[gnome-software/wip/rancell/snapauth: 9/9] snapd: Use snap authentication
- From: Robert Ancell <rancell src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [gnome-software/wip/rancell/snapauth: 9/9] snapd: Use snap authentication
- Date: Mon, 4 Jul 2016 00:07:52 +0000 (UTC)
commit 54d259e4635cd3a61973c4117877aa0f83813201
Author: Robert Ancell <robert ancell canonical com>
Date: Fri Jul 1 15:33:07 2016 +1200
snapd: Use snap authentication
src/plugins/gs-plugin-snap.c | 203 ++++++++++++++++++++++++++++++++++++++----
src/plugins/gs-snapd.c | 130 +++++++++++++++++----------
src/plugins/gs-snapd.h | 18 +++-
3 files changed, 282 insertions(+), 69 deletions(-)
---
diff --git a/src/plugins/gs-plugin-snap.c b/src/plugins/gs-plugin-snap.c
index 3e15380..0ea2913 100644
--- a/src/plugins/gs-plugin-snap.c
+++ b/src/plugins/gs-plugin-snap.c
@@ -26,17 +26,29 @@
#include "gs-snapd.h"
+struct GsPluginData {
+ GsAuth *auth;
+ gchar *macaroon;
+ gchar **discharges;
+};
+
typedef gboolean (*AppFilterFunc)(const gchar *id, JsonObject *object, gpointer data);
void
gs_plugin_initialize (GsPlugin *plugin)
{
+ GsPluginData *priv = gs_plugin_alloc_data (plugin, sizeof(GsPluginData));
+
if (!gs_snapd_exists ()) {
g_debug ("disabling '%s' as snapd not running",
gs_plugin_get_name (plugin));
gs_plugin_set_enabled (plugin, FALSE);
}
+ priv->auth = gs_auth_new ("snapd");
+ gs_auth_set_provider_name (priv->auth, "Snap Store");
+ gs_plugin_add_auth (plugin, priv->auth);
+
gs_plugin_add_rule (plugin, GS_PLUGIN_RULE_RUN_AFTER, "desktop-categories");
gs_plugin_add_rule (plugin, GS_PLUGIN_RULE_RUN_AFTER, "ubuntu-reviews");
gs_plugin_add_rule (plugin, GS_PLUGIN_RULE_BETTER_THAN, "packagekit");
@@ -86,6 +98,7 @@ parse_result (const gchar *response, const gchar *response_type, GError **error)
static void
refine_app (GsPlugin *plugin, GsApp *app, JsonObject *package)
{
+ GsPluginData *priv = gs_plugin_get_data (plugin);
const gchar *status, *icon_url;
g_autoptr(GdkPixbuf) icon_pixbuf = NULL;
gint64 size = -1;
@@ -124,7 +137,8 @@ refine_app (GsPlugin *plugin, GsApp *app, JsonObject *package)
g_autofree gchar *icon_response = NULL;
gsize icon_response_length;
- if (gs_snapd_request ("GET", icon_url, NULL, NULL, TRUE, NULL,
+ if (gs_snapd_request ("GET", icon_url, NULL,
+ priv->macaroon, priv->discharges,
NULL, NULL, NULL,
&icon_response, &icon_response_length,
NULL)) {
@@ -177,6 +191,7 @@ get_apps (GsPlugin *plugin,
gpointer user_data,
GError **error)
{
+ GsPluginData *priv = gs_plugin_get_data (plugin);
guint status_code;
GPtrArray *query_fields;
g_autoptr (GString) path = NULL;
@@ -207,10 +222,11 @@ get_apps (GsPlugin *plugin,
g_string_append (path, fields);
}
g_ptr_array_free (query_fields, TRUE);
- if (!gs_snapd_request ("GET", path->str, NULL, NULL, TRUE, NULL,
+ if (!gs_snapd_request ("GET", path->str, NULL,
+ priv->macaroon, priv->discharges,
&status_code, &reason_phrase,
- &response_type, &response,
- NULL, error))
+ &response_type, &response, NULL,
+ error))
return FALSE;
if (status_code != SOUP_STATUS_OK) {
@@ -257,6 +273,7 @@ get_apps (GsPlugin *plugin,
static gboolean
get_app (GsPlugin *plugin, GsApp *app, GError **error)
{
