| OLD | NEW |
| 1 // Copyright 2015 The LUCI Authors. All rights reserved. | 1 // Copyright 2015 The LUCI Authors. All rights reserved. |
| 2 // Use of this source code is governed under the Apache License, Version 2.0 | 2 // Use of this source code is governed under the Apache License, Version 2.0 |
| 3 // that can be found in the LICENSE file. | 3 // that can be found in the LICENSE file. |
| 4 | 4 |
| 5 package server | 5 package server |
| 6 | 6 |
| 7 import ( | 7 import ( |
| 8 "fmt" | 8 "fmt" |
| 9 "net/http" | 9 "net/http" |
| 10 "strings" | 10 "strings" |
| (...skipping 92 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 103 logging.Infof(c, "oauth: Querying tokeninfo endpoint") | 103 logging.Infof(c, "oauth: Querying tokeninfo endpoint") |
| 104 tokenInfo, err := googleoauth.GetTokenInfo(c, googleoauth.TokenInfoParam
s{ | 104 tokenInfo, err := googleoauth.GetTokenInfo(c, googleoauth.TokenInfoParam
s{ |
| 105 AccessToken: accessToken, | 105 AccessToken: accessToken, |
| 106 Client: &http.Client{Transport: urlfetch.Get(c)}, | 106 Client: &http.Client{Transport: urlfetch.Get(c)}, |
| 107 Endpoint: m.tokenInfoEndpoint, | 107 Endpoint: m.tokenInfoEndpoint, |
| 108 }) | 108 }) |
| 109 if err != nil { | 109 if err != nil { |
| 110 if err == googleoauth.ErrBadToken { | 110 if err == googleoauth.ErrBadToken { |
| 111 return nil, err | 111 return nil, err |
| 112 } | 112 } |
| 113 » » return nil, errors.Annotate(err).Reason("oauth: transient error
when validating token"). | 113 » » return nil, errors.Annotate(err, "oauth: transient error when va
lidating token"). |
| 114 Tag(transient.Tag).Err() | 114 Tag(transient.Tag).Err() |
| 115 } | 115 } |
| 116 | 116 |
| 117 // Verify the token contains a validated email. | 117 // Verify the token contains a validated email. |
| 118 switch { | 118 switch { |
| 119 case tokenInfo.Email == "": | 119 case tokenInfo.Email == "": |
| 120 return nil, fmt.Errorf("oauth: token is not associated with an e
mail") | 120 return nil, fmt.Errorf("oauth: token is not associated with an e
mail") |
| 121 case !tokenInfo.EmailVerified: | 121 case !tokenInfo.EmailVerified: |
| 122 return nil, fmt.Errorf("oauth: email %s is not verified", tokenI
nfo.Email) | 122 return nil, fmt.Errorf("oauth: email %s is not verified", tokenI
nfo.Email) |
| 123 } | 123 } |
| (...skipping 18 matching lines...) Expand all Loading... |
| 142 return nil, err | 142 return nil, err |
| 143 } | 143 } |
| 144 u := &auth.User{ | 144 u := &auth.User{ |
| 145 Identity: id, | 145 Identity: id, |
| 146 Email: tokenInfo.Email, | 146 Email: tokenInfo.Email, |
| 147 ClientID: tokenInfo.Aud, | 147 ClientID: tokenInfo.Aud, |
| 148 } | 148 } |
| 149 proccache.Put(c, tokenCheckCache(accessToken), u, time.Duration(tokenInf
o.ExpiresIn)*time.Second) | 149 proccache.Put(c, tokenCheckCache(accessToken), u, time.Duration(tokenInf
o.ExpiresIn)*time.Second) |
| 150 return u, nil | 150 return u, nil |
| 151 } | 151 } |
| OLD | NEW |