From 6c55c0fd4b83a32703ef9c5e000d0f3333aca8db Mon Sep 17 00:00:00 2001 From: Evgenii Stratonikov Date: Mon, 8 Nov 2021 17:14:14 +0300 Subject: [PATCH] [#61] token: move package from neofs-api-go Signed-off-by: Evgenii Stratonikov --- token/bearer.go | 188 +++++++++++++++++++++++++++++++++++++++++ token/bearer_test.go | 84 ++++++++++++++++++ token/test/generate.go | 40 +++++++++ 3 files changed, 312 insertions(+) create mode 100644 token/bearer.go create mode 100644 token/bearer_test.go create mode 100644 token/test/generate.go diff --git a/token/bearer.go b/token/bearer.go new file mode 100644 index 00000000..3cec8b4b --- /dev/null +++ b/token/bearer.go @@ -0,0 +1,188 @@ +package token + +import ( + "crypto/ecdsa" + "crypto/elliptic" + "errors" + + "github.com/nspcc-dev/neo-go/pkg/crypto/keys" + "github.com/nspcc-dev/neofs-api-go/v2/acl" + "github.com/nspcc-dev/neofs-api-go/v2/refs" + v2signature "github.com/nspcc-dev/neofs-api-go/v2/signature" + "github.com/nspcc-dev/neofs-sdk-go/eacl" + "github.com/nspcc-dev/neofs-sdk-go/owner" + "github.com/nspcc-dev/neofs-sdk-go/util/signature" +) + +var ( + errNilBearerToken = errors.New("bearer token is not set") + errNilBearerTokenBody = errors.New("bearer token body is not set") + errNilBearerTokenEACL = errors.New("bearer token EACL table is not set") +) + +type BearerToken struct { + token acl.BearerToken +} + +// ToV2 converts BearerToken to v2 BearerToken message. +// +// Nil BearerToken converts to nil. +func (b *BearerToken) ToV2() *acl.BearerToken { + if b == nil { + return nil + } + + return &b.token +} + +func (b *BearerToken) SetLifetime(exp, nbf, iat uint64) { + body := b.token.GetBody() + if body == nil { + body = new(acl.BearerTokenBody) + } + + lt := new(acl.TokenLifetime) + lt.SetExp(exp) + lt.SetNbf(nbf) + lt.SetIat(iat) + + body.SetLifetime(lt) + b.token.SetBody(body) +} + +func (b *BearerToken) SetEACLTable(table *eacl.Table) { + body := b.token.GetBody() + if body == nil { + body = new(acl.BearerTokenBody) + } + + body.SetEACL(table.ToV2()) + b.token.SetBody(body) +} + +func (b *BearerToken) SetOwner(id *owner.ID) { + body := b.token.GetBody() + if body == nil { + body = new(acl.BearerTokenBody) + } + + body.SetOwnerID(id.ToV2()) + b.token.SetBody(body) +} + +func (b *BearerToken) SignToken(key *ecdsa.PrivateKey) error { + err := sanityCheck(b) + if err != nil { + return err + } + + signWrapper := v2signature.StableMarshalerWrapper{SM: b.token.GetBody()} + + return signature.SignDataWithHandler(key, signWrapper, func(key []byte, sig []byte) { + bearerSignature := new(refs.Signature) + bearerSignature.SetKey(key) + bearerSignature.SetSign(sig) + b.token.SetSignature(bearerSignature) + }) +} + +// Issuer returns owner.ID associated with the key that signed bearer token. +// To pass node validation it should be owner of requested container. Returns +// nil if token is not signed. +func (b *BearerToken) Issuer() *owner.ID { + pub, _ := keys.NewPublicKeyFromBytes(b.token.GetSignature().GetKey(), elliptic.P256()) + wallet, err := owner.NEO3WalletFromPublicKey((*ecdsa.PublicKey)(pub)) + if err != nil { + return nil + } + + return owner.NewIDFromNeo3Wallet(wallet) +} + +// NewBearerToken creates and initializes blank BearerToken. +// +// Defaults: +// - signature: nil; +// - eacl: nil; +// - ownerID: nil; +// - exp: 0; +// - nbf: 0; +// - iat: 0. +func NewBearerToken() *BearerToken { + b := new(BearerToken) + b.token = acl.BearerToken{} + b.token.SetBody(new(acl.BearerTokenBody)) + + return b +} + +// ToV2 converts BearerToken to v2 BearerToken message. +func NewBearerTokenFromV2(v2 *acl.BearerToken) *BearerToken { + if v2 == nil { + v2 = new(acl.BearerToken) + } + + return &BearerToken{ + token: *v2, + } +} + +// sanityCheck if bearer token is ready to be issued. +func sanityCheck(b *BearerToken) error { + switch { + case b == nil: + return errNilBearerToken + case b.token.GetBody() == nil: + return errNilBearerTokenBody + case b.token.GetBody().GetEACL() == nil: + return errNilBearerTokenEACL + } + + // consider checking EACL sanity there, lifetime correctness, etc. + + return nil +} + +// Marshal marshals BearerToken into a protobuf binary form. +// +// Buffer is allocated when the argument is empty. +// Otherwise, the first buffer is used. +func (b *BearerToken) Marshal(bs ...