GNOME.org
 

[Notes] [Git][BuildGrid/buildgrid][mablanch/144-jwt-authentication] 10 commits: Implementation of the getTree method.

Title: GitLab

Martin Blanchard pushed to branch mablanch/144-jwt-authentication at BuildGrid / buildgrid

Commits:

16 changed files:

Changes:

  • .pylintrc
    ... ... @@ -462,6 +462,7 @@ known-third-party=boto3,
    462 462 
                       google,
    463 463 
                       grpc,
    464 464 
                       janus,
    465 
    +                  jwt,
    465 466 
                       moto,
    466 467 
                       yaml
    467 468
    ... ... @@ -525,4 +526,4 @@ valid-metaclass-classmethod-first-arg=mcs
    525 526
    526 527 
     # Exceptions that will emit a warning when being caught. Defaults to
    527 528 
     # "Exception"
    528 
    -overgeneral-exceptions=Exception
    529 
    +overgeneral-exceptions=Exception
    \ No newline at end of file

  • buildgrid/_app/commands/cmd_capabilities.py
    ... ... @@ -17,9 +17,12 @@ import sys
    17 17 
     from urllib.parse import urlparse
    18 18
    19 19 
     import click
    20 
    +from google.protobuf import json_format
    20 21 
     import grpc
    21 22
    23 
    +from buildgrid.client.authentication import setup_channel
    22 24 
     from buildgrid.client.capabilities import CapabilitiesInterface
    25 
    +from buildgrid._exceptions import InvalidArgumentError
    23 26
    24 27 
     from ..cli import pass_context
    25 28
    ... ... @@ -27,32 +30,29 @@ from ..cli import pass_context
    27 30 
     @click.command(name='capabilities', short_help="Capabilities service.")
    28 31 
     @click.option('--remote', type=click.STRING, default='http://localhost:50051', show_default=True,
    29 32 
                   help="Remote execution server's URL (port defaults to 50051 if no specified).")
    33 
    +@click.option('--auth-token', type=click.Path(exists=True, dir_okay=False), default=None,
    34 
    +              help="Authorization token for the remote.")
    30 35 
     @click.option('--client-key', type=click.Path(exists=True, dir_okay=False), default=None,
    31 
    -              help="Private client key for TLS (PEM-encoded)")
    36 
    +              help="Private client key for TLS (PEM-encoded).")
    32 37 
     @click.option('--client-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    33 
    -              help="Public client certificate for TLS (PEM-encoded)")
    38 
    +              help="Public client certificate for TLS (PEM-encoded).")
    34 39 
     @click.option('--server-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    35 
    -              help="Public server certificate for TLS (PEM-encoded)")
    40 
    +              help="Public server certificate for TLS (PEM-encoded).")
    36 41 
     @click.option('--instance-name', type=click.STRING, default='main', show_default=True,
    37 42 
                   help="Targeted farm instance name.")
    38 43 
     @pass_context
    39 
    -def cli(context, remote, instance_name, client_key, client_cert, server_cert):
    40 
    -    click.echo("Getting capabilities...")
    41 
    -    url = urlparse(remote)
    42 
    -
    43 
    -    remote = '{}:{}'.format(url.hostname, url.port or 50051)
    44 
    -    instance_name = instance_name
    45 
    -
    46 
    -    if url.scheme == 'http':
    47 
    -        channel = grpc.insecure_channel(remote)
    48 
    -    else:
    49 
    -        credentials = context.load_client_credentials(client_key, client_cert, server_cert)
    50 
    -        if not credentials:
    51 
    -            click.echo("ERROR: no TLS keys were specified and no defaults could be found.", err=True)
    52 
    -            sys.exit(-1)
    53 
    -
    54 
    -        channel = grpc.secure_channel(remote, credentials)
    55 
    -
    56 
    -    interface = CapabilitiesInterface(channel)
    57 
    -    response = interface.get_capabilities(instance_name)
    58 
    -    click.echo(response)
    44 
    +def cli(context, remote, instance_name, auth_token, client_key, client_cert, server_cert):
    45 
    +    """Entry point for the bgd-capabilities CLI command group."""
    46 
    +    try:
    47 
    +        context.channel = setup_channel(remote, authorization_token=auth_token,
    48 
    +                                        client_key=client_key, client_cert=client_cert)
    49 
    +
    50 
    +    except InvalidArgumentError as e:
    51 
    +        click.echo("Error: {}.".format(e), err=True)
    52 
    +
    53 
    +    context.instance_name = instance_name
    54 
    +
    55 
    +    interface = CapabilitiesInterface(context.channel)
    56 
    +    response = interface.get_capabilities(context.instance_name)
    57 
    +
    58 
    +    click.echo(json_format.MessageToJson(response))

