Initial QSfera import

Server/vendor/go-micro.dev/v4/auth/auth.go

@@ -0,0 +1,137 @@
+// Package auth provides authentication and authorization capability
+package auth
+
+import (
+	"context"
+	"errors"
+	"time"
+)
+
+const (
+	// BearerScheme used for Authorization header.
+	BearerScheme = "Bearer "
+	// ScopePublic is the scope applied to a rule to allow access to the public.
+	ScopePublic = ""
+	// ScopeAccount is the scope applied to a rule to limit to users with any valid account.
+	ScopeAccount = "*"
+)
+
+var (
+	// ErrInvalidToken is when the token provided is not valid.
+	ErrInvalidToken = errors.New("invalid token provided")
+	// ErrForbidden is when a user does not have the necessary scope to access a resource.
+	ErrForbidden = errors.New("resource forbidden")
+)
+
+// Auth provides authentication and authorization.
+type Auth interface {
+	// Init the auth
+	Init(opts ...Option)
+	// Options set for auth
+	Options() Options
+	// Generate a new account
+	Generate(id string, opts ...GenerateOption) (*Account, error)
+	// Inspect a token
+	Inspect(token string) (*Account, error)
+	// Token generated using refresh token or credentials
+	Token(opts ...TokenOption) (*Token, error)
+	// String returns the name of the implementation
+	String() string
+}
+
+// Rules manages access to resources.
+type Rules interface {
+	// Verify an account has access to a resource using the rules
+	Verify(acc *Account, res *Resource, opts ...VerifyOption) error
+	// Grant access to a resource
+	Grant(rule *Rule) error
+	// Revoke access to a resource
+	Revoke(rule *Rule) error
+	// List returns all the rules used to verify requests
+	List(...ListOption) ([]*Rule, error)
+}
+
+// Account provided by an auth provider.
+type Account struct {
+	// Any other associated metadata
+	Metadata map[string]string `json:"metadata"`
+	// ID of the account e.g. email
+	ID string `json:"id"`
+	// Type of the account, e.g. service
+	Type string `json:"type"`
+	// Issuer of the account
+	Issuer string `json:"issuer"`
+	// Secret for the account, e.g. the password
+	Secret string `json:"secret"`
+	// Scopes the account has access to
+	Scopes []string `json:"scopes"`
+}
+
+// Token can be short or long lived.
+type Token struct {
+	// Time of token creation
+	Created time.Time `json:"created"`
+	// Time of token expiry
+	Expiry time.Time `json:"expiry"`
+	// The token to be used for accessing resources
+	AccessToken string `json:"access_token"`
+	// RefreshToken to be used to generate a new token
+	RefreshToken string `json:"refresh_token"`
+}
+
+// Expired returns a boolean indicating if the token needs to be refreshed.
+func (t *Token) Expired() bool {
+	return t.Expiry.Unix() < time.Now().Unix()
+}
+
+// Resource is an entity such as a user or.
+type Resource struct {
+	// Name of the resource, e.g. go.micro.service.notes
+	Name string `json:"name"`
+	// Type of resource, e.g. service
+	Type string `json:"type"`
+	// Endpoint resource e.g NotesService.Create
+	Endpoint string `json:"endpoint"`
+}
+
+// Access defines the type of access a rule grants.
+type Access int
+
+const (
+	// AccessGranted to a resource.
+	AccessGranted Access = iota
+	// AccessDenied to a resource.
+	AccessDenied
+)
+
+// Rule is used to verify access to a resource.
+type Rule struct {
+	// Resource the rule applies to
+	Resource *Resource
+	// ID of the rule, e.g. "public"
+	ID string
+	// Scope the rule requires, a blank scope indicates open to the public and * indicates the rule
+	// applies to any valid account
+	Scope string
+	// Access determines if the rule grants or denies access to the resource
+	Access Access
+	// Priority the rule should take when verifying a request, the higher the value the sooner the
+	// rule will be applied
+	Priority int32
+}
+
+type accountKey struct{}
+
+// AccountFromContext gets the account from the context, which
+// is set by the auth wrapper at the start of a call. If the account
+// is not set, a nil account will be returned. The error is only returned
+// when there was a problem retrieving an account.
+func AccountFromContext(ctx context.Context) (*Account, bool) {
+	acc, ok := ctx.Value(accountKey{}).(*Account)
+	return acc, ok
+}
+
+// ContextWithAccount sets the account in the context.
+func ContextWithAccount(ctx context.Context, account *Account) context.Context {
+	return context.WithValue(ctx, accountKey{}, account)
+}

