forked from TrueCloudLab/frostfs-node
135 lines
4.5 KiB
Go
135 lines
4.5 KiB
Go
package bearer
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
"time"
|
|
|
|
internalclient "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/client"
|
|
"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/common"
|
|
"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
|
|
commonCmd "git.frostfs.info/TrueCloudLab/frostfs-node/cmd/internal/common"
|
|
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
|
|
eaclSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/eacl"
|
|
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
const (
|
|
eaclFlag = "eacl"
|
|
issuedAtFlag = "issued-at"
|
|
notValidBeforeFlag = "not-valid-before"
|
|
ownerFlag = "owner"
|
|
outFlag = "out"
|
|
jsonFlag = commonflags.JSON
|
|
impersonateFlag = "impersonate"
|
|
)
|
|
|
|
var createCmd = &cobra.Command{
|
|
Use: "create",
|
|
Short: "Create bearer token",
|
|
Long: `Create bearer token.
|
|
|
|
All epoch flags can be specified relative to the current epoch with the +n syntax.
|
|
In this case --` + commonflags.RPC + ` flag should be specified and the epoch in bearer token
|
|
is set to current epoch + n.
|
|
`,
|
|
Run: createToken,
|
|
}
|
|
|
|
func init() {
|
|
createCmd.Flags().StringP(eaclFlag, "e", "", "Path to the extended ACL table (mutually exclusive with --impersonate flag)")
|
|
createCmd.Flags().StringP(issuedAtFlag, "i", "+0", "Epoch to issue token at")
|
|
createCmd.Flags().StringP(notValidBeforeFlag, "n", "+0", "Not valid before epoch")
|
|
createCmd.Flags().StringP(commonflags.ExpireAt, "x", "", "The last active epoch for the token")
|
|
createCmd.Flags().StringP(ownerFlag, "o", "", "Token owner")
|
|
createCmd.Flags().String(outFlag, "", "File to write token to")
|
|
createCmd.Flags().Bool(jsonFlag, false, "Output token in JSON")
|
|
createCmd.Flags().Bool(impersonateFlag, false, "Mark token as impersonate to consider the token signer as the request owner (mutually exclusive with --eacl flag)")
|
|
createCmd.Flags().StringP(commonflags.RPC, commonflags.RPCShorthand, commonflags.RPCDefault, commonflags.RPCUsage)
|
|
|
|
createCmd.MarkFlagsMutuallyExclusive(eaclFlag, impersonateFlag)
|
|
|
|
_ = cobra.MarkFlagFilename(createCmd.Flags(), eaclFlag)
|
|
|
|
_ = cobra.MarkFlagRequired(createCmd.Flags(), commonflags.ExpireAt)
|
|
_ = cobra.MarkFlagRequired(createCmd.Flags(), ownerFlag)
|
|
_ = cobra.MarkFlagRequired(createCmd.Flags(), outFlag)
|
|
}
|
|
|
|
func createToken(cmd *cobra.Command, _ []string) {
|
|
iat, iatRelative, err := common.ParseEpoch(cmd, issuedAtFlag)
|
|
commonCmd.ExitOnErr(cmd, "can't parse --"+issuedAtFlag+" flag: %w", err)
|
|
|
|
exp, expRelative, err := common.ParseEpoch(cmd, commonflags.ExpireAt)
|
|
commonCmd.ExitOnErr(cmd, "can't parse --"+commonflags.ExpireAt+" flag: %w", err)
|
|
|
|
nvb, nvbRelative, err := common.ParseEpoch(cmd, notValidBeforeFlag)
|
|
commonCmd.ExitOnErr(cmd, "can't parse --"+notValidBeforeFlag+" flag: %w", err)
|
|
|
|
if iatRelative || expRelative || nvbRelative {
|
|
endpoint, _ := cmd.Flags().GetString(commonflags.RPC)
|
|
if len(endpoint) == 0 {
|
|
commonCmd.ExitOnErr(cmd, "can't fetch current epoch: %w", fmt.Errorf("'%s' flag value must be specified", commonflags.RPC))
|
|
}
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), time.Second*30)
|
|
defer cancel()
|
|
|
|
currEpoch, err := internalclient.GetCurrentEpoch(ctx, cmd, endpoint)
|
|
commonCmd.ExitOnErr(cmd, "can't fetch current epoch: %w", err)
|
|
|
|
if iatRelative {
|
|
iat += currEpoch
|
|
}
|
|
if expRelative {
|
|
exp += currEpoch
|
|
}
|
|
if nvbRelative {
|
|
nvb += currEpoch
|
|
}
|
|
}
|
|
if exp < nvb {
|
|
commonCmd.ExitOnErr(cmd, "",
|
|
fmt.Errorf("expiration epoch is less than not-valid-before epoch: %d < %d", exp, nvb))
|
|
}
|
|
|
|
ownerStr, _ := cmd.Flags().GetString(ownerFlag)
|
|
|
|
var ownerID user.ID
|
|
commonCmd.ExitOnErr(cmd, "can't parse recipient: %w", ownerID.DecodeString(ownerStr))
|
|
|
|
var b bearer.Token
|
|
b.SetExp(exp)
|
|
b.SetNbf(nvb)
|
|
b.SetIat(iat)
|
|
b.ForUser(ownerID)
|
|
|
|
impersonate, _ := cmd.Flags().GetBool(impersonateFlag)
|
|
b.SetImpersonate(impersonate)
|
|
|
|
eaclPath, _ := cmd.Flags().GetString(eaclFlag)
|
|
if eaclPath != "" {
|
|
table := eaclSDK.NewTable()
|
|
raw, err := os.ReadFile(eaclPath)
|
|
commonCmd.ExitOnErr(cmd, "can't read extended ACL file: %w", err)
|
|
commonCmd.ExitOnErr(cmd, "can't parse extended ACL: %w", json.Unmarshal(raw, table))
|
|
b.SetEACLTable(*table)
|
|
}
|
|
|
|
var data []byte
|
|
|
|
toJSON, _ := cmd.Flags().GetBool(jsonFlag)
|
|
if toJSON {
|
|
data, err = json.Marshal(b)
|
|
commonCmd.ExitOnErr(cmd, "can't mashal token to JSON: %w", err)
|
|
} else {
|
|
data = b.Marshal()
|
|
}
|
|
|
|
out, _ := cmd.Flags().GetString(outFlag)
|
|
err = os.WriteFile(out, data, 0o644)
|
|
commonCmd.ExitOnErr(cmd, "can't write token to file: %w", err)
|
|
}
|