[]byte) ([]byte, error) { + var buf []byte + if len(bs) > 0 { + buf = bs[0] + } + + return b.ToV2(). + StableMarshal(buf) +} + +// Unmarshal unmarshals protobuf binary representation of BearerToken. +func (b *BearerToken) Unmarshal(data []byte) error { + fV2 := new(acl.BearerToken) + if err := fV2.Unmarshal(data); err != nil { + return err + } + + *b = *NewBearerTokenFromV2(fV2) + + return nil +} + +// MarshalJSON encodes BearerToken to protobuf JSON format. +func (b *BearerToken) MarshalJSON() ([]byte, error) { + return b.ToV2(). + MarshalJSON() +} + +// UnmarshalJSON decodes BearerToken from protobuf JSON format. +func (b *BearerToken) UnmarshalJSON(data []byte) error { + fV2 := new(acl.BearerToken) + if err := fV2.UnmarshalJSON(data); err != nil { + return err + } + + *b = *NewBearerTokenFromV2(fV2) + + return nil +} diff --git a/token/bearer_test.go b/token/bearer_test.go new file mode 100644 index 00000000..1cd4b1e3 --- /dev/null +++ b/token/bearer_test.go @@ -0,0 +1,84 @@ +package token_test + +import ( + "crypto/ecdsa" + "testing" + + "github.com/nspcc-dev/neo-go/pkg/crypto/keys" + "github.com/nspcc-dev/neofs-sdk-go/eacl" + "github.com/nspcc-dev/neofs-sdk-go/owner" + "github.com/nspcc-dev/neofs-sdk-go/token" + tokentest "github.com/nspcc-dev/neofs-sdk-go/token/test" + "github.com/stretchr/testify/require" +) + +func TestBearerToken_Issuer(t *testing.T) { + bearerToken := token.NewBearerToken() + + t.Run("non signed token", func(t *testing.T) { + require.Nil(t, bearerToken.Issuer()) + }) + + t.Run("signed token", func(t *testing.T) { + p, err := keys.NewPrivateKey() + require.NoError(t, err) + + wallet, err := owner.NEO3WalletFromPublicKey((*ecdsa.PublicKey)(p.PublicKey())) + require.NoError(t, err) + + ownerID := owner.NewIDFromNeo3Wallet(wallet) + + bearerToken.SetEACLTable(eacl.NewTable()) + require.NoError(t, bearerToken.SignToken(&p.PrivateKey)) + require.True(t, ownerID.Equal(bearerToken.Issuer())) + }) +} + +func TestFilterEncoding(t *testing.T) { + f := tokentest.Generate() + + t.Run("binary", func(t *testing.T) { + data, err := f.Marshal() + require.NoError(t, err) + + f2 := token.NewBearerToken() + require.NoError(t, f2.Unmarshal(data)) + + require.Equal(t, f, f2) + }) + + t.Run("json", func(t *testing.T) { + data, err := f.MarshalJSON() + require.NoError(t, err) + + d2 := token.NewBearerToken() + require.NoError(t, d2.UnmarshalJSON(data)) + + require.Equal(t, f, d2) + }) +} + +func TestBearerToken_ToV2(t *testing.T) { + t.Run("nil", func(t *testing.T) { + var x *token.BearerToken + + require.Nil(t, x.ToV2()) + }) +} + +func TestNewBearerToken(t *testing.T) { + t.Run("default values", func(t *testing.T) { + tkn := token.NewBearerToken() + + // convert to v2 message + tknV2 := tkn.ToV2() + + require.NotNil(t, tknV2.GetBody()) + require.Zero(t, tknV2.GetBody().GetLifetime().GetExp()) + require.Zero(t, tknV2.GetBody().GetLifetime().GetNbf()) + require.Zero(t, tknV2.GetBody().GetLifetime().GetIat()) + require.Nil(t, tknV2.GetBody().GetEACL()) + require.Nil(t, tknV2.GetBody().GetOwnerID()) + require.Nil(t, tknV2.GetSignature()) + }) +} diff --git a/token/test/generate.go b/token/test/generate.go new file mode 100644 index 00000000..899dba31 --- /dev/null +++ b/token/test/generate.go @@ -0,0 +1,40 @@ +package tokentest + +import ( + "github.com/nspcc-dev/neo-go/pkg/crypto/keys" + eacltest "github.com/nspcc-dev/neofs-sdk-go/eacl/test" + ownertest "github.com/nspcc-dev/neofs-sdk-go/owner/test" + "github.com/nspcc-dev/neofs-sdk-go/token" +) + +// Generate returns random token.BearerToken. +// +// Resulting token is unsigned. +func Generate() *token.BearerToken { + x := token.NewBearerToken() + + x.SetLifetime(3, 2, 1) + x.SetOwner(ownertest.GenerateID()) + x.SetEACLTable(eacltest.Table()) + + return x +} + +// GenerateSigned returns signed random token.BearerToken. +// +// Panics if token could not be signed (actually unexpected). +func GenerateSigned() *token.BearerToken { + tok := Generate() + + p, err := keys.NewPrivateKey() + if err != nil { + panic(err) + } + + err = tok.SignToken(&p.PrivateKey) + if err != nil { + panic(err) + } + + return tok +}