Make requesting user available in context

pkg/api/context.go

@@ -19,6 +19,7 @@ package api
 import (
 	stderrs "errors"
 
+	"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user"
 	"golang.org/x/net/context"
 )
 
@@ -33,6 +34,9 @@ type key int
 // namespaceKey is the context key for the request namespace.
 const namespaceKey key = 0
 
+// userKey is the context key for the request user.
+const userKey key = 1
+
 // NewContext instantiates a base context object for request flows.
 func NewContext() Context {
 	return context.TODO()
@@ -86,3 +90,14 @@ func WithNamespaceDefaultIfNone(parent Context) Context {
 	}
 	return parent
 }
+
+// WithUser returns a copy of parent in which the user value is set
+func WithUser(parent Context, user user.Info) Context {
+	return WithValue(parent, userKey, user)
+}
+
+// UserFrom returns the value of the user key on the ctx
+func UserFrom(ctx Context) (user.Info, bool) {
+	user, ok := ctx.Value(userKey).(user.Info)
+	return user, ok
+}

pkg/api/requestcontext.go

@@ -0,0 +1,115 @@
+/*
+Copyright 2014 Google Inc. All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package api
+
+import (
+	"errors"
+	"net/http"
+	"sync"
+)
+
+// RequestContextMapper keeps track of the context associated with a particular request
+type RequestContextMapper interface {
+	// Get returns the context associated with the given request (if any), and true if the request has an associated context, and false if it does not.
+	Get(req *http.Request) (Context, bool)
+	// Update maps the request to the given context. If no context was previously associated with the request, an error is returned.
+	// Update should only be called with a descendant context of the previously associated context.
+	// Updating to an unrelated context may return an error in the future.
+	// The context associated with a request should only be updated by a limited set of callers.
+	// Valid examples include the authentication layer, or an audit/tracing layer.
+	Update(req *http.Request, context Context) error
+}
+
+type requestContextMap struct {
+	contexts map[*http.Request]Context
+	lock     sync.Mutex
+}
+
+// NewRequestContextMapper returns a new RequestContextMapper.
+// The returned mapper must be added as a request filter using NewRequestContextFilter.
+func NewRequestContextMapper() RequestContextMapper {
+	return &requestContextMap{
+		contexts: make(map[*http.Request]Context),
+	}
+}
+
+// Get returns the context associated with the given request (if any), and true if the request has an associated context, and false if it does not.
+// Get will only return a valid context when called from inside the filter chain set up by NewRequestContextFilter()
+func (c *requestContextMap) Get(req *http.Request) (Context, bool) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+	context, ok := c.contexts[req]
+	return context, ok
+}
+
+// Update maps the request to the given context.
+// If no context was previously associated with the request, an error is returned and the context is ignored.
+func (c *requestContextMap) Update(req *http.Request, context Context) error {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+	if _, ok := c.contexts[req]; !ok {
+		return errors.New("No context associated")
+	}
+	// TODO: ensure the new context is a descendant of the existing one
+	c.contexts[req] = context
+	return nil
+}
+
+// init maps the request to the given context and returns true if there was no context associated with the request already.
+// if a context was already associated with the request, it ignores the given context and returns false.
+// init is intentionally unexported to ensure that all init calls are paired with a remove after a request is handled
+func (c *requestContextMap) init(req *http.Request, context Context) bool {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+	if _, exists := c.contexts[req]; exists {
+		return false
+	}
+	c.contexts[req] = context
+	return true
+}
+
+// remove is intentionally unexported to ensure that the context is not removed until a request is handled
+func (c *requestContextMap) remove(req *http.Request) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+	delete(c.contexts, req)
+}
+
+// NewRequestContextFilter ensures there is a Context object associated with the request before calling the passed handler.
+// After the passed handler runs, the context is cleaned up.
+func NewRequestContextFilter(mapper RequestContextMapper, handler http.Handler) (http.Handler, error) {
+	if mapper, ok := mapper.(*requestContextMap); ok {
+		return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			if mapper.init(req, NewContext()) {
+				// If we were the ones to successfully initialize, pair with a remove
+				defer mapper.remove(req)
+			}
+			handler.ServeHTTP(w, req)
+		}), nil
+	} else {
+		return handler, errors.New("Unknown RequestContextMapper implementation.")
+	}
+
+}
+
+// IsEmpty returns true if there are no contexts registered, or an error if it could not be determined. Intended for use by tests.
+func IsEmpty(requestsToContexts RequestContextMapper) (bool, error) {
+	if requestsToContexts, ok := requestsToContexts.(*requestContextMap); ok {
+		return len(requestsToContexts.contexts) == 0, nil
+	}
+	return true, errors.New("Unknown RequestContextMapper implementation")
+}