+ GsPluginData *priv = gs_plugin_get_data (plugin);
guint status_code;
g_autofree gchar *path = NULL;
g_autofree gchar *reason_phrase = NULL;
@@ -271,10 +288,11 @@ get_app (GsPlugin *plugin, GsApp *app, GError **error)
guint i;
path = g_strdup_printf ("/v2/snaps/%s", gs_app_get_id (app));
- if (!gs_snapd_request ("GET", path, NULL, NULL, TRUE, NULL,
+ if (!gs_snapd_request ("GET", path, NULL,
+ priv->macaroon, priv->discharges,
&status_code, &reason_phrase,
- &response_type, &response,
- NULL, error))
+ &response_type, &response, NULL,
+ error))
return FALSE;
if (status_code == SOUP_STATUS_NOT_FOUND) {
@@ -284,10 +302,11 @@ get_app (GsPlugin *plugin, GsApp *app, GError **error)
g_clear_pointer (&response, g_free);
path = g_strdup_printf ("/v2/find?q=%s", gs_app_get_id (app));
- if (!gs_snapd_request ("GET", path, NULL, NULL, TRUE, NULL,
+ if (!gs_snapd_request ("GET", path, NULL,
+ priv->macaroon, priv->discharges,
&status_code, &reason_phrase,
- &response_type, &response,
- NULL, error))
+ &response_type, &response, NULL,
+ error))
return FALSE;
}
@@ -337,6 +356,10 @@ get_app (GsPlugin *plugin, GsApp *app, GError **error)
void
gs_plugin_destroy (GsPlugin *plugin)
{
+ GsPluginData *priv = gs_plugin_get_data (plugin);
+ g_clear_object (&priv->auth);
+ g_free (priv->macaroon);
+ g_strfreev (priv->discharges);
}
static gboolean
@@ -387,6 +410,7 @@ send_package_action (GsPlugin *plugin,
const gchar *action,
GError **error)
{
+ GsPluginData *priv = gs_plugin_get_data (plugin);
g_autofree gchar *content = NULL, *path = NULL;
guint status_code;
g_autofree gchar *reason_phrase = NULL;
@@ -401,16 +425,24 @@ send_package_action (GsPlugin *plugin,
const gchar *resource_path;
const gchar *type;
const gchar *change_id;
- g_autoptr(GVariant) macaroon = NULL;
content = g_strdup_printf ("{\"action\": \"%s\"}", action);
path = g_strdup_printf ("/v2/snaps/%s", id);
- if (!gs_snapd_request ("POST", path, content, NULL, TRUE,
- &macaroon, &status_code,
- &reason_phrase, &response_type,
- &response, NULL, error))
+ if (!gs_snapd_request ("POST", path, content,
+ priv->macaroon, priv->discharges,
+ &status_code, &reason_phrase,
+ &response_type, &response, NULL,
+ error))
return FALSE;
+ if (status_code == SOUP_STATUS_UNAUTHORIZED) {
+ g_set_error_literal (error,
+ GS_PLUGIN_ERROR,
+ GS_PLUGIN_ERROR_AUTH_REQUIRED,
+ "Requires authentication with @snapd");
+ return FALSE;
+ }
+
if (status_code != SOUP_STATUS_ACCEPTED) {
g_set_error (error,
GS_PLUGIN_ERROR,
@@ -440,10 +472,11 @@ send_package_action (GsPlugin *plugin,
/* Wait for a little bit before polling */
g_usleep (100 * 1000);
- if (!gs_snapd_request ("GET", resource_path, NULL, macaroon, TRUE, NULL,
+ if (!gs_snapd_request ("GET", resource_path, NULL,
+ priv->macaroon, priv->discharges,
&status_code, &status_reason_phrase,
- &status_response_type, &status_response,
- NULL, error)) {
+ &status_response_type, &status_response, NULL,
+ error)) {
return FALSE;
}
@@ -545,3 +578,137 @@ gs_plugin_app_remove (GsPlugin *plugin,
gs_app_set_state (app, AS_APP_STATE_AVAILABLE);
return TRUE;
}
+
+gboolean
+gs_plugin_auth_login (GsPlugin *plugin, GsAuth *auth,
+ GCancellable *cancellable, GError **error)
+{
