request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token))
+
+	response, err := client.httpClient.Do(request)
+	if err != nil {
+		return fmt.Errorf("sending http request to delete access token: %w", err)
+	}
+	defer func() {
+		if err := response.Body.Close(); err != nil {
+			client.log.Error("closing http response body", "err", err.Error())
+		}
+	}()
+
+	if response.StatusCode == http.StatusNotFound {
+		return fmt.Errorf("token id: %s %w", params.TokenID, ErrTokenNotFound)
+	}
+
+	if response.StatusCode != http.StatusOK && response.StatusCode != http.StatusNoContent {
+		body, _ := io.ReadAll(response.Body)
+		return fmt.Errorf("unexpected response when deleting access token: code=%d body=%s", response.StatusCode, body)
+	}
+
+	return nil
+}