OLD | NEW |
1 // Copyright 2015 The LUCI Authors. All rights reserved. | 1 // Copyright 2015 The LUCI Authors. All rights reserved. |
2 // Use of this source code is governed under the Apache License, Version 2.0 | 2 // Use of this source code is governed under the Apache License, Version 2.0 |
3 // that can be found in the LICENSE file. | 3 // that can be found in the LICENSE file. |
4 | 4 |
5 package server | 5 package server |
6 | 6 |
7 import ( | 7 import ( |
8 "fmt" | 8 "fmt" |
9 "net/http" | 9 "net/http" |
10 "strings" | 10 "strings" |
(...skipping 92 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
103 logging.Infof(c, "oauth: Querying tokeninfo endpoint") | 103 logging.Infof(c, "oauth: Querying tokeninfo endpoint") |
104 tokenInfo, err := googleoauth.GetTokenInfo(c, googleoauth.TokenInfoParam
s{ | 104 tokenInfo, err := googleoauth.GetTokenInfo(c, googleoauth.TokenInfoParam
s{ |
105 AccessToken: accessToken, | 105 AccessToken: accessToken, |
106 Client: &http.Client{Transport: urlfetch.Get(c)}, | 106 Client: &http.Client{Transport: urlfetch.Get(c)}, |
107 Endpoint: m.tokenInfoEndpoint, | 107 Endpoint: m.tokenInfoEndpoint, |
108 }) | 108 }) |
109 if err != nil { | 109 if err != nil { |
110 if err == googleoauth.ErrBadToken { | 110 if err == googleoauth.ErrBadToken { |
111 return nil, err | 111 return nil, err |
112 } | 112 } |
113 » » return nil, errors.Annotate(err).Reason("oauth: transient error
when validating token"). | 113 » » return nil, errors.Annotate(err, "oauth: transient error when va
lidating token"). |
114 Tag(transient.Tag).Err() | 114 Tag(transient.Tag).Err() |
115 } | 115 } |
116 | 116 |
117 // Verify the token contains a validated email. | 117 // Verify the token contains a validated email. |
118 switch { | 118 switch { |
119 case tokenInfo.Email == "": | 119 case tokenInfo.Email == "": |
120 return nil, fmt.Errorf("oauth: token is not associated with an e
mail") | 120 return nil, fmt.Errorf("oauth: token is not associated with an e
mail") |
121 case !tokenInfo.EmailVerified: | 121 case !tokenInfo.EmailVerified: |
122 return nil, fmt.Errorf("oauth: email %s is not verified", tokenI
nfo.Email) | 122 return nil, fmt.Errorf("oauth: email %s is not verified", tokenI
nfo.Email) |
123 } | 123 } |
(...skipping 18 matching lines...) Expand all Loading... |
142 return nil, err | 142 return nil, err |
143 } | 143 } |
144 u := &auth.User{ | 144 u := &auth.User{ |
145 Identity: id, | 145 Identity: id, |
146 Email: tokenInfo.Email, | 146 Email: tokenInfo.Email, |
147 ClientID: tokenInfo.Aud, | 147 ClientID: tokenInfo.Aud, |
148 } | 148 } |
149 proccache.Put(c, tokenCheckCache(accessToken), u, time.Duration(tokenInf
o.ExpiresIn)*time.Second) | 149 proccache.Put(c, tokenCheckCache(accessToken), u, time.Duration(tokenInf
o.ExpiresIn)*time.Second) |
150 return u, nil | 150 return u, nil |
151 } | 151 } |
OLD | NEW |