+ GsPluginData *priv = gs_plugin_get_data (plugin);
+ g_autoptr(JsonBuilder) builder = NULL;
+ g_autoptr(JsonNode) json_root = NULL;
+ g_autoptr(JsonGenerator) json_generator = NULL;
+ g_autofree gchar *data = NULL;
+ guint status_code;
+ g_autofree gchar *reason_phrase = NULL;
+ g_autofree gchar *response_type = NULL;
+ g_autofree gchar *response = NULL;
+ g_autoptr(JsonObject) result = NULL;
+ JsonArray *discharges;
+ guint i;
+
+ if (auth != priv->auth)
+ return TRUE;
+
+ builder = json_builder_new ();
+ json_builder_begin_object (builder);
+ json_builder_set_member_name (builder, "username");
+ json_builder_add_string_value (builder, gs_auth_get_username (auth));
+ json_builder_set_member_name (builder, "password");
+ json_builder_add_string_value (builder, gs_auth_get_password (auth));
+ if (gs_auth_get_pin (auth)) {
+ json_builder_set_member_name (builder, "otp");
+ json_builder_add_string_value (builder, gs_auth_get_pin (auth));
+ }
+ json_builder_end_object (builder);
+
+ json_root = json_builder_get_root (builder);
+ json_generator = json_generator_new ();
+ json_generator_set_pretty (json_generator, TRUE);
+ json_generator_set_root (json_generator, json_root);
+ data = json_generator_to_data (json_generator, NULL);
+ if (data == NULL) {
+ g_set_error_literal (error,
+ GS_PLUGIN_ERROR,
+ GS_PLUGIN_ERROR_FAILED,
+ "Failed to generate JSON request");
+ return FALSE;
+ }
+
+ if (!gs_snapd_request ("POST", "/v2/login", data,
+ priv->macaroon, priv->discharges,
+ &status_code, &reason_phrase,
+ &response_type, &response, NULL,
+ error))
+ return FALSE;
+
+ if (status_code != SOUP_STATUS_OK) {
+ g_autofree gchar *error_message = NULL;
+ g_autofree gchar *error_kind = NULL;
+
+ if (!gs_snapd_parse_error (response_type, response, &error_message, &error_kind, error))
+ return FALSE;
+
+ if (g_strcmp0 (error_kind, "two-factor-required") == 0) {
+ g_set_error_literal (error,
+ GS_PLUGIN_ERROR,
+ GS_PLUGIN_ERROR_PIN_REQUIRED,
+ error_message);
+ }
+ else {
+ g_set_error_literal (error,
+ GS_PLUGIN_ERROR,
+ GS_PLUGIN_ERROR_FAILED,
+ error_message);
+ }
+ return FALSE;
+ }
+
+ if (!gs_snapd_parse_result (response_type, response, &result, error))
+ return FALSE;
+
+ g_free (priv->macaroon);
+ priv->macaroon = json_object_get_string_member (result, "macaroon");
+ g_strfreev (priv->discharges);
+ discharges = json_object_get_array_member (result, "discharges");
+ priv->discharges = g_new0 (gchar *, json_array_get_length (discharges) + 1);
+ for (i = 0; i < json_array_get_length (discharges); i++) {
+ JsonNode *node;
+ node = json_array_get_element (discharges, i);
+ if (!JSON_NODE_HOLDS_VALUE (node) && json_node_get_value_type (node) != G_TYPE_STRING) {
+ g_set_error_literal (error,
+ GS_PLUGIN_ERROR,
+ GS_PLUGIN_ERROR_FAILED,
+ "Macaroon discharge contains unexpected value");
+ return FALSE;
+ }
+ priv->discharges[i] = json_node_dup_string (node);
+ }
+
+ gs_auth_add_flags (priv->auth, GS_AUTH_FLAG_VALID);
+
+ return TRUE;
+}
+
+gboolean
+gs_plugin_auth_lost_password (GsPlugin *plugin, GsAuth *auth,
+ GCancellable *cancellable, GError **error)
+{
+ GsPluginData *priv = gs_plugin_get_data (plugin);
+
+ if (auth != priv->auth)
