mirror of
https://github.com/coder/coder.git
synced 2026-06-04 13:38:21 +00:00
Spike Curtis
bddb808b25
Fixes all our Go file imports to match the preferred spec that we've _mostly_ been using. For example: ``` import ( "context" "time" "github.com/prometheus/client_golang/prometheus" "golang.org/x/xerrors" "gopkg.in/natefinch/lumberjack.v2" "cdr.dev/slog/v3" "github.com/coder/coder/v2/codersdk/agentsdk" "github.com/coder/serpent" ) ``` 3 groups: standard library, 3rd partly libs, Coder libs. This PR makes the change across the codebase. The PR in the stack above modifies our formatting to maintain this state of affairs, and is a separate PR so it's possible to review that one in detail.
62 lines
1.9 KiB
Go
62 lines
1.9 KiB
Go
package wsproxy
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/url"
|
|
|
|
"cdr.dev/slog/v3"
|
|
"github.com/coder/coder/v2/coderd/cryptokeys"
|
|
"github.com/coder/coder/v2/coderd/jwtutils"
|
|
"github.com/coder/coder/v2/coderd/workspaceapps"
|
|
"github.com/coder/coder/v2/enterprise/wsproxy/wsproxysdk"
|
|
)
|
|
|
|
var _ workspaceapps.SignedTokenProvider = (*TokenProvider)(nil)
|
|
|
|
type TokenProvider struct {
|
|
DashboardURL *url.URL
|
|
AccessURL *url.URL
|
|
AppHostname string
|
|
|
|
Client *wsproxysdk.Client
|
|
TokenSigningKeycache cryptokeys.SigningKeycache
|
|
APIKeyEncryptionKeycache cryptokeys.EncryptionKeycache
|
|
Logger slog.Logger
|
|
}
|
|
|
|
func (p *TokenProvider) FromRequest(r *http.Request) (*workspaceapps.SignedToken, bool) {
|
|
return workspaceapps.FromRequest(r, p.TokenSigningKeycache)
|
|
}
|
|
|
|
func (p *TokenProvider) Issue(ctx context.Context, rw http.ResponseWriter, r *http.Request, issueReq workspaceapps.IssueTokenRequest) (*workspaceapps.SignedToken, string, bool) {
|
|
appReq := issueReq.AppRequest.Normalize()
|
|
err := appReq.Check()
|
|
if err != nil {
|
|
workspaceapps.WriteWorkspaceApp500(p.Logger, p.DashboardURL, rw, r, &appReq, err, "invalid app request")
|
|
return nil, "", false
|
|
}
|
|
issueReq.AppRequest = appReq
|
|
|
|
resp, ok := p.Client.IssueSignedAppTokenHTML(ctx, rw, issueReq, r.RemoteAddr)
|
|
if !ok {
|
|
return nil, "", false
|
|
}
|
|
|
|
// Check that it verifies properly and matches the string.
|
|
var token workspaceapps.SignedToken
|
|
err = jwtutils.Verify(ctx, p.TokenSigningKeycache, resp.SignedTokenStr, &token)
|
|
if err != nil {
|
|
workspaceapps.WriteWorkspaceApp500(p.Logger, p.DashboardURL, rw, r, &appReq, err, "failed to verify newly generated signed token")
|
|
return nil, "", false
|
|
}
|
|
|
|
// Check that it matches the request.
|
|
if !token.MatchesRequest(appReq) {
|
|
workspaceapps.WriteWorkspaceApp500(p.Logger, p.DashboardURL, rw, r, &appReq, err, "newly generated signed token does not match request")
|
|
return nil, "", false
|
|
}
|
|
|
|
return &token, resp.SignedTokenStr, true
|
|
}
|