Add redis lock feature (#1063)

* Add sensible logging flag to default setup for logger

* Add Redis lock

* Fix default value flag for sensitive logging

* Split RefreshSessionIfNeeded in two methods and use Redis lock

* Small adjustments to doc and code

* Remove sensible logging

* Fix method names in ticket.go

* Revert "Fix method names in ticket.go"

This reverts commit 408ba1a1a5.

* Fix methods name in ticket.go

* Remove block in Redis client get

* Increase lock time to 1 second

* Perform retries, if session store is locked

* Reverse if condition, because it should return if session does not have to be refreshed

* Update go.sum

* Update MockStore

* Return error if loading session fails

* Fix and update tests

* Change validSession to session in docs and strings

* Change validSession to session in docs and strings

* Fix docs

* Fix wrong field name

* Fix linting

* Fix imports for linting

* Revert changes except from locking functionality

* Add lock feature on session state

* Update from master

* Remove errors package, because it is not used

* Only pass context instead of request to lock

* Use lock key

* By default use NoOpLock

* Remove debug output

* Update ticket_test.go

* Map internal error to sessions error

* Add ErrLockNotObtained

* Enable lock peek for all redis clients

* Use lock key prefix consistent

* Fix imports

* Use exists method for peek lock

* Fix imports

* Fix imports

* Fix imports

* Remove own Dockerfile

* Fix imports

* Fix tests for ticket and session store

* Fix session store test

* Update pkg/apis/sessions/interfaces.go

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

* Do not wrap lock method

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

* Use errors package for lock constants

* Use better naming for initLock function

* Add comments

* Add session store lock test

* Fix tests

* Fix tests

* Fix tests

* Fix tests

* Add cookies after saving session

* Add mock lock

* Fix imports for mock_lock.go

* Store mock lock for key

* Apply elapsed time on mock lock

* Check if lock is initially applied

* Reuse existing lock

* Test all lock methods

* Update CHANGELOG.md

* Use redis client methods in redis.lock for release an refresh

* Use lock key suffix instead of prefix for lock key

* Add comments for Lock interface

* Update comment for Lock interface

* Update CHANGELOG.md

* Change LockSuffix to const

* Check lock on already loaded session

* Use global var for loadedSession in lock tests

* Use lock instance for refreshing and releasing of lock

* Update possible error type for Refresh

Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

pkg/apis/sessions/interfaces.go

@@ -1,7 +1,10 @@
 package sessions
 
 import (
+	"context"
+	"errors"
 	"net/http"
+	"time"
 )
 
 // SessionStore is an interface to storing user sessions in the proxy
@@ -10,3 +13,24 @@ type SessionStore interface {
 	Load(req *http.Request) (*SessionState, error)
 	Clear(rw http.ResponseWriter, req *http.Request) error
 }
+
+var ErrLockNotObtained = errors.New("lock: not obtained")
+var ErrNotLocked = errors.New("tried to release not existing lock")
+
+// Lock is an interface for controlling session locks
+type Lock interface {
+	// Obtain obtains the lock on the distributed
+	// lock resource if no lock exists yet.
+	// Otherwise it will return ErrLockNotObtained
+	Obtain(ctx context.Context, expiration time.Duration) error
+	// Peek returns true if the lock currently exists
+	// Otherwise it returns false.
+	Peek(ctx context.Context) (bool, error)
+	// Refresh refreshes the expiration time of the lock,
+	// if is still applied.
+	// Otherwise it will return ErrNotLocked
+	Refresh(ctx context.Context, expiration time.Duration) error
+	// Release removes the existing lock,
+	// Otherwise it will return ErrNotLocked
+	Release(ctx context.Context) error
+}

pkg/apis/sessions/lock.go

@@ -0,0 +1,24 @@
+package sessions
+
+import (
+	"context"
+	"time"
+)
+
+type NoOpLock struct{}
+
+func (l *NoOpLock) Obtain(ctx context.Context, expiration time.Duration) error {
+	return nil
+}
+
+func (l *NoOpLock) Peek(ctx context.Context) (bool, error) {
+	return false, nil
+}
+
+func (l *NoOpLock) Refresh(ctx context.Context, expiration time.Duration) error {
+	return nil
+}
+
+func (l *NoOpLock) Release(ctx context.Context) error {
+	return nil
+}

pkg/apis/sessions/session_state.go

@@ -2,6 +2,7 @@ package sessions
 
 import (
 	"bytes"
+	"context"
 	"errors"
 	"fmt"
 	"io"
@@ -30,6 +31,36 @@ type SessionState struct {
 	User              string   `msgpack:"u,omitempty"`
 	Groups            []string `msgpack:"g,omitempty"`
 	PreferredUsername string   `msgpack:"pu,omitempty"`
+
+	Lock Lock `msgpack:"-"`
+}
+
+func (s *SessionState) ObtainLock(ctx context.Context, expiration time.Duration) error {
+	if s.Lock == nil {
+		s.Lock = &NoOpLock{}
+	}
+	return s.Lock.Obtain(ctx, expiration)
+}
+
+func (s *SessionState) RefreshLock(ctx context.Context, expiration time.Duration) error {
+	if s.Lock == nil {
+		s.Lock = &NoOpLock{}
+	}
+	return s.Lock.Refresh(ctx, expiration)
+}
+
+func (s *SessionState) ReleaseLock(ctx context.Context) error {
+	if s.Lock == nil {
+		s.Lock = &NoOpLock{}
+	}
+	return s.Lock.Release(ctx)
+}
+
+func (s *SessionState) PeekLock(ctx context.Context) (bool, error) {
+	if s.Lock == nil {
+		s.Lock = &NoOpLock{}
+	}
+	return s.Lock.Peek(ctx)
 }
 
 // IsExpired checks whether the session has expired