74 lines
1.9 KiB
Go
74 lines
1.9 KiB
Go
package controller
|
|
|
|
import (
|
|
"errors"
|
|
"io"
|
|
"net/http"
|
|
"time"
|
|
|
|
storepkg "github.com/cirruslabs/orchard/internal/controller/store"
|
|
"github.com/cirruslabs/orchard/internal/responder"
|
|
"github.com/cirruslabs/orchard/internal/vmtempauth"
|
|
v1 "github.com/cirruslabs/orchard/pkg/resource/v1"
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func (controller *Controller) issueVMAccessToken(ctx *gin.Context) responder.Responder {
|
|
if responder := controller.authorize(ctx, v1.ServiceAccountRoleComputeWrite); responder != nil {
|
|
return responder
|
|
}
|
|
|
|
var request v1.IssueVMAccessTokenRequest
|
|
|
|
if err := ctx.ShouldBindJSON(&request); err != nil && !errors.Is(err, io.EOF) {
|
|
return responder.JSON(http.StatusBadRequest, NewErrorResponse("invalid JSON was provided"))
|
|
}
|
|
|
|
ttl, err := vmtempauth.NormalizeTTL(request.TTLSeconds)
|
|
if err != nil {
|
|
return responder.JSON(http.StatusPreconditionFailed, NewErrorResponse("%v", err))
|
|
}
|
|
|
|
name := ctx.Param("name")
|
|
var vm *v1.VM
|
|
|
|
if responder := controller.storeView(func(txn storepkg.Transaction) responder.Responder {
|
|
vm, err = txn.GetVM(name)
|
|
if err != nil {
|
|
return responder.Error(err)
|
|
}
|
|
|
|
return nil
|
|
}); responder != nil {
|
|
return responder
|
|
}
|
|
|
|
serviceAccount, ok := controller.serviceAccountFromContext(ctx)
|
|
if !ok {
|
|
return responder.Code(http.StatusUnauthorized)
|
|
}
|
|
|
|
token, err := vmtempauth.Issue(controller.vmAccessTokenKey, vmtempauth.IssueInput{
|
|
Issuer: vmtempauth.AccessTokenIssuer,
|
|
Subject: serviceAccount.Name,
|
|
VMUID: vm.UID,
|
|
VMName: vm.Name,
|
|
TTL: ttl,
|
|
Now: time.Now().UTC(),
|
|
})
|
|
if err != nil {
|
|
controller.logger.Errorf("failed to issue VM access token: %v", err)
|
|
|
|
return responder.Code(http.StatusInternalServerError)
|
|
}
|
|
|
|
return responder.JSON(http.StatusOK, &v1.VMAccessToken{
|
|
Token: token.Token,
|
|
TokenType: "Bearer",
|
|
ExpiresAt: token.ExpiresAt,
|
|
SSHUsername: vmtempauth.SSHUsername,
|
|
VMName: vm.Name,
|
|
VMUID: vm.UID,
|
|
})
|
|
}
|