server/auth: Add TokenSource call.

server/auth/client.go

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package auth
 
 import (
         "fmt"
         "net/http"
         "strings"
         "time"
 
         "golang.org/x/net/context"
+        "golang.org/x/oauth2"
         "google.golang.org/grpc/credentials"
 
         "github.com/luci/luci-go/common/auth"
         "github.com/luci/luci-go/server/auth/delegation"
         "github.com/luci/luci-go/server/auth/identity"
         "github.com/luci/luci-go/server/auth/internal"
 )
 
 // RPCAuthorityKind defines under whose authority RPCs are made.
 type RPCAuthorityKind int
@@ skipping 71 matching lines @@
 // requests.
 //
 // Usage:
 //    tr, err := auth.GetRPCTransport(c, auth.AsSelf, auth.WithScopes("..."))
 //    if err != nil {
 //      return err
 //    }
 //    client := &http.Client{Transport: tr}
 //    ...
 func GetRPCTransport(c context.Context, kind RPCAuthorityKind, opts ...RPCOption) (http.RoundTripper, error) {
-        options, err := makeRpcOptions(kind, opts)
+        options, err := makeRPCOptions(kind, opts)
         if err != nil {
                 return nil, err
         }
         config := GetConfig(c)
         if config == nil || config.AnonymousTransport == nil {
                 return nil, ErrNotConfigured
         }
         baseTransport := config.AnonymousTransport(c)
         if options.kind == NoAuth {
                 return baseTransport, nil
         }
         return auth.NewModifyingTransport(baseTransport, func(req *http.Request) error {
                 headers, err := options.getRPCHeaders(c, req.URL.String(), options)
                 if err != nil {
                         return err
                 }
                 for k, v := range headers {
                         req.Header.Set(k, v)
                 }
                 return nil
         }), nil
 }
 
 // GetPerRPCCredentials returns gRPC's PerRPCCredentials implementation.
 //
 // It can be used to authenticate outbound gPRC RPC's.
 func GetPerRPCCredentials(kind RPCAuthorityKind, opts ...RPCOption) (credentials.PerRPCCredentials, error) {
-        options, err := makeRpcOptions(kind, opts)
+        options, err := makeRPCOptions(kind, opts)
         if err != nil {
                 return nil, err
         }
         return perRPCCreds{options}, nil
 }
 
 type perRPCCreds struct {
         options *rpcOptions
 }
 
 func (creds perRPCCreds) GetRequestMetadata(c context.Context, uri ...string) (map[string]string, error) {
         if len(uri) == 0 {
                 panic("perRPCCreds: no URI given")
         }
         return creds.options.getRPCHeaders(c, uri[0], creds.options)
 }
 
 func (creds perRPCCreds) RequireTransportSecurity() bool {
         return true
 }
 
+// GetTokenSourceAsSelf returns an oauth2.TokenSource bound to the supplied
+// Context that returns tokens for AsSelf authentication.
+//
+// If no scopes are provided, auth.OAuthScopeEmail will be used.
+//
+// While GetPerRPCCredentials is preferred, this can be used by packages that
+// cannot or do not properly handle this gRPC option.
+func GetTokenSourceAsSelf(c context.Context, scopes ...string) oauth2.TokenSource {
+        if len(scopes) == 0 {
+                scopes = []string{auth.OAuthScopeEmail}
+        }
+        return &tokenSource{c, scopes}
+}
+
+type tokenSource struct {
+        context.Context
+        scopes []string
+}
+
+func (ts *tokenSource) Token() (*oauth2.Token, error) {
+        cfg := GetConfig(ts)
+        if cfg == nil || cfg.AccessTokenProvider == nil {
+                return nil, ErrNotConfigured
+        }
+
+        tok, err := cfg.AccessTokenProvider(ts, ts.scopes)
+        if err != nil {
+                return nil, err
+        }
+        return tok.OAuth2Token(), nil
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // Internal stuff.
 
 func init() {
         // This is needed to allow packages imported by 'server/auth' to make
         // authenticated calls. They can't use GetRPCTransport directly, since they
         // can't import 'server/auth' (it creates an import cycle).
         internal.RegisterClientFactory(func(c context.Context, scopes []string) (*http.Client, error) {
                 var t http.RoundTripper
                 var err error
@@ skipping 24 matching lines @@
 type headersGetter func(c context.Context, uri string, opts *rpcOptions) (map[string]string, error)
 
 type rpcOptions struct {
         kind            RPCAuthorityKind
         scopes          []string
         delegationToken string
         getRPCHeaders   headersGetter
         rpcMocks        *rpcMocks
 }
 
-// makeRpcOptions applies all options and validates them.
-func makeRpcOptions(kind RPCAuthorityKind, opts []RPCOption) (*rpcOptions, error) {
+// makeRPCOptions applies all options and validates them.
+func makeRPCOptions(kind RPCAuthorityKind, opts []RPCOption) (*rpcOptions, error) {
         options := &rpcOptions{kind: kind}
         for _, o := range opts {
                 o.apply(options)
         }
         // Validate options.
         switch {
         case options.kind == AsSelf && len(options.scopes) == 0:
                 options.scopes = defaultOAuthScopes
         case options.kind != AsSelf && len(options.scopes) != 0:
                 return nil, fmt.Errorf("auth: WithScopes can only be used with AsSelf authorization kind")
@@ skipping 88 matching lines @@
         // Use our own OAuth token too, since the delegation token is bound to us.
         oauthTok, err := cfg.AccessTokenProvider(c, []string{auth.OAuthScopeEmail})
         if err != nil {
                 return nil, err
         }
         return map[string]string{
                 "Authorization":           oauthTok.TokenType + " " + oauthTok.AccessToken,
                 delegation.HTTPHeaderName: delegationToken,
         }, nil
 }