  • buildgrid/_app/commands/cmd_cas.py
    ... ... @@ -27,7 +27,9 @@ from urllib.parse import urlparse
    27 27 
     import click
    28 28 
     import grpc
    29 29
    30 
    +from buildgrid.client.authentication import setup_channel
    30 31 
     from buildgrid.client.cas import download, upload
    32 
    +from buildgrid._exceptions import InvalidArgumentError
    31 33 
     from buildgrid._protos.build.bazel.remote.execution.v2 import remote_execution_pb2
    32 34 
     from buildgrid.utils import create_digest, merkle_tree_maker, read_file
    33 35
    ... ... @@ -37,32 +39,27 @@ from ..cli import pass_context
    37 39 
     @click.group(name='cas', short_help="Interact with the CAS server.")
    38 40 
     @click.option('--remote', type=click.STRING, default='http://localhost:50051', show_default=True,
    39 41 
                   help="Remote execution server's URL (port defaults to 50051 if no specified).")
    42 
    +@click.option('--auth-token', type=click.Path(exists=True, dir_okay=False), default=None,
    43 
    +              help="Authorization token for the remote.")
    40 44 
     @click.option('--client-key', type=click.Path(exists=True, dir_okay=False), default=None,
    41 
    -              help="Private client key for TLS (PEM-encoded)")
    45 
    +              help="Private client key for TLS (PEM-encoded).")
    42 46 
     @click.option('--client-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    43 
    -              help="Public client certificate for TLS (PEM-encoded)")
    47 
    +              help="Public client certificate for TLS (PEM-encoded).")
    44 48 
     @click.option('--server-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    45 49 
                   help="Public server certificate for TLS (PEM-encoded)")
    46 50 
     @click.option('--instance-name', type=click.STRING, default='main', show_default=True,
    47 51 
                   help="Targeted farm instance name.")
    48 52 
     @pass_context
    49 
    -def cli(context, remote, instance_name, client_key, client_cert, server_cert):
    50 
    -    url = urlparse(remote)
    53 
    +def cli(context, remote, instance_name, auth_token, client_key, client_cert, server_cert):
    54 
    +    """Entry point for the bgd-cas CLI command group."""
    55 
    +    try:
    56 
    +        context.channel = setup_channel(remote, authorization_token=auth_token,
    57 
    +                                        client_key=client_key, client_cert=client_cert)
    51 58
    52 
    -    context.remote = '{}:{}'.format(url.hostname, url.port or 50051)
    53 
    -    context.instance_name = instance_name
    54 
    -
    55 
    -    if url.scheme == 'http':
    56 
    -        context.channel = grpc.insecure_channel(context.remote)
    57 
    -    else:
    58 
    -        credentials = context.load_client_credentials(client_key, client_cert, server_cert)
    59 
    -        if not credentials:
    60 
    -            click.echo("ERROR: no TLS keys were specified and no defaults could be found.", err=True)
    61 
    -            sys.exit(-1)
    59 
    +    except InvalidArgumentError as e:
    60 
    +        click.echo("Error: {}.".format(e), err=True)
    62 61
    63 
    -        context.channel = grpc.secure_channel(context.remote, credentials)
    64 
    -
    65 
    -    click.echo("Starting for remote=[{}]".format(context.remote))
    62 
    +    context.instance_name = instance_name
    66 63
    67 64
    68 65 
     @cli.command('upload-dummy', short_help="Upload a dummy action. Should be used with `execute dummy-request`")

  • buildgrid/_app/commands/cmd_execute.py
    ... ... @@ -28,7 +28,9 @@ from urllib.parse import urlparse
    28 28 
     import click
    29 29 
     import grpc
    30 30
    31 
    +from buildgrid.client.authentication import setup_channel
    31 32 
     from buildgrid.client.cas import download, upload
    33 
    +from buildgrid._exceptions import InvalidArgumentError
    32 34 
     from buildgrid._protos.build.bazel.remote.execution.v2 import remote_execution_pb2, remote_execution_pb2_grpc
    33 35 
     from buildgrid.utils import create_digest
    34 36
    ... ... @@ -38,32 +40,27 @@ from ..cli import pass_context
    38 40 
     @click.group(name='execute', short_help="Execute simple operations.")
    39 41 
     @click.option('--remote', type=click.STRING, default='http://localhost:50051', show_default=True,
    40 42 
                   help="Remote execution server's URL (port defaults to 50051 if no specified).")
    43 
    +@click.option('--auth-token', type=click.Path(exists=True, dir_okay=False), default=None,
    44 
    +              help="Authorization token for the remote.")
    41 45 
     @click.option('--client-key', type=click.Path(exists=True, dir_okay=False), default=None,
    42 
    -              help="Private client key for TLS (PEM-encoded)")
    46 
    +              help="Private client key for TLS (PEM-encoded).")
    43 47 
     @click.option('--client-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    44 
    -              help="Public client certificate for TLS (PEM-encoded)")
    48 
    +              help="Public client certificate for TLS (PEM-encoded).")
    45 49 
     @click.option('--server-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    46 
    -              help="Public server certificate for TLS (PEM-encoded)")
    50 
    +              help="Public server certificate for TLS (PEM-encoded).")
    47 51 
     @click.option('--instance-name', type=click.STRING, default='main', show_default=True,
    48 52 
                   help="Targeted farm instance name.")
    49 53 
     @pass_context
    50 54 
     def cli(context, remote, instance_name, client_key, client_cert, server_cert):
    51 
    -    url = urlparse(remote)
    55 
    +    """Entry point for the bgd-execute CLI command group."""
    56 
    +    try:
    57 
    +        context.channel = setup_channel(remote, authorization_token=auth_token,
    58 
    +                                        client_key=client_key, client_cert=client_cert)
    52 59
    53 
    -    context.remote = '{}:{}'.format(url.hostname, url.port or 50051)
    54 
    -    context.instance_name = instance_name
    55 
    -
    56 
    -    if url.scheme == 'http':
    57 
    -        context.channel = grpc.insecure_channel(context.remote)
    58 
    -    else:
    59 
    -        credentials = context.load_client_credentials(client_key, client_cert, server_cert)
    60 
    -        if not credentials:
    61 
    -            click.echo("ERROR: no TLS keys were specified and no defaults could be found.", err=True)
    62 
    -            sys.exit(-1)
    60 
    +    except InvalidArgumentError as e:
    61 
    +        click.echo("Error: {}.".format(e), err=True)
    63 62
    64 
    -        context.channel = grpc.secure_channel(context.remote, credentials)
    65 
    -
    66 
    -    click.echo("Starting for remote=[{}]".format(context.remote))
    63 
    +    context.instance_name = instance_name
    67 64
    68 65
    69 66 
     @cli.command('request-dummy', short_help="Send a dummy action.")

