paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 34 Packages Projects Releases Wiki Activity

create an interface for gh creds provider

Browse Source 
We plan to build on this later to allow the credentials provider to
be passed into the scaffolder tasks, the processors, and the url
readers.

Signed-off-by: Brian Fletcher <brian@roadie.io>
This commit is contained in:
Brian Fletcher
2021-12-17 11:25:01 +00:00
parent 3e79c4bc58
commit 7228b18c0f
14 changed files with 334 additions and 282 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/integration/api-report.md
+12 -2
View File
@@ -92,6 +92,17 @@ export type BitbucketIntegrationConfig = {
appPassword?: string;
};
// @public
export class DefaultGithubCredentialsProvider
implements GithubCredentialsProvider
{
// (undocumented)
static create(
config: GitHubIntegrationConfig,
): DefaultGithubCredentialsProvider;
getCredentials(opts: { url: string }): Promise<GithubCredentials>;
}
// @public
export function defaultScmResolveUrl(options: {
url: string;
@@ -198,9 +209,8 @@ export type GithubCredentials = {
};
// @public
export class GithubCredentialsProvider {
export interface GithubCredentialsProvider {
// (undocumented)
static create(config: GitHubIntegrationConfig): GithubCredentialsProvider;
getCredentials(opts: { url: string }): Promise<GithubCredentials>;
}
packages/integration/src/github/GithubCredentialsProvider.test.ts → packages/integration/src/github/DefaultGithubCredentialsProvider.test.ts
+6 -6
View File
@@ -31,11 +31,11 @@ jest.doMock('@octokit/rest', () => {
return { Octokit };
});
import { GithubCredentialsProvider } from './GithubCredentialsProvider';
import { DefaultGithubCredentialsProvider } from './DefaultGithubCredentialsProvider';
import { RestEndpointMethodTypes } from '@octokit/rest';
import { DateTime } from 'luxon';
const github = GithubCredentialsProvider.create({
const github = DefaultGithubCredentialsProvider.create({
host: 'github.com',
apps: [
{
@@ -49,7 +49,7 @@ const github = GithubCredentialsProvider.create({
token: 'hardcoded_token',
});
describe('GithubCredentialsProvider tests', () => {
describe('DefaultGithubCredentialsProvider tests', () => {
beforeEach(() => {
jest.resetAllMocks();
});
@@ -204,7 +204,7 @@ describe('GithubCredentialsProvider tests', () => {
});
it('should return the default token if no app is configured', async () => {
const githubProvider = GithubCredentialsProvider.create({
const githubProvider = DefaultGithubCredentialsProvider.create({
host: 'github.com',
apps: [],
token: 'fallback_token',
@@ -218,7 +218,7 @@ describe('GithubCredentialsProvider tests', () => {
});
it('should return the configured token if there are no installations', async () => {
const githubProvider = GithubCredentialsProvider.create({
const githubProvider = DefaultGithubCredentialsProvider.create({
host: 'github.com',
apps: [
{
@@ -243,7 +243,7 @@ describe('GithubCredentialsProvider tests', () => {
});
it('should return undefined if no token or apps are configured', async () => {
const githubProvider = GithubCredentialsProvider.create({
const githubProvider = DefaultGithubCredentialsProvider.create({
host: 'github.com',
});
packages/integration/src/github/DefaultGithubCredentialsProvider.ts
+287
View File
@@ -0,0 +1,287 @@
/*
* Copyright 2021 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import parseGitUrl from 'git-url-parse';
import { GithubAppConfig, GitHubIntegrationConfig } from './config';
import { createAppAuth } from '@octokit/auth-app';
import { Octokit, RestEndpointMethodTypes } from '@octokit/rest';
import { DateTime } from 'luxon';
import {
GithubCredentials,
GithubCredentialsProvider,
GithubCredentialType,
} from './GithubCredentialsProvider';
type InstallationData = {
installationId: number;
suspended: boolean;
};
class Cache {
private readonly tokenCache = new Map<
string,
{ token: string; expiresAt: DateTime }
>();
async getOrCreateToken(
key: string,
supplier: () => Promise<{ token: string; expiresAt: DateTime }>,
): Promise<{ accessToken: string }> {
const item = this.tokenCache.get(key);
if (item && this.isNotExpired(item.expiresAt)) {
return { accessToken: item.token };
}
const result = await supplier();
this.tokenCache.set(key, result);
return { accessToken: result.token };
}
// consider timestamps older than 50 minutes to be expired.
private isNotExpired = (date: DateTime) =>
date.diff(DateTime.local(), 'minutes').minutes > 50;
}
/**
* This accept header is required when calling App APIs in GitHub Enterprise.
* It has no effect on calls to github.com and can probably be removed entirely
* once GitHub Apps is out of preview.
