| OLD | NEW |
| 1 // Copyright 2015 The LUCI Authors. All rights reserved. | 1 // Copyright 2015 The LUCI Authors. All rights reserved. |
| 2 // Use of this source code is governed under the Apache License, Version 2.0 | 2 // Use of this source code is governed under the Apache License, Version 2.0 |
| 3 // that can be found in the LICENSE file. | 3 // that can be found in the LICENSE file. |
| 4 | 4 |
| 5 // Package auth implements a wrapper around golang.org/x/oauth2. | 5 // Package auth implements a wrapper around golang.org/x/oauth2. |
| 6 // | 6 // |
| 7 // Its main improvement is the on-disk cache for OAuth tokens, which is | 7 // Its main improvement is the on-disk cache for OAuth tokens, which is |
| 8 // especially important for 3-legged interactive OAuth flows: its usage | 8 // especially important for 3-legged interactive OAuth flows: its usage |
| 9 // eliminates annoying login prompts each time a program is used (because the | 9 // eliminates annoying login prompts each time a program is used (because the |
| 10 // refresh token can now be reused). The cache also allows to reduce unnecessary | 10 // refresh token can now be reused). The cache also allows to reduce unnecessary |
| (...skipping 23 matching lines...) Expand all Loading... |
| 34 "golang.org/x/net/context" | 34 "golang.org/x/net/context" |
| 35 "golang.org/x/oauth2" | 35 "golang.org/x/oauth2" |
| 36 "google.golang.org/grpc/credentials" | 36 "google.golang.org/grpc/credentials" |
| 37 | 37 |
| 38 "github.com/luci/luci-go/common/auth/internal" | 38 "github.com/luci/luci-go/common/auth/internal" |
| 39 "github.com/luci/luci-go/common/clock" | 39 "github.com/luci/luci-go/common/clock" |
| 40 "github.com/luci/luci-go/common/errors" | 40 "github.com/luci/luci-go/common/errors" |
| 41 "github.com/luci/luci-go/common/gcloud/iam" | 41 "github.com/luci/luci-go/common/gcloud/iam" |
| 42 "github.com/luci/luci-go/common/logging" | 42 "github.com/luci/luci-go/common/logging" |
| 43 "github.com/luci/luci-go/common/retry" | 43 "github.com/luci/luci-go/common/retry" |
| 44 "github.com/luci/luci-go/common/retry/transient" |
| 44 "github.com/luci/luci-go/lucictx" | 45 "github.com/luci/luci-go/lucictx" |
| 45 ) | 46 ) |
| 46 | 47 |
| 47 var ( | 48 var ( |
| 48 // ErrLoginRequired is returned by Transport() in case long term credent
ials | 49 // ErrLoginRequired is returned by Transport() in case long term credent
ials |
| 49 // are not cached and the user must go through interactive login. | 50 // are not cached and the user must go through interactive login. |
| 50 ErrLoginRequired = errors.New("interactive login is required") | 51 ErrLoginRequired = errors.New("interactive login is required") |
| 51 | 52 |
| 52 // ErrInsufficientAccess is returned by Login() or Transport() if access
_token | 53 // ErrInsufficientAccess is returned by Login() or Transport() if access
_token |
| 53 // can't be minted for given OAuth scopes. For example if GCE instance w
asn't | 54 // can't be minted for given OAuth scopes. For example if GCE instance w
asn't |
| (...skipping 1134 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1188 Retries: 50, | 1189 Retries: 50, |
| 1189 MaxTotal: 5 * time.Second, | 1190 MaxTotal: 5 * time.Second, |
| 1190 }, | 1191 }, |
| 1191 Multiplier: 2, | 1192 Multiplier: 2, |
| 1192 } | 1193 } |
| 1193 } | 1194 } |
| 1194 | 1195 |
| 1195 // mintTokenWithRetries calls provider's MintToken() retrying on transient | 1196 // mintTokenWithRetries calls provider's MintToken() retrying on transient |
| 1196 // errors a bunch of times. Called only for non-interactive providers. | 1197 // errors a bunch of times. Called only for non-interactive providers. |
| 1197 func (t *tokenWithProvider) mintTokenWithRetries(ctx context.Context, base *oaut
h2.Token) (tok *oauth2.Token, err error) { | 1198 func (t *tokenWithProvider) mintTokenWithRetries(ctx context.Context, base *oaut
h2.Token) (tok *oauth2.Token, err error) { |
| 1198 » err = retry.Retry(ctx, retry.TransientOnly(retryParams), func() error { | 1199 » err = retry.Retry(ctx, transient.Only(retryParams), func() error { |
| 1199 tok, err = t.provider.MintToken(ctx, base) | 1200 tok, err = t.provider.MintToken(ctx, base) |
| 1200 return err | 1201 return err |
| 1201 }, nil) | 1202 }, nil) |
| 1202 return | 1203 return |
| 1203 } | 1204 } |
| 1204 | 1205 |
| 1205 // refreshTokenWithRetries calls providers' RefreshToken(...) retrying on | 1206 // refreshTokenWithRetries calls providers' RefreshToken(...) retrying on |
| 1206 // transient errors a bunch of times. | 1207 // transient errors a bunch of times. |
| 1207 func (t *tokenWithProvider) refreshTokenWithRetries(ctx context.Context, prev, b
ase *oauth2.Token) (tok *oauth2.Token, err error) { | 1208 func (t *tokenWithProvider) refreshTokenWithRetries(ctx context.Context, prev, b
ase *oauth2.Token) (tok *oauth2.Token, err error) { |
| 1208 » err = retry.Retry(ctx, retry.TransientOnly(retryParams), func() error { | 1209 » err = retry.Retry(ctx, transient.Only(retryParams), func() error { |
| 1209 tok, err = t.provider.RefreshToken(ctx, prev, base) | 1210 tok, err = t.provider.RefreshToken(ctx, prev, base) |
| 1210 return err | 1211 return err |
| 1211 }, nil) | 1212 }, nil) |
| 1212 return | 1213 return |
| 1213 } | 1214 } |
| 1214 | 1215 |
| 1215 //////////////////////////////////////////////////////////////////////////////// | 1216 //////////////////////////////////////////////////////////////////////////////// |
| 1216 // Utility functions. | 1217 // Utility functions. |
| 1217 | 1218 |
| 1218 // makeBaseTokenProvider creates TokenProvider implementation based on options. | 1219 // makeBaseTokenProvider creates TokenProvider implementation based on options. |
| (...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1262 func makeIAMTokenProvider(ctx context.Context, opts *Options) (internal.TokenPro
vider, error) { | 1263 func makeIAMTokenProvider(ctx context.Context, opts *Options) (internal.TokenPro
vider, error) { |
| 1263 if opts.testingIAMTokenProvider != nil { | 1264 if opts.testingIAMTokenProvider != nil { |
| 1264 return opts.testingIAMTokenProvider, nil | 1265 return opts.testingIAMTokenProvider, nil |
| 1265 } | 1266 } |
| 1266 return internal.NewIAMTokenProvider( | 1267 return internal.NewIAMTokenProvider( |
| 1267 ctx, | 1268 ctx, |
| 1268 opts.ActAsServiceAccount, | 1269 opts.ActAsServiceAccount, |
| 1269 opts.Scopes, | 1270 opts.Scopes, |
| 1270 opts.Transport) | 1271 opts.Transport) |
| 1271 } | 1272 } |
| OLD | NEW |