  • buildgrid/_app/commands/cmd_operation.py
    ... ... @@ -30,7 +30,9 @@ import click
    30 30 
     from google.protobuf import json_format
    31 31 
     import grpc
    32 32
    33 
    +from buildgrid.client.authentication import setup_channel
    33 34 
     from buildgrid._enums import OperationStage
    35 
    +from buildgrid._exceptions import InvalidArgumentError
    34 36 
     from buildgrid._protos.build.bazel.remote.execution.v2 import remote_execution_pb2, remote_execution_pb2_grpc
    35 37 
     from buildgrid._protos.google.longrunning import operations_pb2, operations_pb2_grpc
    36 38 
     from buildgrid._protos.google.rpc import code_pb2
    ... ... @@ -41,32 +43,27 @@ from ..cli import pass_context
    41 43 
     @click.group(name='operation', short_help="Long running operations commands.")
    42 44 
     @click.option('--remote', type=click.STRING, default='http://localhost:50051', show_default=True,
    43 45 
                   help="Remote execution server's URL (port defaults to 50051 if no specified).")
    46 
    +@click.option('--auth-token', type=click.Path(exists=True, dir_okay=False), default=None,
    47 
    +              help="Authorization token for the remote.")
    44 48 
     @click.option('--client-key', type=click.Path(exists=True, dir_okay=False), default=None,
    45 
    -              help="Private client key for TLS (PEM-encoded)")
    49 
    +              help="Private client key for TLS (PEM-encoded).")
    46 50 
     @click.option('--client-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    47 
    -              help="Public client certificate for TLS (PEM-encoded)")
    51 
    +              help="Public client certificate for TLS (PEM-encoded).")
    48 52 
     @click.option('--server-cert', type=click.Path(exists=True, dir_okay=False), default=None,
    49 
    -              help="Public server certificate for TLS (PEM-encoded)")
    53 
    +              help="Public server certificate for TLS (PEM-encoded).")
    50 54 
     @click.option('--instance-name', type=click.STRING, default='main', show_default=True,
    51 55 
                   help="Targeted farm instance name.")
    52 56 
     @pass_context
    53 57 
     def cli(context, remote, instance_name, client_key, client_cert, server_cert):
    54 
    -    url = urlparse(remote)
    58 
    +    """Entry point for the bgd-operation CLI command group."""
    59 
    +    try:
    60 
    +        context.channel = setup_channel(remote, authorization_token=auth_token,
    61 
    +                                        client_key=client_key, client_cert=client_cert)
    55 62
    56 
    -    context.remote = '{}:{}'.format(url.hostname, url.port or 50051)
    57 
    -    context.instance_name = instance_name
    58 
    -
    59 
    -    if url.scheme == 'http':
    60 
    -        context.channel = grpc.insecure_channel(context.remote)
    61 
    -    else:
    62 
    -        credentials = context.load_client_credentials(client_key, client_cert, server_cert)
    63 
    -        if not credentials:
    64 
    -            click.echo("ERROR: no TLS keys were specified and no defaults could be found.", err=True)
    65 
    -            sys.exit(-1)
    63 
    +    except InvalidArgumentError as e:
    64 
    +        click.echo("Error: {}.".format(e), err=True)
    66 65
    67 
    -        context.channel = grpc.secure_channel(context.remote, credentials)
    68 
    -
    69 
    -    click.echo("Starting for remote=[{}]".format(context.remote))
    66 
    +    context.instance_name = instance_name
    70 67
    71 68
    72 69 
     def _print_operation_status(operation, print_details=False):

  • buildgrid/client/authentication.py
    1 
    +# Copyright (C) 2018 Bloomberg LP
    2 
    +#
    3 
    +# Licensed under the Apache License, Version 2.0 (the "License");
    4 
    +# you may not use this file except in compliance with the License.
    5 
    +# You may obtain a copy of the License at
    6 
    +#
    7 
    +#  <http://www.apache.org/licenses/LICENSE-2.0>
    8 
    +#
    9 
    +# Unless required by applicable law or agreed to in writing, software
    10 
    +# distributed under the License is distributed on an "AS IS" BASIS,
    11 
    +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12 
    +# See the License for the specific language governing permissions and
    13 
    +# limitations under the License.
    14 
    +
    15 
    +
    16 
    +import base64
    17 
    +from collections import namedtuple
    18 
    +from urllib.parse import urlparse
    19 
    +import os
    20 
    +
    21 
    +import grpc
    22 
    +
    23 
    +from buildgrid._exceptions import InvalidArgumentError
    24 
    +from buildgrid.utils import read_file
    25 
    +
    26 
    +
    27 
    +def load_tls_channel_credentials(client_key=None, client_cert=None, server_cert=None):
    28 
    +    """Looks-up and loads TLS gRPC client channel credentials.
    29 
    +
    30 
    +    Args:
    31 
    +        client_key(str, optional): Client certificate chain file path.
    32 
    +        client_cert(str, optional): Client private key file path.
    33 
    +        server_cert(str, optional): Serve root certificate file path.
    34 
    +
    35 
    +    Returns:
    36 
    +        ChannelCredentials: Credentials to be used for a TLS-encrypted gRPC
    37 
    +            client channel.
    38 
    +    """
    39 
    +    if server_cert and os.path.exists(server_cert):
    40 
    +        server_cert_pem = read_file(server_cert)
    41 
    +    else:
    42 
    +        server_cert_pem = None
    43 
    +
    44 
    +    if client_key and os.path.exists(client_key):
    45 
    +        client_key_pem = read_file(client_key)
    46 
    +    else:
    47 
    +        client_key_pem = None
    48 
    +
    49 
    +    if client_key_pem and client_cert and os.path.exists(client_cert):
    50 
    +        client_cert_pem = read_file(client_cert)
    51 
    +    else:
    52 
    +        client_cert_pem = None
    53 
    +
    54 
    +    credentials = grpc.ssl_channel_credentials(root_certificates=server_cert_pem,
    55 
    +                                               private_key=client_key_pem,
    56 
    +                                               certificate_chain=client_cert_pem)
    57 
    +    return credentials
    58 
    +
    59 
    +
    60 
    +def load_channel_authorization_token(auth_token=None):
    61 
    +    """Looks-up and loads client authorization token.
    62 
    +
    63 
    +    Args:
    64 
    +        auth_token (str, optional): Token file path.
    65 
    +
    66 
    +    Returns:
    67 
    +        str: Encoded token string.
    68 
    +    """
    69 
    +    if auth_token and os.path.exists(auth_token):
    70 
    +        return read_file(auth_token).decode()
    71 
    +
    72 
    +    #TODO: Try loading the token from a default location?
    73 
    +
    74 
    +    return None
    75 
    +
    76 
    +
    77 
    +def setup_channel(remote_url, authorization_token=None,
    78 
    +                  client_key=None, client_cert=None, server_cert=None):
    79 
    +    """Creates a new gRPC client communication chanel.
    80 
    +
    81 
    +    If `remote_url` does not specifies a port number, defaults 50051.
    82 
    +
    83 
    +    Args:
    84 
    +        remote_url (str): URL for the remote, including port and protocol.
    85 
    +        authorization_token (str): Authorization token file path.
    86 
    +        server_cert(str): TLS certificate chain file path.
    87 
    +        client_key(str): TLS root certificate file path.
    88 
    +        client_cert(str): TLS private key file path.
    89 
    +
    90 
    +    Returns:
    91 
    +        (str, Channel):
    92 
    +
    93 
    +    Raises:
    94 
    +        InvalidArgumentError: On any input parsing error.
    95 
    +    """
    96 
    +    url = urlparse(remote_url)
    97 
    +    remote = '{}:{}'.format(url.hostname, url.port or 50051)
    98 
    +
    99 
    +    if url.scheme == 'http':
    100 
    +        channel = grpc.insecure_channel(remote)
    101 
    +
    102 
    +    elif url.scheme == 'https':
    103 
    +        credentials = load_tls_channel_credentials(client_key, client_cert, server_cert)
    104 
    +        if not credentials:
    105 
    +            raise InvalidArgumentError("Given TLS details (or defaults) could be loaded")
    106 
    +
    107 
    +        channel = grpc.secure_channel(remote, credentials)
    108 
    +
    109 
    +    else:
    110 
    +        raise InvalidArgumentError("Given remote does not specify a protocol")
    111 
    +
    112 
    +    if authorization_token is not None:
    113 
    +        token = load_channel_authorization_token(authorization_token)
    114 
    +        if not token:
    115 
    +            raise InvalidArgumentError("Given authorization token could be loaded")
    116 
    +
    117 
    +        interpector =  AuthMetadataClientInterceptor(token)
    118 
    +        channel = grpc.intercept_channel(channel, interpector)
    119 
    +
    120 
    +    return channel
    121 
    +
    122 
    +
    123 
    +class AuthMetadataClientInterceptor(
    124 
    +        grpc.UnaryUnaryClientInterceptor, grpc.UnaryStreamClientInterceptor,
    125 
    +        grpc.StreamUnaryClientInterceptor, grpc.StreamStreamClientInterceptor):
    126 
    +
    127 
    +    def __init__(self, authorization_token=None, authorization_secret=None):
    128 
    +        """Initialises a new :class:`AuthMetadataClientInterceptor`.
    129 
    +
    130 
    +        Args:
    131 
    +            authorization_token (str): Authorization token as a string.
    132 
    +        """
    133 
    +        if authorization_token:
    134 
    +            self.__secret = authorization_token.strip()
    135 
    +        else:
    136 
    +            self.__secret = base64.b64encode(authorization_secret)
    137 
    +
    138 
    +        self.__header_field_name = 'authorization'
    139 
    +        self.__header_field_value = 'Bearer {}'.format(self.__secret)
    140 
    +
    141 
    +    def intercept_unary_unary(self, continuation, client_call_details, request):
    142 
    +        new_details = self._amend_call_details(client_call_details)
    143 
    +
    144 
    +        return continuation(new_details, request)
    145 
    +
    146 
    +    def intercept_unary_stream(self, continuation, client_call_details, request):
    147 
    +        new_details = self._amend_call_details(client_call_details)
    148 
    +
    149 
    +        return continuation(new_details, request)
    150 
    +
    151 
    +    def intercept_stream_unary(self, continuation, client_call_details, request_iterator):
    152 
    +        new_details = self._amend_call_details(client_call_details)
    153 
    +
    154 
    +        return continuation(new_details, request_iterator)
    155 
    +
    156 
    +    def intercept_stream_stream(self, continuation, client_call_details, request_iterator):
    157 
    +        new_details = self._amend_call_details(client_call_details)
    158 
    +
    159 
    +        return continuation(new_details, request_iterator)
    160 
    +
    161 
    +    def _amend_call_details(self, client_call_details):
    162 
    +        if client_call_details.metadata is not None:
    163 
    +            new_metadata = list(client_call_details.metadata)
    164 
    +        else:
    165 
    +            new_metadata = []
    166 
    +
    167 
    +        new_metadata.append((self.__header_field_name, self.__header_field_value,))
    168 
    +
    169 
    +        class _ClientCallDetails(
    170 
    +                namedtuple('_ClientCallDetails',
    171 
    +                           ('method', 'timeout', 'credentials', 'metadata')),
    172 
    +                grpc.ClientCallDetails):
    173 
    +            pass
    174 
    +
    175 
    +        return _ClientCallDetails(client_call_details.method,
    176 
    +                                  client_call_details.timeout,
    177 
    +                                  client_call_details.credentials,
    178 
    +                                  new_metadata)