Server/vendor/go-micro.dev/v4/auth/noop.go

@@ -0,0 +1,91 @@
+package auth
+
+import (
+	"github.com/google/uuid"
+)
+
+var (
+	DefaultAuth = NewAuth()
+)
+
+func NewAuth(opts ...Option) Auth {
+	options := Options{}
+
+	for _, o := range opts {
+		o(&options)
+	}
+
+	return &noop{
+		opts: options,
+	}
+}
+
+func NewRules() Rules {
+	return new(noopRules)
+}
+
+type noop struct {
+	opts Options
+}
+
+type noopRules struct{}
+
+// String returns the name of the implementation.
+func (n *noop) String() string {
+	return "noop"
+}
+
+// Init the auth.
+func (n *noop) Init(opts ...Option) {
+	for _, o := range opts {
+		o(&n.opts)
+	}
+}
+
+// Options set for auth.
+func (n *noop) Options() Options {
+	return n.opts
+}
+
+// Generate a new account.
+func (n *noop) Generate(id string, opts ...GenerateOption) (*Account, error) {
+	options := NewGenerateOptions(opts...)
+
+	return &Account{
+		ID:       id,
+		Secret:   options.Secret,
+		Metadata: options.Metadata,
+		Scopes:   options.Scopes,
+		Issuer:   n.Options().Namespace,
+	}, nil
+}
+
+// Grant access to a resource.
+func (n *noopRules) Grant(rule *Rule) error {
+	return nil
+}
+
+// Revoke access to a resource.
+func (n *noopRules) Revoke(rule *Rule) error {
+	return nil
+}
+
+// Rules used to verify requests
+// Verify an account has access to a resource.
+func (n *noopRules) Verify(acc *Account, res *Resource, opts ...VerifyOption) error {
+	return nil
+}
+
+func (n *noopRules) List(opts ...ListOption) ([]*Rule, error) {
+	return []*Rule{}, nil
+}
+
+// Inspect a token.
+func (n *noop) Inspect(token string) (*Account, error) {
+	return &Account{ID: uuid.New().String(), Issuer: n.Options().Namespace}, nil
+}
+
+// Token generation using an account id and secret.
+func (n *noop) Token(opts ...TokenOption) (*Token, error) {
+	return &Token{}, nil
+}

Server/vendor/go-micro.dev/v4/auth/options.go

@@ -0,0 +1,222 @@
+package auth
+
+import (
+	"context"
+	"time"
+
+	"go-micro.dev/v4/logger"
+)
+
+func NewOptions(opts ...Option) Options {
+	options := Options{
+		Logger: logger.DefaultLogger,
+	}
+
+	for _, o := range opts {
+		o(&options)
+	}
+
+	return options
+}
+
+type Options struct {
+	// Logger is the underline logger
+	Logger logger.Logger
+	// Token is the services token used to authenticate itself
+	Token *Token
+	// Namespace the service belongs to
+	Namespace string
+	// ID is the services auth ID
+	ID string
+	// Secret is used to authenticate the service
+	Secret string
+	// PublicKey for decoding JWTs
+	PublicKey string
+	// PrivateKey for encoding JWTs
+	PrivateKey string
+	// Addrs sets the addresses of auth
+	Addrs []string
+}
+
+type Option func(o *Options)
+
+// Addrs is the auth addresses to use.
+func Addrs(addrs ...string) Option {
+	return func(o *Options) {
+		o.Addrs = addrs
+	}
+}
+
+// Namespace the service belongs to.
+func Namespace(n string) Option {
+	return func(o *Options) {
+		o.Namespace = n
+	}
+}
+
+// PublicKey is the JWT public key.
+func PublicKey(key string) Option {
+	return func(o *Options) {
+		o.PublicKey = key
+	}
+}
+
+// PrivateKey is the JWT private key.
+func PrivateKey(key string) Option {
+	return func(o *Options) {
+		o.PrivateKey = key
+	}
+}
+
+// WithLogger sets the underline logger.
+func WithLogger(l logger.Logger) Option {
+	return func(o *Options) {
+		o.Logger = l
+	}
+}
+
+// Credentials sets the auth credentials.
+func Credentials(id, secret string) Option {
+	return func(o *Options) {
+		o.ID = id
+		o.Secret = secret
+	}
+}
+
+// ClientToken sets the auth token to use when making requests.
+func ClientToken(token *Token) Option {
+	return func(o *Options) {
+		o.Token = token
+	}
+}
+
+type GenerateOptions struct {
+	// Metadata associated with the account
+	Metadata map[string]string
+	// Provider of the account, e.g. oauth
+	Provider string
+	// Type of the account, e.g. user
+	Type string
+	// Secret used to authenticate the account
+	Secret string
+	// Scopes the account has access too
+	Scopes []string
+}
+
+type GenerateOption func(o *GenerateOptions)
+
+// WithSecret for the generated account.
+func WithSecret(s string) GenerateOption {
+	return func(o *GenerateOptions) {
+		o.Secret = s
+	}
+}
+
+// WithType for the generated account.
+func WithType(t string) GenerateOption {
+	return func(o *GenerateOptions) {
+		o.Type = t
+	}
+}
+
+// WithMetadata for the generated account.
+func WithMetadata(md map[string]string) GenerateOption {
+	return func(o *GenerateOptions) {
+		o.Metadata = md
+	}
+}
+
+// WithProvider for the generated account.
+func WithProvider(p string) GenerateOption {
+	return func(o *GenerateOptions) {
+		o.Provider = p
+	}
+}
+
+// WithScopes for the generated account.
+func WithScopes(s ...string) GenerateOption {
+	return func(o *GenerateOptions) {
+		o.Scopes = s
+	}
+}
+
+// NewGenerateOptions from a slice of options.
+func NewGenerateOptions(opts ...GenerateOption) GenerateOptions {
+	var options GenerateOptions
+	for _, o := range opts {
+		o(&options)
+	}
+	return options
+}
+
+type TokenOptions struct {
+	// ID for the account
+	ID string
+	// Secret for the account
+	Secret string
+	// RefreshToken is used to refesh a token
+	RefreshToken string
+	// Expiry is the time the token should live for
+	Expiry time.Duration
+}
+
+type TokenOption func(o *TokenOptions)
+
+// WithExpiry for the token.
+func WithExpiry(ex time.Duration) TokenOption {
+	return func(o *TokenOptions) {
+		o.Expiry = ex
+	}
+}
+
+func WithCredentials(id, secret string) TokenOption {
+	return func(o *TokenOptions) {
+		o.ID = id
+		o.Secret = secret
+	}
+}
+
+func WithToken(rt string) TokenOption {
+	return func(o *TokenOptions) {
+		o.RefreshToken = rt
+	}
+}
+
+// NewTokenOptions from a slice of options.
+func NewTokenOptions(opts ...TokenOption) TokenOptions {
+	var options TokenOptions
+	for _, o := range opts {
+		o(&options)
+	}
+
+	// set default expiry of token
+	if options.Expiry == 0 {
+		options.Expiry = time.Minute
+	}
+
+	return options
+}
+
+type VerifyOptions struct {
+	Context context.Context
+}
+
+type VerifyOption func(o *VerifyOptions)
+
+func VerifyContext(ctx context.Context) VerifyOption {
+	return func(o *VerifyOptions) {
+		o.Context = ctx
+	}
+}
+
+type ListOptions struct {
+	Context context.Context
+}
+
+type ListOption func(o *ListOptions)
+
+func RulesContext(ctx context.Context) ListOption {
+	return func(o *ListOptions) {
+		o.Context = ctx
+	}
+}

