OLD | NEW |
1 // Copyright 2015 The LUCI Authors. All rights reserved. | 1 // Copyright 2015 The LUCI Authors. All rights reserved. |
2 // Use of this source code is governed under the Apache License, Version 2.0 | 2 // Use of this source code is governed under the Apache License, Version 2.0 |
3 // that can be found in the LICENSE file. | 3 // that can be found in the LICENSE file. |
4 | 4 |
5 // Package auth implements a wrapper around golang.org/x/oauth2. | 5 // Package auth implements a wrapper around golang.org/x/oauth2. |
6 // | 6 // |
7 // Its main improvement is the on-disk cache for OAuth tokens, which is | 7 // Its main improvement is the on-disk cache for OAuth tokens, which is |
8 // especially important for 3-legged interactive OAuth flows: its usage | 8 // especially important for 3-legged interactive OAuth flows: its usage |
9 // eliminates annoying login prompts each time a program is used (because the | 9 // eliminates annoying login prompts each time a program is used (because the |
10 // refresh token can now be reused). The cache also allows to reduce unnecessary | 10 // refresh token can now be reused). The cache also allows to reduce unnecessary |
(...skipping 23 matching lines...) Expand all Loading... |
34 "golang.org/x/net/context" | 34 "golang.org/x/net/context" |
35 "golang.org/x/oauth2" | 35 "golang.org/x/oauth2" |
36 "google.golang.org/grpc/credentials" | 36 "google.golang.org/grpc/credentials" |
37 | 37 |
38 "github.com/luci/luci-go/common/auth/internal" | 38 "github.com/luci/luci-go/common/auth/internal" |
39 "github.com/luci/luci-go/common/clock" | 39 "github.com/luci/luci-go/common/clock" |
40 "github.com/luci/luci-go/common/errors" | 40 "github.com/luci/luci-go/common/errors" |
41 "github.com/luci/luci-go/common/gcloud/iam" | 41 "github.com/luci/luci-go/common/gcloud/iam" |
42 "github.com/luci/luci-go/common/logging" | 42 "github.com/luci/luci-go/common/logging" |
43 "github.com/luci/luci-go/common/retry" | 43 "github.com/luci/luci-go/common/retry" |
| 44 "github.com/luci/luci-go/common/retry/transient" |
44 "github.com/luci/luci-go/lucictx" | 45 "github.com/luci/luci-go/lucictx" |
45 ) | 46 ) |
46 | 47 |
47 var ( | 48 var ( |
48 // ErrLoginRequired is returned by Transport() in case long term credent
ials | 49 // ErrLoginRequired is returned by Transport() in case long term credent
ials |
49 // are not cached and the user must go through interactive login. | 50 // are not cached and the user must go through interactive login. |
50 ErrLoginRequired = errors.New("interactive login is required") | 51 ErrLoginRequired = errors.New("interactive login is required") |
51 | 52 |
52 // ErrInsufficientAccess is returned by Login() or Transport() if access
_token | 53 // ErrInsufficientAccess is returned by Login() or Transport() if access
_token |
53 // can't be minted for given OAuth scopes. For example if GCE instance w
asn't | 54 // can't be minted for given OAuth scopes. For example if GCE instance w
asn't |
(...skipping 1134 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1188 Retries: 50, | 1189 Retries: 50, |
1189 MaxTotal: 5 * time.Second, | 1190 MaxTotal: 5 * time.Second, |
1190 }, | 1191 }, |
1191 Multiplier: 2, | 1192 Multiplier: 2, |
1192 } | 1193 } |
1193 } | 1194 } |
1194 | 1195 |
1195 // mintTokenWithRetries calls provider's MintToken() retrying on transient | 1196 // mintTokenWithRetries calls provider's MintToken() retrying on transient |
1196 // errors a bunch of times. Called only for non-interactive providers. | 1197 // errors a bunch of times. Called only for non-interactive providers. |
1197 func (t *tokenWithProvider) mintTokenWithRetries(ctx context.Context, base *oaut
h2.Token) (tok *oauth2.Token, err error) { | 1198 func (t *tokenWithProvider) mintTokenWithRetries(ctx context.Context, base *oaut
h2.Token) (tok *oauth2.Token, err error) { |
1198 » err = retry.Retry(ctx, retry.TransientOnly(retryParams), func() error { | 1199 » err = retry.Retry(ctx, transient.Only(retryParams), func() error { |
1199 tok, err = t.provider.MintToken(ctx, base) | 1200 tok, err = t.provider.MintToken(ctx, base) |
1200 return err | 1201 return err |
1201 }, nil) | 1202 }, nil) |
1202 return | 1203 return |
1203 } | 1204 } |
1204 | 1205 |
1205 // refreshTokenWithRetries calls providers' RefreshToken(...) retrying on | 1206 // refreshTokenWithRetries calls providers' RefreshToken(...) retrying on |
1206 // transient errors a bunch of times. | 1207 // transient errors a bunch of times. |
1207 func (t *tokenWithProvider) refreshTokenWithRetries(ctx context.Context, prev, b
ase *oauth2.Token) (tok *oauth2.Token, err error) { | 1208 func (t *tokenWithProvider) refreshTokenWithRetries(ctx context.Context, prev, b
ase *oauth2.Token) (tok *oauth2.Token, err error) { |
1208 » err = retry.Retry(ctx, retry.TransientOnly(retryParams), func() error { | 1209 » err = retry.Retry(ctx, transient.Only(retryParams), func() error { |
1209 tok, err = t.provider.RefreshToken(ctx, prev, base) | 1210 tok, err = t.provider.RefreshToken(ctx, prev, base) |
1210 return err | 1211 return err |
1211 }, nil) | 1212 }, nil) |
1212 return | 1213 return |
1213 } | 1214 } |
1214 | 1215 |
1215 //////////////////////////////////////////////////////////////////////////////// | 1216 //////////////////////////////////////////////////////////////////////////////// |
1216 // Utility functions. | 1217 // Utility functions. |
1217 | 1218 |
1218 // makeBaseTokenProvider creates TokenProvider implementation based on options. | 1219 // makeBaseTokenProvider creates TokenProvider implementation based on options. |
(...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1262 func makeIAMTokenProvider(ctx context.Context, opts *Options) (internal.TokenPro
vider, error) { | 1263 func makeIAMTokenProvider(ctx context.Context, opts *Options) (internal.TokenPro
vider, error) { |
1263 if opts.testingIAMTokenProvider != nil { | 1264 if opts.testingIAMTokenProvider != nil { |
1264 return opts.testingIAMTokenProvider, nil | 1265 return opts.testingIAMTokenProvider, nil |
1265 } | 1266 } |
1266 return internal.NewIAMTokenProvider( | 1267 return internal.NewIAMTokenProvider( |
1267 ctx, | 1268 ctx, |
1268 opts.ActAsServiceAccount, | 1269 opts.ActAsServiceAccount, |
1269 opts.Scopes, | 1270 opts.Scopes, |
1270 opts.Transport) | 1271 opts.Transport) |
1271 } | 1272 } |
OLD | NEW |