  • buildgrid/client/cas.py
    ... ... @@ -23,19 +23,13 @@ from buildgrid._exceptions import NotFoundError
    23 23 
     from buildgrid._protos.build.bazel.remote.execution.v2 import remote_execution_pb2, remote_execution_pb2_grpc
    24 24 
     from buildgrid._protos.google.bytestream import bytestream_pb2, bytestream_pb2_grpc
    25 25 
     from buildgrid._protos.google.rpc import code_pb2
    26 
    -from buildgrid.settings import HASH
    26 
    +from buildgrid.settings import HASH, MAX_REQUEST_SIZE, MAX_REQUEST_COUNT
    27 27 
     from buildgrid.utils import merkle_tree_maker
    28 28
    29 29
    30 30 
     # Maximum size for a queueable file:
    31 31 
     FILE_SIZE_THRESHOLD = 1 * 1024 * 1024
    32 32
    33 
    -# Maximum size for a single gRPC request:
    34 
    -MAX_REQUEST_SIZE = 2 * 1024 * 1024
    35 
    -
    36 
    -# Maximum number of elements per gRPC request:
    37 
    -MAX_REQUEST_COUNT = 500
    38 
    -
    39 33
    40 34 
     class _CallCache:
    41 35 
         """Per remote grpc.StatusCode.UNIMPLEMENTED call cache."""
    ... ... @@ -390,11 +384,10 @@ class Downloader:
    390 384 
                     assert digest.hash in directories
    391 385
    392 386 
                     directory = directories[digest.hash]
    393 
    -                self._write_directory(digest.hash, directory_path,
    387 
    +                self._write_directory(directory, directory_path,
    394 388 
                                           directories=directories, root_barrier=directory_path)
    395 389
    396 390 
                     directory_fetched = True
    397 
    -
    398 391 
                 except grpc.RpcError as e:
    399 392 
                     status_code = e.code()
    400 393 
                     if status_code == grpc.StatusCode.UNIMPLEMENTED:

  • buildgrid/server/_authentication.py
    1 
    +# Copyright (C) 2018 Bloomberg LP
    2 
    +#
    3 
    +# Licensed under the Apache License, Version 2.0 (the "License");
    4 
    +# you may not use this file except in compliance with the License.
    5 
    +# You may obtain a copy of the License at
    6 
    +#
    7 
    +#  <http://www.apache.org/licenses/LICENSE-2.0>
    8 
    +#
    9 
    +# Unless required by applicable law or agreed to in writing, software
    10 
    +# distributed under the License is distributed on an "AS IS" BASIS,
    11 
    +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12 
    +# See the License for the specific language governing permissions and
    13 
    +# limitations under the License.
    14 
    +
    15 
    +
    16 
    +from datetime import datetime
    17 
    +from enum import Enum
    18 
    +import logging
    19 
    +
    20 
    +import grpc
    21 
    +
    22 
    +from buildgrid._exceptions import InvalidArgumentError
    23 
    +
    24 
    +
    25 
    +try:
    26 
    +    import jwt
    27 
    +except ImportError:
    28 
    +    HAVE_JWT = False
    29 
    +else:
    30 
    +    HAVE_JWT = True
    31 
    +
    32 
    +
    33 
    +class AuthMetadataMethod(Enum):
    34 
    +    # No authentication:
    35 
    +    NONE = 'none'
    36 
    +    # JWT based authentication:
    37 
    +    JWT = 'JWT'
    38 
    +
    39 
    +
    40 
    +class AuthMetadataAlgorithm(Enum):
    41 
    +    # No encryption involved:
    42 
    +    NONE = 'none'
    43 
    +    # JWT related algorithms:
    44 
    +    JWT_ES256 = 'ES256'  # ECDSA signature algorithm using SHA-256 hash algorithm
    45 
    +    JWT_ES384 = 'ES384'  # ECDSA signature algorithm using SHA-384 hash algorithm
    46 
    +    JWT_ES512 = 'ES512'  # ECDSA signature algorithm using SHA-512 hash algorithm
    47 
    +    JWT_HS256 = 'HS256'  # HMAC using SHA-256 hash algorithm
    48 
    +    JWT_HS384 = 'HS384'  # HMAC using SHA-384 hash algorithm
    49 
    +    JWT_HS512 = 'HS512'  # HMAC using SHA-512 hash algorithm
    50 
    +    JWT_PS256 = 'PS256'  # RSASSA-PSS using SHA-256 and MGF1 padding with SHA-256
    51 
    +    JWT_PS384 = 'PS384'  # RSASSA-PSS signature using SHA-384 and MGF1 padding with SHA-384
    52 
    +    JWT_PS512 = 'PS512'  # RSASSA-PSS signature using SHA-512 and MGF1 padding with SHA-512
    53 
    +    JWT_RS256 = 'RS256'  # RSASSA-PKCS1-v1_5 signature algorithm using SHA-256 hash algorithm
    54 
    +    JWT_RS384 = 'RS384'  # RSASSA-PKCS1-v1_5 signature algorithm using SHA-384 hash algorithm
    55 
    +    JWT_RS512 = 'RS512'  # RSASSA-PKCS1-v1_5 signature algorithm using SHA-512 hash algorithm
    56 
    +
    57 
    +
    58 
    +class _InvalidTokenError(Exception):
    59 
    +    pass
    60 
    +
    61 
    +
    62 
    +class _ExpiredTokenError(Exception):
    63 
    +    pass
    64 
    +
    65 
    +
    66 
    +class _UnboundedTokenError(Exception):
    67 
    +    pass
    68 
    +
    69 
    +
    70 
    +class AuthMetadataServerInterceptor(grpc.ServerInterceptor):
    71 
    +
    72 
    +    __auth_errors = {
    73 
    +        'missing-bearer': 'Missing authentication header field',
    74 
    +        'invalid-bearer': 'Invalid authentication header field',
    75 
    +        'invalid-token': 'Invalid authentication token',
    76 
    +        'expired-token': 'Expired authentication token',
    77 
    +        'unbounded-token': 'Unbounded authentication token',
    78 
    +    }
    79 
    +
    80 
    +    def __init__(self, method, secret=None, algorithm=AuthMetadataAlgorithm.NONE):
    81 
    +        """Initialises a new :class:`AuthMetadataServerInterceptor`.
    82 
    +
    83 
    +        Args:
    84 
    +            method (AuthMetadataMethod): Type of authorization method.
    85 
    +            secret (str): The secret or key to be used for validating request,
    86 
    +                depending on `method`. Defaults to ``None``.
    87 
    +            algorithm (AuthMetadataAlgorithm): The crytographic algorithm used
    88 
    +                to encode `secret`. Defaults to ``AuthMetadataAlgorithm.NONE``.
    89 
    +
    90 
    +        Raises:
    91 
    +            InvalidArgumentError: If no authorization method is specified if
    92 
    +                `method` is not supported or if `algorithm` is not supported for
    93 
    +                `method`.
    94 
    +        """
    95 
    +        self.__logger = logging.getLogger(__name__)
    96 
    +
    97 
    +        self.__bearer_cache = {}
    98 
    +        self.__terminators = {}
    99 
    +        self.__validator = None
    100 
    +        self.__secret = secret
    101 
    +
    102 
    +        self._method = method
    103 
    +        self._algorithm = algorithm
    104 
    +
    105 
    +        if self._method == AuthMetadataMethod.JWT:
    106 
    +            if not HAVE_JWT:
    107 
    +                raise InvalidArgumentError("JWT authorization method requires PyJWT")
    108 
    +
    109 
    +            try:
    110 
    +                jwt.register_algorithm(self._algorithm.value, None)
    111 
    +            except TypeError:
    112 
    +                raise InvalidArgumentError("Algorithm not supported for JWT decoding: [{}]"
    113 
    +                                           .format(self._algorithm))
    114 
    +            except ValueError:
    115 
    +                pass
    116 
    +
    117 
    +            self.__validator = self._validate_jwt_token
    118 
    +
    119 
    +        else:
    120 
    +            raise InvalidArgumentError("Authorization method must be specified")
    121 
    +
    122 
    +        for code, message in self.__auth_errors.items():
    123 
    +            self.__terminators[code] = _unary_unary_rpc_terminator(message)
    124 
    +
    125 
    +    @property
    126 
    +    def method(self):
    127 
    +        return self._method
    128 
    +
    129 
    +    @property
    130 
    +    def algorithm(self):
    131 
    +        return self._algorithm
    132 
    +
    133 
    +    def intercept_service(self, continuation, handler_call_details):
    134 
    +        try:
    135 
    +            # Reject requests not carrying a token:
    136 
    +            bearer = dict(handler_call_details.invocation_metadata)['authorization']
    137 
    +
    138 
    +        except KeyError:
    139 
    +            self.__logger.error("Rejecting '{}' request: {}"
    140 
    +                                .format(handler_call_details.method.split('/')[-1],
    141 
    +                                        self.__auth_errors['missing-bearer']))
    142 
    +            return self.__terminators['missing-bearer']
    143 
    +
    144 
    +        # Reject requests with malformated bearer:
    145 
    +        if not bearer.startswith('Bearer '):
    146 
    +            self.__logger.error("Rejecting '{}' request: {}"
    147 
    +                                .format(handler_call_details.method.split('/')[-1],
    148 
    +                                        self.__auth_errors['invalid-bearer']))
    149 
    +            return self.__terminators['invalid-bearer']
    150 
    +
    151 
    +        try:
    152 
    +            # Hit the cache for already validated token:
    153 
    +            expiration_time = self.__bearer_cache[bearer]
    154 
    +
    155 
    +            # Accept request if cached token hasn't expired yet:
    156 
    +            if expiration_time < datetime.utcnow():
    157 
    +                return continuation(handler_call_details)  # Accepted
    158 
    +
    159 
    +        except KeyError:
    160 
    +            pass
    161 
    +
    162 
    +        try:
    163 
    +            # Decode and validate the new token:
    164 
    +            expiration_time = self.__validator(bearer[7:])
    165 
    +
    166 
    +        except _InvalidTokenError as e:
    167 
    +            self.__logger.error("Rejecting '{}' request: {}; {}"
    168 
    +                                .format(handler_call_details.method.split('/')[-1],
    169 
    +                                        self.__auth_errors['invalid-token'], str(e)))
    170 
    +            return self.__terminators['invalid-token']
    171 
    +
    172 
    +        except _ExpiredTokenError as e:
    173 
    +            self.__logger.error("Rejecting '{}' request: {}; {}"
    174 
    +                                .format(handler_call_details.method.split('/')[-1],
    175 
    +                                        self.__auth_errors['expired-token'], str(e)))
    176 
    +            return self.__terminators['expired-token']
    177 
    +
    178 
    +        except _UnboundedTokenError as e:
    179 
    +            self.__logger.error("Rejecting '{}' request: {}; {}"
    180 
    +                                .format(handler_call_details.method.split('/')[-1],
    181 
    +                                        self.__auth_errors['unbounded-token'], str(e)))
    182 
    +            return self.__terminators['unbounded-token']
    183 
    +
    184 
    +        # Cache the validated token and store expiration time:
    185 
    +        self.__bearer_cache[bearer] = expiration_time
    186 
    +
    187 
    +        return continuation(handler_call_details)  # Accepted
    188 
    +
    189 
    +    def _validate_jwt_token(self, token):
    190 
    +        try:
    191 
    +            payload = jwt.decode(
    192 
    +                token, self.__secret, algorithms=[self._algorithm.value])
    193 
    +
    194 
    +        except jwt.exceptions.ExpiredSignatureError as e:
    195 
    +            raise _ExpiredTokenError(e)
    196 
    +
    197 
    +        except jwt.exceptions.InvalidTokenError as e:
    198 
    +            raise _InvalidTokenError(e)
    199 
    +
    200 
    +        if 'exp' not in payload or not isinstance(payload['exp'], int):
    201 
    +            raise _UnboundedTokenError("Missing 'exp' in payload")
    202 
    +
    203 
    +        return datetime.fromtimestamp(payload['exp'])
    204 
    +
    205 
    +
    206 
    +def _unary_unary_rpc_terminator(details):
    207 
    +
    208 
    +    def terminate(ignored_request, context):
    209 
    +        context.abort(grpc.StatusCode.UNAUTHENTICATED, details)
    210 
    +
    211 
    +    return grpc.unary_unary_rpc_method_handler(terminate)