+ return TRUE;
+
+ /* return with data */
+ /*g_set_error (error,
+ GS_PLUGIN_ERROR,
+ GS_PLUGIN_ERROR_AUTH_INVALID,
+ "do online using @%s/+forgot_password", UBUNTU_LOGIN_HOST);*/
+ return FALSE;
+}
+
+gboolean
+gs_plugin_auth_register (GsPlugin *plugin, GsAuth *auth,
+ GCancellable *cancellable, GError **error)
+{
+ GsPluginData *priv = gs_plugin_get_data (plugin);
+
+ if (auth != priv->auth)
+ return TRUE;
+
+ /* return with data */
+ /*g_set_error (error,
+ GS_PLUGIN_ERROR,
+ GS_PLUGIN_ERROR_AUTH_INVALID,
+ "do online using @%s/+login", UBUNTU_LOGIN_HOST);*/
+ return FALSE;
+}
diff --git a/src/plugins/gs-snapd.c b/src/plugins/gs-snapd.c
index c11b1ce..426a349 100644
--- a/src/plugins/gs-snapd.c
+++ b/src/plugins/gs-snapd.c
@@ -94,9 +94,8 @@ gboolean
gs_snapd_request (const gchar *method,
const gchar *path,
const gchar *content,
- GVariant *macaroon,
- gboolean retry_after_login,
- GVariant **out_macaroon,
+ const gchar *macaroon,
+ gchar **discharges,
guint *status_code,
gchar **reason_phrase,
gchar **response_type,
@@ -112,11 +111,7 @@ gs_snapd_request (const gchar *method,
g_autoptr (SoupMessageHeaders) headers = NULL;
gsize chunk_length, n_required;
gchar *chunk_start = NULL;
- const gchar *root;
- const gchar *discharge;
- GVariantIter *iter;
guint code;
- gboolean ret;
// NOTE: Would love to use libsoup but it doesn't support unix sockets
// https://bugzilla.gnome.org/show_bug.cgi?id=727563
@@ -129,13 +124,11 @@ gs_snapd_request (const gchar *method,
g_string_append_printf (request, "%s %s HTTP/1.1\r\n", method, path);
g_string_append (request, "Host:\r\n");
if (macaroon != NULL) {
- g_variant_get (macaroon, "(&sas)", &root, &iter);
- g_string_append_printf (request, "Authorization: Macaroon root=\"%s\"", root);
+ gint i;
- while (g_variant_iter_next (iter, "&s", &discharge))
- g_string_append_printf (request, ",discharge=\"%s\"", discharge);
-
- g_variant_iter_free (iter);
+ g_string_append_printf (request, "Authorization: Macaroon root=\"%s\"", macaroon);
+ for (i = 0; discharges[i] != NULL; i++)
+ g_string_append_printf (request, ",discharge=\"%s\"", discharges[i]);
g_string_append (request, "\r\n");
}
if (content)
@@ -187,39 +180,6 @@ gs_snapd_request (const gchar *method,
if (status_code != NULL)
*status_code = code;
- if ((code == 401 || code == 403) && retry_after_login) {
- g_socket_close (socket, NULL);
-
- if (macaroon == NULL) {
- g_set_error_literal (error,
- GS_PLUGIN_ERROR,
- GS_PLUGIN_ERROR_AUTH_REQUIRED,
- "failed to authenticate");
- return FALSE;
- }
-
- ret = gs_snapd_request (method,
- path,
- content,
- macaroon,
- FALSE,
- NULL,
- status_code,
- reason_phrase,
- response_type,
- response,
- response_length,
- error);
-
- if (ret && out_macaroon != NULL) {
- *out_macaroon = macaroon;
- } else {
- g_variant_unref (macaroon);
- }
-
- return ret;
- }
-
/* work out how much data to follow */
if (g_strcmp0 (soup_message_headers_get_one (headers, "Transfer-Encoding"),
"chunked") == 0) {
@@ -281,8 +241,6 @@ gs_snapd_request (const gchar *method,
error))
return FALSE;
- if (out_macaroon != NULL)
- *out_macaroon = g_variant_ref (macaroon);
if (response_type)