pkg/apiserver/api_installer.go

@@ -62,8 +62,8 @@ func (a *APIInstaller) Install() (ws *restful.WebService, errors []error) {
 		linker:  a.group.linker,
 		info:    a.group.info,
 	})
-	redirectHandler := (&RedirectHandler{a.group.storage, a.group.codec, a.group.info})
-	proxyHandler := (&ProxyHandler{a.prefix + "/proxy/", a.group.storage, a.group.codec, a.group.info})
+	redirectHandler := (&RedirectHandler{a.group.storage, a.group.codec, a.group.context, a.group.info})
+	proxyHandler := (&ProxyHandler{a.prefix + "/proxy/", a.group.storage, a.group.codec, a.group.context, a.group.info})
 
 	for path, storage := range a.group.storage {
 		if err := a.registerResourceHandlers(path, storage, ws, watchHandler, redirectHandler, proxyHandler); err != nil {
@@ -88,6 +88,7 @@ func (a *APIInstaller) registerResourceHandlers(path string, storage RESTStorage
 	codec := a.group.codec
 	admit := a.group.admit
 	linker := a.group.linker
+	context := a.group.context
 	resource := path
 
 	object := storage.New()
@@ -147,13 +148,20 @@ func (a *APIInstaller) registerResourceHandlers(path string, storage RESTStorage
 		storageVerbs["Redirector"] = true
 	}
 
+	var ctxFn ContextFunc
 	var namespaceFn ResourceNamespaceFunc
 	var nameFn ResourceNameFunc
 	var generateLinkFn linkFunc
 	var objNameFn ObjectNameFunc
 	linkFn := func(req *restful.Request, obj runtime.Object) error {
 		return setSelfLink(obj, req.Request, a.group.linker, generateLinkFn)
 	}
+	ctxFn = func(req *restful.Request) api.Context {
+		if ctx, ok := context.Get(req.Request); ok {
+			return ctx
+		}
+		return api.NewContext()
+	}
 
