This repository has been archived by the owner on Jul 12, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 84
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Introduce auth provider interface (#902)
This introduces an abstraction between firebase and our system called "AuthProvider". Right now the only auth provider is Firebase, but it could be extended in the future, with the primary use case being automated testing. There's currently no way to configure a different auth provider without writing custom code.
Part of this required using more of the Firebase server APIs. However, I found a way to plumb through the user's auth token and use that (instead of our service account), so rate limiting should be much less restrictive. In my testing, I was only able to get rate limited once and I must have tried a few hundred times over an hour. Immediately trying with a different email succeeded, demonstrating that the limiting is scoped to email (idToken) and not our service account.
The vast majority of the work involved **decoupling our controller logic from firebase** and **decoupling firebase from our smtp implementation**. There are some weird qwirks in the interface (including two places where I decided to accept an `interface{}` and force the type decision onto the implementer for flexibility), but overall I think it's pretty good.
This isn't 100% complete and will need a few tweaks to the interface{}, as we add more testing, but I think it's good to merge and iterate on in its current state.
Some other things wrapped up in the refactor:
- Extract email, email verified, and MFA factors from the session cookie. This saves a few round trip lookups to firebase for both performance and rate limiting purposes.
- Invitations for new system admins can use the system SMTP (if configured) to send invitations.- Loading branch information
Showing
32 changed files
with
1,092 additions
and
698 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
| // Copyright 2020 Google LLC | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| // Package auth exposes interfaces for various auth methods. | ||
| package auth | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "time" | ||
|
|
||
| "github.com/gorilla/sessions" | ||
| ) | ||
|
|
||
| var ( | ||
| ErrSessionMissing = fmt.Errorf("session is missing") | ||
| ) | ||
|
|
||
| // InviteUserEmailFunc sends email with the given inviteLink. | ||
| type InviteUserEmailFunc func(ctx context.Context, inviteLink string) error | ||
|
|
||
| // ResetPasswordEmailFunc is an email composer function. | ||
| type ResetPasswordEmailFunc func(ctx context.Context, resetLink string) error | ||
|
|
||
| // EmailVerificationEmailFunc is an email composer function. | ||
| type EmailVerificationEmailFunc func(ctx context.Context, verifyLink string) error | ||
|
|
||
| // Provider is a generic authentication provider interface. | ||
| type Provider interface { | ||
| // StoreSession stores the session in the values. | ||
| StoreSession(context.Context, *sessions.Session, *SessionInfo) error | ||
|
|
||
| // CheckRevoked checks if the auth has been revoked. It returns an error if | ||
| // the auth does not exist or if the auth has been revoked. | ||
| CheckRevoked(context.Context, *sessions.Session) error | ||
|
|
||
| // ClearSession removes any information about this auth from the session. | ||
| ClearSession(context.Context, *sessions.Session) | ||
|
|
||
| // CreateUser creates a user in the auth provider. If pass is "", the provider | ||
| // creates and uses a random password. | ||
| CreateUser(ctx context.Context, name, email, pass string, composer InviteUserEmailFunc) (bool, error) | ||
|
|
||
| // SendResetPasswordEmail resets the given user's password. If the user does not exist, | ||
| // the underlying provider determines whether itls an error or perhaps upserts | ||
| // the account. | ||
| SendResetPasswordEmail(ctx context.Context, email string, composer ResetPasswordEmailFunc) error | ||
|
|
||
| // ChangePassword changes the users password. The additional authentication | ||
| // information is provider-specific. | ||
| ChangePassword(ctx context.Context, newPassword string, data interface{}) error | ||
|
|
||
| // VerifyPasswordResetCode verifies the code is valid. It returns the email of | ||
| // the user for which the code belongs. | ||
| VerifyPasswordResetCode(ctx context.Context, code string) (string, error) | ||
|
|
||
| // SendEmailVerificationEmail sends the email verification email for the | ||
| // currently authenticated user. Data is arbitrary additional data that the | ||
| // provider might need (like user ID) to send the verification. | ||
| SendEmailVerificationEmail(ctx context.Context, email string, data interface{}, composer EmailVerificationEmailFunc) error | ||
|
|
||
| // EmailAddress extracts the email address for this auth provider from the | ||
| // session. It returns an error if the session does not exist. | ||
| EmailAddress(context.Context, *sessions.Session) (string, error) | ||
|
|
||
| // EmailVerified returns true if the current user is verified, false | ||
| // otherwise. | ||
| EmailVerified(context.Context, *sessions.Session) (bool, error) | ||
|
|
||
| // MFAEnabled returns true if MFA is enabled, false otherwise. | ||
| MFAEnabled(context.Context, *sessions.Session) (bool, error) | ||
| } | ||
|
|
||
| // SessionInfo is a generic struct used to store session information. Not all | ||
| // providers use all fields. | ||
| type SessionInfo struct { | ||
| // IDToken is a unique string or ID. It is usually a JWT token. | ||
| IDToken string | ||
|
|
||
| // TTL is the session duration. | ||
| TTL time.Duration | ||
| } |
Oops, something went wrong.