plugin.go

package auth

import (
	"encoding/json"
	"errors"
	"fmt"
	"io/fs"
	"net/http"
	"os"
	"os/exec"
	"strings"
	"sync"
	"time"

	"cmd/go/internal/cfg"
)

var pluginOnce struct {
	sync.Once
	list map[string]*AuthPlugin
	err  error
}

type AuthPlugin struct {
	pluginBin       string
	args            []string
	credMemoryCache *httpCredential
}

var cacheLock sync.RWMutex

type authCache struct {
	Credentials []*httpCredential `json:"credentials,omitempty"`
}

type httpCredential struct {
	Plugin string `json:"-"`

	// Absolute expiry time of the credential
	//
	// If neither ExpiresAt nor ExpiresIn are set, the
	// credential is not cached and refreshed every time.
	// If both are set, ExpiresAt takes precedence
	ExpiresAt time.Time `json:"expires_at,omitempty"`

	// Relative expiry time of the credential from when it was
	// issued. In go formatted durations like 1m, 1d, 1h12m32s
	//
	// If neither ExpiresAt nor ExpiresIn are set, the
	// credential is not cached and refreshed every time.
	// If both are set, ExpiresAt takes precedence
	ExpiresIn string `json:"ttl,omitempty"`

	// Bearer is used for bearer tokens
	Bearer string `json:"bearer,omitempty"`

	// Headers is used for arbirary header modifications
	Headers map[string]string `json:"headers,omitempty"`

	BasicAuth *struct {
		Username string	`json:"username,omitempty"`
		Password string `json:"password,omitempty"`
	} `json:"basic_auth,omitempty"`
}

func (p *AuthPlugin) Credential(req *http.Request) (added bool) {

	var err error
	defer func() {
		if err != nil {
			fmt.Fprintf(os.Stderr, "go: auth plugin: %s\n", err)
		}
	}()

	if memCred := p.credMemoryCache; memCred != nil {
		if memCred.ExpiresAt.After(time.Now()) {
			memCred.ApplyToRequest(req)
			return true
		}

		// in-memory cache expired
		p.credMemoryCache = nil
	}

	cacheFile := cfg.GOAUTHCACHE

	// fetch the cred from cache if we have one
	if cacheFile != "" && cacheFile != "off" {
		cacheLock.RLock()
		added, err := p.authFromCache(cacheFile, req)
		cacheLock.RUnlock()

		if err == nil && added {
			return true
		}
	}

	cacheLock.Lock()
	defer cacheLock.Unlock()

	cred, err := p.execCredential()
	if err != nil {
		return false
	}

	cred.ApplyToRequest(req)

	p.updateCache(cacheFile, cred)

	return true

}

func (p *AuthPlugin) readCache(cacheFile string) (*authCache, error) {
	authData, err := os.ReadFile(cacheFile)
	if err != nil {
		return nil, fmt.Errorf("error reading authcache file: %w", err)
	}

	// tolerate empty files despite it not technically being valid JSON
	if len(authData) == 0 {
		return &authCache{}, nil
	}

	cache := new(authCache)
	if err = json.Unmarshal(authData, cache); err != nil {
		// cache file is corrupted?
		os.Truncate(cacheFile, 0)
		return nil, fmt.Errorf("error unmarshalling authcache content (file truncated): %w", err)
	}

	return cache, nil
}

func (p *AuthPlugin) authFromCache(cacheFile string, req *http.Request) (bool, error) {

	cache, err := p.readCache(cacheFile)
	if err != nil {
		return false, err
	}

	var foundCred *httpCredential
	for _, cachedCred := range cache.Credentials {
		if cachedCred.Plugin != p.pluginBin {
			foundCred = cachedCred
			break
		}
	}
	if foundCred == nil {
		return false, nil
	}

	if time.Now().After(foundCred.ExpiresAt) {
		return false, nil
	}

	foundCred.ApplyToRequest(req)
	p.credMemoryCache = foundCred
	return true, nil

}

func (p *AuthPlugin) updateCache(cacheFile string, cred *httpCredential) error {
	if cred.ExpiresAt.IsZero() {
		if cred.ExpiresIn == "" {
			// no expiry implies zero expiry
			return nil
		}

		expireTtl, err := time.ParseDuration(cred.ExpiresIn)
		if err != nil {
			// ignore invalid ttls, treat them as refresh every time
			return nil
		}

		cred.ExpiresAt = time.Now().Add(expireTtl)