  • buildgrid/server/cas/instance.py
    ... ... @@ -24,7 +24,7 @@ import logging
    24 24 
     from buildgrid._exceptions import InvalidArgumentError, NotFoundError, OutOfRangeError
    25 25 
     from buildgrid._protos.google.bytestream import bytestream_pb2
    26 26 
     from buildgrid._protos.build.bazel.remote.execution.v2 import remote_execution_pb2 as re_pb2
    27 
    -from buildgrid.settings import HASH, HASH_LENGTH
    27 
    +from buildgrid.settings import HASH, HASH_LENGTH, MAX_REQUEST_SIZE, MAX_REQUEST_COUNT
    28 28 
     from buildgrid.utils import get_hash_type
    29 29
    30 30
    ... ... @@ -42,9 +42,7 @@ class ContentAddressableStorageInstance:
    42 42 
             return get_hash_type()
    43 43
    44 44 
         def max_batch_total_size_bytes(self):
    45 
    -        # TODO: link with max size
    46 
    -        # Should be added from settings in MR !119
    47 
    -        return 2000000
    45 
    +        return MAX_REQUEST_SIZE
    48 46
    49 47 
         def symlink_absolute_path_strategy(self):
    50 48 
             # Currently this strategy is hardcoded into BuildGrid
    ... ... @@ -72,6 +70,41 @@ class ContentAddressableStorageInstance:
    72 70
    73 71 
             return response
    74 72
    73 
    +    def get_tree(self, request):
    74 
    +        storage = self._storage
    75 
    +
    76 
    +        response = re_pb2.GetTreeResponse()
    77 
    +        page_size = request.page_size
    78 
    +
    79 
    +        if not request.page_size:
    80 
    +            request.page_size = MAX_REQUEST_COUNT
    81 
    +
    82 
    +        root_digest = request.root_digest
    83 
    +        page_size = request.page_size
    84 
    +
    85 
    +        def __get_tree(node_digest):
    86 
    +            nonlocal response, page_size, request
    87 
    +
    88 
    +            if not page_size:
    89 
    +                page_size = request.page_size
    90 
    +                yield response
    91 
    +                response = re_pb2.GetTreeResponse()
    92 
    +
    93 
    +            if response.ByteSize() >= (MAX_REQUEST_SIZE):
    94 
    +                yield response
    95 
    +                response = re_pb2.GetTreeResponse()
    96 
    +
    97 
    +            directory_from_digest = storage.get_message(node_digest, re_pb2.Directory)
    98 
    +            page_size -= 1
    99 
    +            response.directories.extend([directory_from_digest])
    100 
    +
    101 
    +            for directory in directory_from_digest.directories:
    102 
    +                yield from __get_tree(directory.digest)
    103 
    +
    104 
    +            yield response
    105 
    +
    106 
    +        return __get_tree(root_digest)
    107 
    +
    75 108
    76 109 
     class ByteStreamInstance:
    77 110