*response_type = g_strdup (soup_message_headers_get_one (headers, "Content-Type"));
if (response) {
@@ -296,3 +254,79 @@ gs_snapd_request (const gchar *method,
return TRUE;
}
+
+gboolean
+gs_snapd_parse_result (const gchar *response_type,
+ const gchar *response,
+ JsonObject **result,
+ GError **error)
+{
+ g_autoptr(JsonParser) parser = NULL;
+ g_autoptr(GError) error_local = NULL;
+ JsonObject *root;
+
+ if (response_type == NULL) {
+ g_set_error_literal (error,
+ GS_PLUGIN_ERROR,
+ GS_PLUGIN_ERROR_FAILED,
+ "snapd returned no content type");
+ return FALSE;
+ }
+ if (g_strcmp0 (response_type, "application/json") != 0) {
+ g_set_error (error,
+ GS_PLUGIN_ERROR,
+ GS_PLUGIN_ERROR_FAILED,
+ "snapd returned unexpected content type %s", response_type);
+ return FALSE;
+ }
+
+ parser = json_parser_new ();
+ if (!json_parser_load_from_data (parser, response, -1, &error_local)) {
+ g_set_error (error,
+ GS_PLUGIN_ERROR,
+ GS_PLUGIN_ERROR_FAILED,
+ "Unable to parse snapd response: %s",
+ error_local->message);
+ return FALSE;
+ }
+
+ if (!JSON_NODE_HOLDS_OBJECT (json_parser_get_root (parser))) {
+ g_set_error_literal (error,
+ GS_PLUGIN_ERROR,
+ GS_PLUGIN_ERROR_FAILED,
+ "snapd response does is not a valid JSON object");
+ return FALSE;
+ }
+ root = json_node_get_object (json_parser_get_root (parser));
+ if (!json_object_has_member (root, "result")) {
+ g_set_error_literal (error,
+ GS_PLUGIN_ERROR,
+ GS_PLUGIN_ERROR_FAILED,
+ "snapd response does not contain a \"result\" field");
+ return FALSE;
+ }
+ if (result != NULL)
+ *result = json_object_ref (json_object_get_object_member (root, "result"));
+
+ return TRUE;
+}
+
+gboolean
+gs_snapd_parse_error (const gchar *response_type,
+ const gchar *response,
+ gchar **message,
+ gchar **kind,
+ GError **error)
+{
+ g_autoptr(JsonObject) result = NULL;
+
+ if (!gs_snapd_parse_result (response_type, response, &result, error))
+ return FALSE;
+
+ if (message != NULL)
+ *message = g_strdup (json_object_get_string_member (result, "message"));
+ if (kind != NULL)
+ *kind = json_object_has_member (result, "kind") ? g_strdup (json_object_get_string_member
(result, "kind")) : NULL;
+
+ return TRUE;
+}
diff --git a/src/plugins/gs-snapd.h b/src/plugins/gs-snapd.h
index 58ac6fe..512a23a 100644
--- a/src/plugins/gs-snapd.h
+++ b/src/plugins/gs-snapd.h
@@ -23,15 +23,15 @@
#define __GS_SNAPD_H__
#include <gio/gio.h>
+#include <json-glib/json-glib.h>
gboolean gs_snapd_exists (void);
gboolean gs_snapd_request (const gchar *method,
const gchar *path,
const gchar *content,
- GVariant *macaroon,
- gboolean retry_after_login,
- GVariant **out_macaroon,
+ const gchar *macaroon,
+ gchar **discharges,
guint *status_code,
gchar **reason_phrase,
gchar **response_type,
@@ -39,4 +39,16 @@ gboolean gs_snapd_request (const gchar *method,
gsize *response_length,
GError **error);
+gboolean gs_snapd_parse_result (const gchar *response_type,
+ const gchar *response,
+ JsonObject **result,
+ GError **error);
+
+gboolean gs_snapd_parse_error (const gchar *response_type,
+ const gchar *response,
+ gchar **message,
+ gchar **kind,
+ GError **error);
+
+
#endif /* __GS_SNAPD_H__ */
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]
