frostfs-api-go/pkg/token/bearer.go
Alex Vanin e023b6e51e [#179] sdk/client: Ease bearer token sanity check
Now owner ID field is not required to be set. According to
latest neofs-api, this field set if token was issued for
specific owner ID. If this field is not set, then any user
can use this token while it is correctly signed and has valid
lifetime.

Lifetime is also can be omitted since node interpret empty
lifetime as a lifetime with zero values.

Signed-off-by: Alex Vanin <alexey@nspcc.ru>
2020-10-22 15:41:59 +03:00

105 lines
2.2 KiB
Go

package token
import (
"crypto/ecdsa"
"errors"
"github.com/nspcc-dev/neofs-api-go/pkg/acl/eacl"
"github.com/nspcc-dev/neofs-api-go/pkg/owner"
"github.com/nspcc-dev/neofs-api-go/util/signature"
"github.com/nspcc-dev/neofs-api-go/v2/acl"
"github.com/nspcc-dev/neofs-api-go/v2/refs"
v2signature "github.com/nspcc-dev/neofs-api-go/v2/signature"
)
type BearerToken struct {
token acl.BearerToken
}
func (b BearerToken) ToV2() *acl.BearerToken {
return &b.token
}
func (b *BearerToken) SetLifetime(exp, nbf, iat uint64) {
body := b.token.GetBody()
if body == nil {
body = new(acl.BearerTokenBody)
}
lt := new(acl.TokenLifetime)
lt.SetExp(exp)
lt.SetNbf(nbf)
lt.SetIat(iat)
body.SetLifetime(lt)
b.token.SetBody(body)
}
func (b *BearerToken) SetEACLTable(table *eacl.Table) {
body := b.token.GetBody()
if body == nil {
body = new(acl.BearerTokenBody)
}
body.SetEACL(table.ToV2())
b.token.SetBody(body)
}
func (b *BearerToken) SetOwner(id *owner.ID) {
body := b.token.GetBody()
if body == nil {
body = new(acl.BearerTokenBody)
}
body.SetOwnerID(id.ToV2())
b.token.SetBody(body)
}
func (b *BearerToken) SignToken(key *ecdsa.PrivateKey) error {
err := sanityCheck(b)
if err != nil {
return err
}
signWrapper := v2signature.StableMarshalerWrapper{SM: b.token.GetBody()}
return signature.SignDataWithHandler(key, signWrapper, func(key []byte, sig []byte) {
bearerSignature := new(refs.Signature)
bearerSignature.SetKey(key)
bearerSignature.SetSign(sig)
b.token.SetSignature(bearerSignature)
})
}
func NewBearerToken() *BearerToken {
b := new(BearerToken)
b.token = acl.BearerToken{}
b.token.SetBody(new(acl.BearerTokenBody))
return b
}
func NewBearerTokenFromV2(v2 *acl.BearerToken) *BearerToken {
if v2 == nil {
v2 = new(acl.BearerToken)
}
return &BearerToken{
token: *v2,
}
}
// sanityCheck if bearer token is ready to be issued
func sanityCheck(b *BearerToken) error {
switch {
case b == nil:
return errors.New("bearer token is not set")
case b.token.GetBody() == nil:
return errors.New("bearer token body is not set")
case b.token.GetBody().GetEACL() == nil:
return errors.New("bearer token EACL table is not set")
}
// consider checking EACL sanity there, lifetime correctness, etc.
return nil
}