  • buildgrid/server/cas/service.py
    ... ... @@ -86,10 +86,16 @@ class ContentAddressableStorageService(remote_execution_pb2_grpc.ContentAddressa
    86 86 
         def GetTree(self, request, context):
    87 87 
             self.__logger.debug("GetTree request from [%s]", context.peer())
    88 88
    89 
    -        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
    90 
    -        context.set_details('Method not implemented!')
    89 
    +        try:
    90 
    +            instance = self._get_instance(request.instance_name)
    91 
    +            yield from instance.get_tree(request)
    92 
    +
    93 
    +        except InvalidArgumentError as e:
    94 
    +            self.__logger.error(e)
    95 
    +            context.set_details(str(e))
    96 
    +            context.set_code(grpc.StatusCode.INVALID_ARGUMENT)
    91 97
    92 
    -        return iter([remote_execution_pb2.GetTreeResponse()])
    98 
    +            yield remote_execution_pb2.GetTreeResponse()
    93 99
    94 100 
         def _get_instance(self, instance_name):
    95 101 
             try:

  • buildgrid/server/instance.py
    ... ... @@ -26,6 +26,7 @@ import grpc
    26 26 
     from buildgrid._enums import BotStatus, MetricRecordDomain, MetricRecordType
    27 27 
     from buildgrid._protos.buildgrid.v2 import monitoring_pb2
    28 28 
     from buildgrid.server.actioncache.service import ActionCacheService
    29 
    +from buildgrid.server._authentication import AuthMetadataMethod, AuthMetadataAlgorithm, AuthMetadataServerInterceptor
    29 30 
     from buildgrid.server.bots.service import BotsService
    30 31 
     from buildgrid.server.cas.service import ByteStreamService, ContentAddressableStorageService
    31 32 
     from buildgrid.server.execution.service import ExecutionService
    ... ... @@ -44,11 +45,21 @@ class BuildGridServer:
    44 45 
         requisite services.
    45 46 
         """
    46 47
    47 
    -    def __init__(self, max_workers=None, monitor=False):
    48 
    +    def __init__(self, max_workers=None, monitor=False, auth_method=AuthMetadataMethod.NONE,
    49 
    +                 auth_secret=None, auth_algorithm=AuthMetadataAlgorithm.NONE):
    48 50 
             """Initializes a new :class:`BuildGridServer` instance.
    49 51
    50 52 
             Args:
    51 53 
                 max_workers (int, optional): A pool of max worker threads.
    54 
    +            monitor (bool, optional): Whether or not to globally activate server
    55 
    +                monitoring. Defaults to ``False``.
    56 
    +            auth_method (AuthMetadataMethod, optional): Authentication method to
    57 
    +                be used for request authorization. Defaults to ``NONE``.
    58 
    +            auth_secret (str, optional): The secret or key to be used for
    59 
    +                authorizing request using `auth_method`. Defaults to ``None``.
    60 
    +            auth_algorithm (AuthMetadataAlgorithm, optional): The crytographic
    61 
    +                algorithm to be uses in combination with `auth_secret` for
    62 
    +                authorizing request using `auth_method`. Defaults to ``NONE``.
    52 63 
             """
    53 64 
             self.__logger = logging.getLogger(__name__)
    54 65
    ... ... @@ -56,8 +67,17 @@ class BuildGridServer:
    56 67 
                 # Use max_workers default from Python 3.5+
    57 68 
                 max_workers = (os.cpu_count() or 1) * 5
    58 69
    70 
    +        self.__grpc_auth_interceptor = None
    71 
    +        if auth_method != AuthMetadataMethod.NONE:
    72 
    +            self.__grpc_auth_interceptor = AuthMetadataServerInterceptor(
    73 
    +                method=auth_method , secret=auth_secret , algorithm=auth_algorithm)
    59 74 
             self.__grpc_executor = futures.ThreadPoolExecutor(max_workers)
    60 
    -        self.__grpc_server = grpc.server(self.__grpc_executor)
    75 
    +
    76 
    +        if self.__grpc_auth_interceptor is not None:
    77 
    +            self.__grpc_server = grpc.server(
    78 
    +                self.__grpc_executor, interceptors=(self.__grpc_auth_interceptor,))
    79 
    +        else:
    80 
    +            self.__grpc_server = grpc.server(self.__grpc_executor)
    61 81
    62 82 
             self.__main_loop = asyncio.get_event_loop()
    63 83 
             self.__monitoring_bus = None

  • buildgrid/settings.py
    ... ... @@ -24,3 +24,9 @@ HASH_LENGTH = HASH().digest_size * 2
    24 24
    25 25 
     # Period, in seconds, for the monitoring cycle:
    26 26 
     MONITORING_PERIOD = 5.0
    27 
    +
    28 
    +# Maximum size for a single gRPC request:
    29 
    +MAX_REQUEST_SIZE = 2 * 1024 * 1024
    30 
    +
    31 
    +# Maximum number of elements per gRPC request:
    32 
    +MAX_REQUEST_COUNT = 500

  • docs/source/installation.rst
    ... ... @@ -59,20 +59,20 @@ have to adjust your ``PATH``, in ``~/.bashrc``, with:
    59 59
    60 60 
     .. note::
    61 61
    62 
    -   The ``setup.py`` script defines two extra targets, ``docs`` and ``tests``,
    63 
    -   that declare required dependency for, respectively, generating documentation
    64 
    -   and running unit-tests. They can be use as helpers for setting up a
    65 
    -   development environment. To use them simply run:
    62 
    +   The ``setup.py`` script defines three extra targets, ``auth``, ``docs`` and
    63 
    +   ``tests``. They declare required dependency for, respectively, authentication
    64 
    +   and authorization management, generating documentation and running
    65 
    +   unit-tests. They can be use as helpers for setting up a development
    66 
    +   environment. To use them simply run:
    66 67
    67 68 
        .. code-block:: sh
    68 69
    69 
    -      pip3 install --user --editable ".[docs,tests]"
    70 
    -
    70 
    +      pip3 install --user --editable ".[auth,docs,tests]"
    71 71
    72 72
    73 73 
     .. install-docker:
    74 74
    75 
    -Installation through docker
    75 
    +Installation through Docker
    76 76 
     ---------------------------
    77 77
    78 78 
     How to build a Docker image that runs BuildGrid.