*/
const HEADERS = {
Accept: 'application/vnd.github.machine-man-preview+json',
};
/**
* GithubAppManager issues and caches tokens for a specific GitHub App.
*/
class GithubAppManager {
private readonly appClient: Octokit;
private readonly baseUrl?: string;
private readonly baseAuthConfig: { appId: number; privateKey: string };
private readonly cache = new Cache();
private readonly allowedInstallationOwners: string[] | undefined; // undefined allows all installations
constructor(config: GithubAppConfig, baseUrl?: string) {
this.allowedInstallationOwners = config.allowedInstallationOwners;
this.baseUrl = baseUrl;
this.baseAuthConfig = {
appId: config.appId,
privateKey: config.privateKey.replace(/\\n/gm, '\n'),
};
this.appClient = new Octokit({
baseUrl,
headers: HEADERS,
authStrategy: createAppAuth,
auth: this.baseAuthConfig,
});
}
async getInstallationCredentials(
owner: string,
repo?: string,
): Promise<{ accessToken: string }> {
const { installationId, suspended } = await this.getInstallationData(owner);
if (this.allowedInstallationOwners) {
if (!this.allowedInstallationOwners?.includes(owner)) {
throw new Error(
`The GitHub application for ${owner} is not included in the allowed installation list (${installationId}).`,
);
}
}
if (suspended) {
throw new Error(`The GitHub application for ${owner} is suspended`);
}
const cacheKey = repo ? `${owner}/${repo}` : owner;
// Go and grab an access token for the app scoped to a repository if provided, if not use the organisation installation.
return this.cache.getOrCreateToken(cacheKey, async () => {
const result = await this.appClient.apps.createInstallationAccessToken({
installation_id: installationId,
headers: HEADERS,
});
if (repo && result.data.repository_selection === 'selected') {
const installationClient = new Octokit({
baseUrl: this.baseUrl,
auth: result.data.token,
});
const repos = await installationClient.paginate(
installationClient.apps.listReposAccessibleToInstallation,
);
const hasRepo = repos.some(repository => {
return repository.name === repo;
});
if (!hasRepo) {
throw new Error(
`The Backstage GitHub application used in the ${owner} organization does not have access to a repository with the name ${repo}`,
);
}
}
return {
token: result.data.token,
expiresAt: DateTime.fromISO(result.data.expires_at),
};
});
}
getInstallations(): Promise<
RestEndpointMethodTypes['apps']['listInstallations']['response']['data']
> {
return this.appClient.paginate(this.appClient.apps.listInstallations);
}
private async getInstallationData(owner: string): Promise<InstallationData> {
const allInstallations = await this.getInstallations();
const installation = allInstallations.find(
inst =>
inst.account?.login?.toLocaleLowerCase('en-US') ===
owner.toLocaleLowerCase('en-US'),
);
if (installation) {
return {
installationId: installation.id,
suspended: Boolean(installation.suspended_by),
};
}
const notFoundError = new Error(
`No app installation found for ${owner} in ${this.baseAuthConfig.appId}`,
);
notFoundError.name = 'NotFoundError';
throw notFoundError;
}
}
/**
* Corresponds to a Github installation which internally could hold several GitHub Apps.
*
* @public
*/
export class GithubAppCredentialsMux {
private readonly apps: GithubAppManager[];
constructor(config: GitHubIntegrationConfig) {
this.apps =
config.apps?.map(ac => new GithubAppManager(ac, config.apiBaseUrl)) ?? [];
}
async getAllInstallations(): Promise<
RestEndpointMethodTypes['apps']['listInstallations']['response']['data']
> {
if (!this.apps.length) {
return [];
}
const installs = await Promise.all(
this.apps.map(app => app.getInstallations()),
);
return installs.flat();
}
async getAppToken(owner: string, repo?: string): Promise<string | undefined> {
if (this.apps.length === 0) {
return undefined;
}
const results = await Promise.all(
this.apps.map(app =>
app.getInstallationCredentials(owner, repo).then(
credentials => ({ credentials, error: undefined }),
error => ({ credentials: undefined, error }),
),
),
);
const result = results.find(resultItem => resultItem.credentials);
if (result) {
return result.credentials!.accessToken;
}
const errors = results.map(r => r.error);
const notNotFoundError = errors.find(err => err.name !== 'NotFoundError');
if (notNotFoundError) {
throw notNotFoundError;
}
return undefined;
}
}
/**
* Handles the creation and caching of credentials for GitHub integrations.