Server/vendor/go-micro.dev/v4/auth/rules.go

@@ -0,0 +1,91 @@
+package auth
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// Verify an account has access to a resource using the rules provided. If the account does not have
+// access an error will be returned. If there are no rules provided which match the resource, an error
+// will be returned.
+func Verify(rules []*Rule, acc *Account, res *Resource) error {
+	// the rule is only to be applied if the type matches the resource or is catch-all (*)
+	validTypes := []string{"*", res.Type}
+
+	// the rule is only to be applied if the name matches the resource or is catch-all (*)
+	validNames := []string{"*", res.Name}
+
+	// rules can have wildcard excludes on endpoints since this can also be a path for web services,
+	// e.g. /foo/* would include /foo/bar. We also want to check for wildcards and the exact endpoint
+	validEndpoints := []string{"*", res.Endpoint}
+	if comps := strings.Split(res.Endpoint, "/"); len(comps) > 1 {
+		for i := 1; i < len(comps)+1; i++ {
+			wildcard := fmt.Sprintf("%v/*", strings.Join(comps[0:i], "/"))
+			validEndpoints = append(validEndpoints, wildcard)
+		}
+	}
+
+	// filter the rules to the ones which match the criteria above
+	filteredRules := make([]*Rule, 0)
+	for _, rule := range rules {
+		if !include(validTypes, rule.Resource.Type) {
+			continue
+		}
+		if !include(validNames, rule.Resource.Name) {
+			continue
+		}
+		if !include(validEndpoints, rule.Resource.Endpoint) {
+			continue
+		}
+		filteredRules = append(filteredRules, rule)
+	}
+
+	// sort the filtered rules by priority, highest to lowest
+	sort.SliceStable(filteredRules, func(i, j int) bool {
+		return filteredRules[i].Priority > filteredRules[j].Priority
+	})
+
+	// loop through the rules and check for a rule which applies to this account
+	for _, rule := range filteredRules {
+		// a blank scope indicates the rule applies to everyone, even nil accounts
+		if rule.Scope == ScopePublic && rule.Access == AccessDenied {
+			return ErrForbidden
+		} else if rule.Scope == ScopePublic && rule.Access == AccessGranted {
+			return nil
+		}
+
+		// all further checks require an account
+		if acc == nil {
+			continue
+		}
+
+		// this rule applies to any account
+		if rule.Scope == ScopeAccount && rule.Access == AccessDenied {
+			return ErrForbidden
+		} else if rule.Scope == ScopeAccount && rule.Access == AccessGranted {
+			return nil
+		}
+
+		// if the account has the necessary scope
+		if include(acc.Scopes, rule.Scope) && rule.Access == AccessDenied {
+			return ErrForbidden
+		} else if include(acc.Scopes, rule.Scope) && rule.Access == AccessGranted {
+			return nil
+		}
+	}
+
+	// if no rules matched then return forbidden
+	return ErrForbidden
+}
+
+// include is a helper function which checks to see if the slice contains the value. includes is
+// not case sensitive.
+func include(slice []string, val string) bool {
+	for _, s := range slice {
+		if strings.EqualFold(s, val) {
+			return true
+		}
+	}
+	return false
+}