OLD | NEW |
1 // Copyright 2017 The LUCI Authors. All rights reserved. | 1 // Copyright 2017 The LUCI Authors. All rights reserved. |
2 // Use of this source code is governed under the Apache License, Version 2.0 | 2 // Use of this source code is governed under the Apache License, Version 2.0 |
3 // that can be found in the LICENSE file. | 3 // that can be found in the LICENSE file. |
4 | 4 |
5 package tokensigning | 5 package tokensigning |
6 | 6 |
7 import ( | 7 import ( |
8 "encoding/base64" | 8 "encoding/base64" |
9 | 9 |
10 "github.com/golang/protobuf/proto" | 10 "github.com/golang/protobuf/proto" |
11 "golang.org/x/net/context" | 11 "golang.org/x/net/context" |
12 | 12 |
13 » "github.com/luci/luci-go/common/errors" | 13 » "github.com/luci/luci-go/common/retry/transient" |
14 "github.com/luci/luci-go/server/auth/signing" | 14 "github.com/luci/luci-go/server/auth/signing" |
15 ) | 15 ) |
16 | 16 |
17 // Signer knows how to sign protos and serialize/encode signed result. | 17 // Signer knows how to sign protos and serialize/encode signed result. |
18 type Signer struct { | 18 type Signer struct { |
19 // Signer is the actual signer: it knows how to sign blobs. | 19 // Signer is the actual signer: it knows how to sign blobs. |
20 Signer signing.Signer | 20 Signer signing.Signer |
21 | 21 |
22 // SigningContext is prepended to the token blob before it is signed. | 22 // SigningContext is prepended to the token blob before it is signed. |
23 // | 23 // |
(...skipping 22 matching lines...) Expand all Loading... |
46 // token. | 46 // token. |
47 Wrap func(unwrapped *Unwrapped) proto.Message | 47 Wrap func(unwrapped *Unwrapped) proto.Message |
48 } | 48 } |
49 | 49 |
50 // SignToken serializes the body, signs it and returns serialized envelope. | 50 // SignToken serializes the body, signs it and returns serialized envelope. |
51 // | 51 // |
52 // Produces base64 URL-safe token or an error (possibly transient). | 52 // Produces base64 URL-safe token or an error (possibly transient). |
53 func (s *Signer) SignToken(c context.Context, body proto.Message) (string, error
) { | 53 func (s *Signer) SignToken(c context.Context, body proto.Message) (string, error
) { |
54 info, err := s.Signer.ServiceInfo(c) | 54 info, err := s.Signer.ServiceInfo(c) |
55 if err != nil { | 55 if err != nil { |
56 » » return "", errors.WrapTransient(err) | 56 » » return "", transient.Tag.Apply(err) |
57 } | 57 } |
58 blob, err := proto.Marshal(body) | 58 blob, err := proto.Marshal(body) |
59 if err != nil { | 59 if err != nil { |
60 return "", err | 60 return "", err |
61 } | 61 } |
62 withCtx := prependSigningContext(blob, s.SigningContext) | 62 withCtx := prependSigningContext(blob, s.SigningContext) |
63 keyID, sig, err := s.Signer.SignBytes(c, withCtx) | 63 keyID, sig, err := s.Signer.SignBytes(c, withCtx) |
64 if err != nil { | 64 if err != nil { |
65 » » return "", errors.WrapTransient(err) | 65 » » return "", transient.Tag.Apply(err) |
66 } | 66 } |
67 tok, err := proto.Marshal(s.Wrap(&Unwrapped{ | 67 tok, err := proto.Marshal(s.Wrap(&Unwrapped{ |
68 Body: blob, | 68 Body: blob, |
69 RsaSHA256Sig: sig, | 69 RsaSHA256Sig: sig, |
70 SignerID: info.ServiceAccountName, | 70 SignerID: info.ServiceAccountName, |
71 KeyID: keyID, | 71 KeyID: keyID, |
72 })) | 72 })) |
73 if err != nil { | 73 if err != nil { |
74 return "", err | 74 return "", err |
75 } | 75 } |
76 enc := s.Encoding | 76 enc := s.Encoding |
77 if enc == nil { | 77 if enc == nil { |
78 enc = base64.RawURLEncoding | 78 enc = base64.RawURLEncoding |
79 } | 79 } |
80 return enc.EncodeToString(tok), nil | 80 return enc.EncodeToString(tok), nil |
81 } | 81 } |
OLD | NEW |