*
* @public
* @remarks
*
* TODO: Possibly move this to a backend only package so that it's not used in the frontend by mistake
*/
export class DefaultGithubCredentialsProvider
implements GithubCredentialsProvider
{
static create(
config: GitHubIntegrationConfig,
): DefaultGithubCredentialsProvider {
return new DefaultGithubCredentialsProvider(
new GithubAppCredentialsMux(config),
config.token,
);
}
private constructor(
private readonly githubAppCredentialsMux: GithubAppCredentialsMux,
private readonly token?: string,
) {}
/**
* Returns {@link GithubCredentials} for a given URL.
*
* @remarks
*
* Consecutive calls to this method with the same URL will return cached
* credentials.
*
* The shortest lifetime for a token returned is 10 minutes.
*
* @example
* ```ts
* const { token, headers } = await getCredentials({
* url: 'github.com/backstage/foobar'
* })
* ```
*
* @param opts - The organization or repository URL
* @returns A promise of {@link GithubCredentials}.
*/
async getCredentials(opts: { url: string }): Promise<GithubCredentials> {
const parsed = parseGitUrl(opts.url);
const owner = parsed.owner || parsed.name;
const repo = parsed.owner ? parsed.name : undefined;
let type: GithubCredentialType = 'app';
let token = await this.githubAppCredentialsMux.getAppToken(owner, repo);
if (!token) {
type = 'token';
token = this.token;
}
return {
headers: token ? { Authorization: `Bearer ${token}` } : undefined,
token,
type,
};
}
}
packages/integration/src/github/GithubCredentialsProvider.ts
+3 -256
View File
@@ -14,207 +14,6 @@
* limitations under the License.
*/
import parseGitUrl from 'git-url-parse';
import { GithubAppConfig, GitHubIntegrationConfig } from './config';
import { createAppAuth } from '@octokit/auth-app';
import { Octokit, RestEndpointMethodTypes } from '@octokit/rest';
import { DateTime } from 'luxon';
type InstallationData = {
installationId: number;
suspended: boolean;
};
class Cache {
private readonly tokenCache = new Map<
string,
{ token: string; expiresAt: DateTime }
>();
async getOrCreateToken(
key: string,
supplier: () => Promise<{ token: string; expiresAt: DateTime }>,
): Promise<{ accessToken: string }> {
const item = this.tokenCache.get(key);
if (item && this.isNotExpired(item.expiresAt)) {
return { accessToken: item.token };
}
const result = await supplier();
this.tokenCache.set(key, result);
return { accessToken: result.token };
}
// consider timestamps older than 50 minutes to be expired.
private isNotExpired = (date: DateTime) =>
date.diff(DateTime.local(), 'minutes').minutes > 50;
}
/**
* This accept header is required when calling App APIs in GitHub Enterprise.
* It has no effect on calls to github.com and can probably be removed entirely
* once GitHub Apps is out of preview.
*/
const HEADERS = {
Accept: 'application/vnd.github.machine-man-preview+json',
};
/**
* GithubAppManager issues and caches tokens for a specific GitHub App.
*/
class GithubAppManager {
private readonly appClient: Octokit;
private readonly baseUrl?: string;
private readonly baseAuthConfig: { appId: number; privateKey: string };
private readonly cache = new Cache();
private readonly allowedInstallationOwners: string[] | undefined; // undefined allows all installations
constructor(config: GithubAppConfig, baseUrl?: string) {
this.allowedInstallationOwners = config.allowedInstallationOwners;
this.baseUrl = baseUrl;
this.baseAuthConfig = {
appId: config.appId,
privateKey: config.privateKey.replace(/\\n/gm, '\n'),
};
this.appClient = new Octokit({
baseUrl,
headers: HEADERS,
authStrategy: createAppAuth,
auth: this.baseAuthConfig,
});
}
async getInstallationCredentials(
owner: string,
repo?: string,
): Promise<{ accessToken: string }> {
const { installationId, suspended } = await this.getInstallationData(owner);
if (this.allowedInstallationOwners) {
if (!this.allowedInstallationOwners?.includes(owner)) {
throw new Error(
`The GitHub application for ${owner} is not included in the allowed installation list (${installationId}).`,
);
}
}
if (suspended) {
throw new Error(`The GitHub application for ${owner} is suspended`);
}
const cacheKey = repo ? `${owner}/${repo}` : owner;
// Go and grab an access token for the app scoped to a repository if provided, if not use the organisation installation.