 	allowWatchList := storageVerbs["ResourceWatcher"] && storageVerbs["RESTLister"] // watching on lists is allowed only for kinds that support both watch and list.
 	scope := mapping.Scope
@@ -324,39 +332,39 @@ func (a *APIInstaller) registerResourceHandlers(path string, storage RESTStorage
 		m := monitorFilter(action.Verb, resource)
 		switch action.Verb {
 		case "GET": // Get a resource.
-			route := ws.GET(action.Path).To(GetResource(getter, nameFn, linkFn, codec)).
+			route := ws.GET(action.Path).To(GetResource(getter, ctxFn, nameFn, linkFn, codec)).
 				Filter(m).
 				Doc("read the specified " + kind).
 				Operation("read" + kind).
 				Writes(versionedObject)
 			addParams(route, action.Params)
 			ws.Route(route)
 		case "LIST": // List all resources of a kind.
-			route := ws.GET(action.Path).To(ListResource(lister, namespaceFn, linkFn, codec)).
+			route := ws.GET(action.Path).To(ListResource(lister, ctxFn, namespaceFn, linkFn, codec)).
 				Filter(m).
 				Doc("list objects of kind " + kind).
 				Operation("list" + kind).
 				Writes(versionedList)
 			addParams(route, action.Params)
 			ws.Route(route)
 		case "PUT": // Update a resource.
-			route := ws.PUT(action.Path).To(UpdateResource(updater, nameFn, objNameFn, linkFn, codec, resource, admit)).
+			route := ws.PUT(action.Path).To(UpdateResource(updater, ctxFn, nameFn, objNameFn, linkFn, codec, resource, admit)).
 				Filter(m).
 				Doc("update the specified " + kind).
 				Operation("update" + kind).
 				Reads(versionedObject)
 			addParams(route, action.Params)
 			ws.Route(route)
 		case "POST": // Create a resource.
-			route := ws.POST(action.Path).To(CreateResource(creater, namespaceFn, linkFn, codec, resource, admit)).
+			route := ws.POST(action.Path).To(CreateResource(creater, ctxFn, namespaceFn, linkFn, codec, resource, admit)).
 				Filter(m).
 				Doc("create a " + kind).
 				Operation("create" + kind).
 				Reads(versionedObject)
 			addParams(route, action.Params)
 			ws.Route(route)
 		case "DELETE": // Delete a resource.
-			route := ws.DELETE(action.Path).To(DeleteResource(deleter, nameFn, linkFn, codec, resource, kind, admit)).
+			route := ws.DELETE(action.Path).To(DeleteResource(deleter, ctxFn, nameFn, linkFn, codec, resource, kind, admit)).
 				Filter(m).
 				Doc("delete a " + kind).
 				Operation("delete" + kind)

pkg/apiserver/apiserver.go

@@ -98,9 +98,9 @@ type defaultAPIServer struct {
 // as RESTful resources at prefix, serialized by codec, and also includes the support
 // http resources.
 // Note: This method is used only in tests.
-func Handle(storage map[string]RESTStorage, codec runtime.Codec, root string, version string, linker runtime.SelfLinker, admissionControl admission.Interface, mapper meta.RESTMapper) http.Handler {
+func Handle(storage map[string]RESTStorage, codec runtime.Codec, root string, version string, linker runtime.SelfLinker, admissionControl admission.Interface, contextMapper api.RequestContextMapper, mapper meta.RESTMapper) http.Handler {
 	prefix := path.Join(root, version)
-	group := NewAPIGroupVersion(storage, codec, root, prefix, linker, admissionControl, mapper)
+	group := NewAPIGroupVersion(storage, codec, root, prefix, linker, admissionControl, contextMapper, mapper)
 	container := restful.NewContainer()
 	container.Router(restful.CurlyRouter{})
 	mux := container.ServeMux
@@ -121,6 +121,7 @@ type APIGroupVersion struct {
 	prefix  string
 	linker  runtime.SelfLinker
 	admit   admission.Interface
+	context api.RequestContextMapper
 	mapper  meta.RESTMapper
 	// TODO: put me into a cleaner interface
 	info *APIRequestInfoResolver
@@ -131,13 +132,14 @@ type APIGroupVersion struct {
 // This is a helper method for registering multiple sets of REST handlers under different
 // prefixes onto a server.
 // TODO: add multitype codec serialization
-func NewAPIGroupVersion(storage map[string]RESTStorage, codec runtime.Codec, root, prefix string, linker runtime.SelfLinker, admissionControl admission.Interface, mapper meta.RESTMapper) *APIGroupVersion {
+func NewAPIGroupVersion(storage map[string]RESTStorage, codec runtime.Codec, root, prefix string, linker runtime.SelfLinker, admissionControl admission.Interface, contextMapper api.RequestContextMapper, mapper meta.RESTMapper) *APIGroupVersion {
 	return &APIGroupVersion{
 		storage: storage,
 		codec:   codec,
 		prefix:  prefix,
 		linker:  linker,
 		admit:   admissionControl,
+		context: contextMapper,
 		mapper:  mapper,
 		info:    &APIRequestInfoResolver{util.NewStringSet(root), latest.RESTMapper},
 	}