  • setup.py
    ... ... @@ -85,6 +85,11 @@ def get_cmdclass():
    85 85 
         }
    86 86 
         return cmdclass
    87 87
    88 
    +auth_require = [
    89 
    +    'cryptography >= 1.8.0',  # Required by pyjwt for RSA
    90 
    +    'pyjwt >= 1.5.0',
    91 
    +]
    92 
    +
    88 93 
     tests_require = [
    89 94 
         'coverage >= 4.5.0',
    90 95 
         'moto < 1.3.7',
    ... ... @@ -130,6 +135,7 @@ setup(
    130 135 
         setup_requires=['pytest-runner'],
    131 136 
         tests_require=tests_require,
    132 137 
         extras_require={
    138 
    +        'auth': auth_require,
    133 139 
             'docs': docs_require,
    134 140 
             'tests': tests_require,
    135 141 
         },

  • tests/auth/test_client_interceptor.py
    1 
    +# Copyright (C) 2018 Bloomberg LP
    2 
    +#
    3 
    +# Licensed under the Apache License, Version 2.0 (the "License");
    4 
    +# you may not use this file except in compliance with the License.
    5 
    +# You may obtain a copy of the License at
    6 
    +#
    7 
    +#  <http://www.apache.org/licenses/LICENSE-2.0>
    8 
    +#
    9 
    +# Unless required by applicable law or agreed to in writing, software
    10 
    +# distributed under the License is distributed on an "AS IS" BASIS,
    11 
    +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12 
    +# See the License for the specific language governing permissions and
    13 
    +# limitations under the License.
    14 
    +
    15 
    +
    16 
    +from buildgrid.client.authentication import AuthMetadataClientInterceptor

  • tests/auth/test_server_interceptor.py
    1 
    +# Copyright (C) 2018 Bloomberg LP
    2 
    +#
    3 
    +# Licensed under the Apache License, Version 2.0 (the "License");
    4 
    +# you may not use this file except in compliance with the License.
    5 
    +# You may obtain a copy of the License at
    6 
    +#
    7 
    +#  <http://www.apache.org/licenses/LICENSE-2.0>
    8 
    +#
    9 
    +# Unless required by applicable law or agreed to in writing, software
    10 
    +# distributed under the License is distributed on an "AS IS" BASIS,
    11 
    +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12 
    +# See the License for the specific language governing permissions and
    13 
    +# limitations under the License.
    14 
    +
    15 
    +
    16 
    +import pytest
    17 
    +
    18 
    +from buildgrid.server._authentication import AuthMetadataMethod, AuthMetadataAlgorithm, AuthMetadataServerInterceptor
    19 
    +
    20 
    +
    21 
    +try:
    22 
    +    import jwt
    23 
    +except ImportError:
    24 
    +    HAVE_JWT = False
    25 
    +else:
    26 
    +    HAVE_JWT = True
    27 
    +
    28 
    +
    29 
    +TOKENS = [None, 'not-a-token']
    30 
    +SECRETS = [None, None]
    31 
    +ALGORITHMS = [None, None]
    32 
    +VALIDITY = [False, False]
    33 
    +# Generic test data: token, secret, algorithm, validity
    34 
    +DATA = zip(TOKENS, SECRETS, ALGORITHMS, VALIDITY)
    35 
    +
    36 
    +JWT_TOKENS = [
    37 
    +    '.'.join(['eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9',
    38 
    +              'eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ',
    39 
    +              'SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c']),
    40 
    +    '.'.join(['eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9',
    41 
    +              'eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0',
    42 
    +              'TCYt5XsITJX1CxPCT8yAV-TVkIEq_PbChOMqsLfRoPsnsgw5WEuts01mq-pQy7UJiN5mgRxD-WUcX16dUEMGlv50aqzpqh4Qktb3rk-BuQy72IFLOqV0G_zS245-kronKb78cPN25DGlcTwLtjPAYuNzVBAh4vGHSrQyHUdBBPM'])]
    43 
    +JWT_SECRETS = [
    44 
    +    'your-256-bit-secret',
    45 
    +    '\n'.join(['-----BEGIN PUBLIC KEY-----',
    46 
    +               'MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDdlatRjRjogo3WojgGHFHYLugd',
    47 
    +               'UWAY9iR3fy4arWNA1KoS8kVw33cJibXr8bvwUAUparCwlvdbH6dvEOfou0/gCFQs',
    48 
    +               'HUfQrSDv+MuSUMAe8jzKE4qW+jK+xQU9a03GUnKHkkle+Q0pX/g6jXZ7r1/xAK5D',
    49 
    +               'o2kQ+X5xK9cipRgEKwIDAQAB',
    50 
    +               '-----END PUBLIC KEY-----'])]
    51 
    +JWT_ALGORITHMS = [
    52 
    +    AuthMetadataAlgorithm.JWT_HS256,
    53 
    +    AuthMetadataAlgorithm.JWT_RS256]
    54 
    +JWT_VALIDITY = [
    55 
    +    False,
    56 
    +    False]
    57 
    +# JWT test data: token, secret, algorithm, validity
    58 
    +JWT_DATA = zip(JWT_TOKENS, JWT_SECRETS, JWT_ALGORITHMS, JWT_VALIDITY)
    59 
    +
    60 
    +
    61 
    +@pytest.mark.parametrize('token,secret,algorithm,validity', DATA)
    62 
    +def test_authorization_rejections(token, secret, algorithm, validity):
    63 
    +    interceptor = AuthMetadataServerInterceptor(
    64 
    +        method=AuthMetadataMethod.NONE, secret=secret, algorithm=algorithm)
    65 
    +    pass
    66 
    +
    67 
    +
    68 
    +@pytest.mark.skipif(not HAVE_JWT, reason="No pyjwt")
    69 
    +@pytest.mark.parametrize('token,secret,algorithm,validity', JWT_DATA)
    70 
    +def test_jwt_token_validation(token, secret, algorithm, validity):
    71 
    +    interceptor = AuthMetadataServerInterceptor(
    72 
    +        method=AuthMetadataMethod.JWT, secret=secret, algorithm=algorithm)
    73 
    +    pass

    • —
    View it on GitLab.
    You're receiving this email because of your account on gitlab.com. If you'd like to receive fewer emails, you can adjust your notification settings.

    [Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]