return this.cache.getOrCreateToken(cacheKey, async () => {
const result = await this.appClient.apps.createInstallationAccessToken({
installation_id: installationId,
headers: HEADERS,
});
if (repo && result.data.repository_selection === 'selected') {
const installationClient = new Octokit({
baseUrl: this.baseUrl,
auth: result.data.token,
});
const repos = await installationClient.paginate(
installationClient.apps.listReposAccessibleToInstallation,
);
const hasRepo = repos.some(repository => {
return repository.name === repo;
});
if (!hasRepo) {
throw new Error(
`The Backstage GitHub application used in the ${owner} organization does not have access to a repository with the name ${repo}`,
);
}
}
return {
token: result.data.token,
expiresAt: DateTime.fromISO(result.data.expires_at),
};
});
}
getInstallations(): Promise<
RestEndpointMethodTypes['apps']['listInstallations']['response']['data']
> {
return this.appClient.paginate(this.appClient.apps.listInstallations);
}
private async getInstallationData(owner: string): Promise<InstallationData> {
const allInstallations = await this.getInstallations();
const installation = allInstallations.find(
inst =>
inst.account?.login?.toLocaleLowerCase('en-US') ===
owner.toLocaleLowerCase('en-US'),
);
if (installation) {
return {
installationId: installation.id,
suspended: Boolean(installation.suspended_by),
};
}
const notFoundError = new Error(
`No app installation found for ${owner} in ${this.baseAuthConfig.appId}`,
);
notFoundError.name = 'NotFoundError';
throw notFoundError;
}
}
/**
* Corresponds to a Github installation which internally could hold several GitHub Apps.
*
* @public
*/
export class GithubAppCredentialsMux {
private readonly apps: GithubAppManager[];
constructor(config: GitHubIntegrationConfig) {
this.apps =
config.apps?.map(ac => new GithubAppManager(ac, config.apiBaseUrl)) ?? [];
}
async getAllInstallations(): Promise<
RestEndpointMethodTypes['apps']['listInstallations']['response']['data']
> {
if (!this.apps.length) {
return [];
}
const installs = await Promise.all(
this.apps.map(app => app.getInstallations()),
);
return installs.flat();
}
async getAppToken(owner: string, repo?: string): Promise<string | undefined> {
if (this.apps.length === 0) {
return undefined;
}
const results = await Promise.all(
this.apps.map(app =>
app.getInstallationCredentials(owner, repo).then(
credentials => ({ credentials, error: undefined }),
error => ({ credentials: undefined, error }),
),
),
);
const result = results.find(resultItem => resultItem.credentials);
if (result) {
return result.credentials!.accessToken;
}
const errors = results.map(r => r.error);
const notNotFoundError = errors.find(err => err.name !== 'NotFoundError');
if (notNotFoundError) {
throw notNotFoundError;
}
return undefined;
}
}
/**
* The type of credentials produced by the credential provider.
*
@@ -234,63 +33,11 @@ export type GithubCredentials = {
};
/**
* Handles the creation and caching of credentials for GitHub integrations.
* This allows implementations to be provided to retrieve GitHub credentials.
*
* @public
* @remarks
*
* TODO: Possibly move this to a backend only package so that it's not used in the frontend by mistake
*/
export class GithubCredentialsProvider {
static create(config: GitHubIntegrationConfig): GithubCredentialsProvider {
return new GithubCredentialsProvider(
new GithubAppCredentialsMux(config),
config.token,
);
}
private constructor(
private readonly githubAppCredentialsMux: GithubAppCredentialsMux,
private readonly token?: string,
) {}
/**
* Returns {@link GithubCredentials} for a given URL.
*
* @remarks
*
* Consecutive calls to this method with the same URL will return cached
* credentials.
*
* The shortest lifetime for a token returned is 10 minutes.
*
* @example
* ```ts
* const { token, headers } = await getCredentials({
* url: 'github.com/backstage/foobar'
* })
* ```
*
* @param opts - The organization or repository URL
* @returns A promise of {@link GithubCredentials}.
*/
async getCredentials(opts: { url: string }): Promise<GithubCredentials> {
const parsed = parseGitUrl(opts.url);
const owner = parsed.owner || parsed.name;
const repo = parsed.owner ? parsed.name : undefined;
let type: GithubCredentialType = 'app';
let token = await this.githubAppCredentialsMux.getAppToken(owner, repo);
if (!token) {
type = 'token';
token = this.token;
}
return {
headers: token ? { Authorization: `Bearer ${token}` } : undefined,
token,
type,
};
}
export interface GithubCredentialsProvider {
getCredentials(opts: { url: string }): Promise<GithubCredentials>;
}
packages/integration/src/github/index.ts
+3 -2
View File
@@ -22,10 +22,11 @@ export type { GithubAppConfig, GitHubIntegrationConfig } from './config';
export { getGitHubFileFetchUrl, getGitHubRequestOptions } from './core';
export {
GithubAppCredentialsMux,
GithubCredentialsProvider,
} from './GithubCredentialsProvider';
DefaultGithubCredentialsProvider,
} from './DefaultGithubCredentialsProvider';
export type {
GithubCredentials,
GithubCredentialsProvider,
GithubCredentialType,
} from './GithubCredentialsProvider';
export { GitHubIntegration, replaceGitHubUrlType } from './GitHubIntegration';