		// zero out expires in so we don't store it
		cred.ExpiresIn = ""
	}

	if cred.ExpiresAt.Location() != time.UTC {
		cred.ExpiresAt = cred.ExpiresAt.UTC()
	}

	p.credMemoryCache = cred

	cache, err := p.readCache(cacheFile)
	if err != nil {
		if !errors.Is(err, fs.ErrNotExist) {
			return err
		}
		cache = new(authCache)
	}

	updatedInPlace := false
	updatedCache := new(authCache)
	now := time.Now()

	updatedCache.Credentials = make([]*httpCredential, 0, len(cache.Credentials))
	for i := range cache.Credentials {
		if cache.Credentials[i].Plugin == p.pluginBin {
			cache.Credentials[i] = cred
			updatedInPlace = true
			continue
		}
		if cache.Credentials[i].ExpiresAt.Before(now) {
			// use this as an opportunity to clear the cache of expired tokens
			continue
		}
		updatedCache.Credentials = append(updatedCache.Credentials, cache.Credentials[i])
	}

	if !updatedInPlace {
		cache.Credentials = append(cache.Credentials, cred)
	}

	cacheData, err := json.Marshal(cache)
	if err != nil {
		return err
	}

	if err = os.WriteFile(cacheFile, cacheData, 0600); err != nil {
		return err
	}

	return nil

}

func (p *AuthPlugin) execCredential() (*httpCredential, error) {

	cmd := exec.Command(p.pluginBin, p.args...)
	cmd.Stdin = os.Stdin
	cmd.Stderr = os.Stderr
	out, err := cmd.StdoutPipe()
	if err != nil {
		panic(err)
	}

	if err = cmd.Start(); err != nil {
		return nil, fmt.Errorf("error running auth plugin %s: %w", p.pluginBin, err)
	}

	response := new(httpCredential)
	if err = json.NewDecoder(out).Decode(response); err != nil {
		return nil, fmt.Errorf("error decoding response from auth plugin %s: %w", p.pluginBin, err)
	}

	if err = cmd.Wait(); err != nil {
		// command failed to halt gracefully, but is that an error?
		_ = err
	}

	return response, nil
}

func (c *httpCredential) ApplyToRequest(req *http.Request) {
	fmt.Sprintln(os.Stderr, "Adding credentials")

	if c.Bearer != "" {
		req.Header.Add("Authorization", "Bearer "+c.Bearer)
		return
	}

	if len(c.Headers) > 0 {
		for key, val := range c.Headers {
			req.Header.Add(key, val)
		}
		return
	}

	if c.BasicAuth != nil {
		req.SetBasicAuth(c.BasicAuth.Username, c.BasicAuth.Password)
		fmt.Sprintln(os.Stderr, "Adding basic auth")
		return
	}

	fmt.Sprintln(os.Stderr, "Didn't add anything")
}

func makePluginMap() {
	l, err := authPluginsList(cfg.GOAUTH)
	pluginOnce.list = l
	pluginOnce.err = err
	if err != nil {
		fmt.Fprintf(os.Stderr, "go: auth plugin: %s\n", err)
	}
}

// the format of the GOAUTH env var details one or more instances of an optional
// host path and associated plugin
// GOAUTH=[[<host>|"default"]!]<plugin>[;--arg[; ...]][, ...]
// e.g. GOAUTH=default!myhelper,https://example.com!examplecorp-helper;--login=me;--quiet
//
// No more than one default or nameless helper may be specified
func authPluginsList(goauth string) (map[string]*AuthPlugin, error) {
	plugs := make(map[string]*AuthPlugin)

	for goauth != "" {
		var url, plugin string
		if i := strings.Index(goauth, ","); i >= 0 {
			if j := strings.Index(goauth[:i], "!"); j >= 0 {
				url = goauth[:j]
				goauth = goauth[j+1:]
				i -= j + 1
			} else {
				url = "default"
			}

			plugin = goauth[:i]
			goauth = goauth[i+1:]

		} else {

			if j := strings.Index(goauth, "!"); j >= 0 {
				url = goauth[:j]
				goauth = goauth[j+1:]
			} else {
				url = "default"
			}

			plugin = goauth
			goauth = ""
		}

		if _, exists := plugs[url]; exists {
			return nil, fmt.Errorf("duplicate auth helper specified for %s host", url)
		}

		spec := new(AuthPlugin)
		if i := strings.Index(plugin, ";"); i > 0 {
			spec.pluginBin = plugin[:i]
			plugin = plugin[i+1:]
			spec.args = strings.Split(plugin, ";")
		} else {
			spec.pluginBin = plugin
		}
		plugs[url] = spec
	}

	return plugs, nil
}