improve authorization #152
+284
−4,845
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,257 @@ | ||
| /* | ||
| Copyright 2024 The CloudPilot AI Authors. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package metadata | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "errors" | ||
| "fmt" | ||
| "io" | ||
| "net/http" | ||
| "os" | ||
| "reflect" | ||
| "strings" | ||
| "time" | ||
| ) | ||
|
|
||
| const ( | ||
| Endpoint = "http://100.100.100.200" | ||
| hostname = "hostname" | ||
| instanceID = "instance-id" | ||
| regionID = "region-id" | ||
| ramSecurity = "ram/security-credentials" | ||
| ) | ||
|
|
||
| // MetaData wrap http client | ||
| type MetaData struct { | ||
| // mock for unit test. | ||
| mock requestMock | ||
| client *http.Client | ||
| } | ||
|
|
||
| // NewMetaData returns MetaData | ||
| func NewMetaData(client *http.Client) *MetaData { | ||
| if client == nil { | ||
| client = &http.Client{} | ||
| } | ||
| return &MetaData{ | ||
| client: client, | ||
| } | ||
| } | ||
|
|
||
| // NewMockMetaData returns mock MetaData | ||
| func NewMockMetaData(client *http.Client, sendRequest requestMock) *MetaData { | ||
|
|
||
| if client == nil { | ||
| client = &http.Client{} | ||
| } | ||
| return &MetaData{ | ||
| client: client, | ||
| mock: sendRequest, | ||
| } | ||
| } | ||
|
|
||
| // New returns MetaDataRequest | ||
| func (m *MetaData) New() *MetaDataRequest { | ||
| return &MetaDataRequest{ | ||
| client: m.client, | ||
| sendRequest: m.mock, | ||
| } | ||
| } | ||
|
|
||
| // HostName returns host name | ||
| func (m *MetaData) HostName() (string, error) { | ||
|
There was a problem hiding this comment. Maybe we should only keep what we need and delete the unused function? |
||
| var name ResultList | ||
| err := m.New().Resource(hostname).Do(&name) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| return name.result[0], nil | ||
| } | ||
|
|
||
| // InstanceID returns instance Id | ||
| func (m *MetaData) InstanceID() (string, error) { | ||
| var instanceid ResultList | ||
| err := m.New().Resource(instanceID).Do(&instanceid) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| return instanceid.result[0], err | ||
| } | ||
|
|
||
| // Region returns region | ||
| func (m *MetaData) Region() (string, error) { | ||
| var region ResultList | ||
| err := m.New().Resource(regionID).Do(®ion) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| return region.result[0], nil | ||
| } | ||
|
|
||
| // RoleName returns role name | ||
| func (m *MetaData) RoleName() (string, error) { | ||
| var roleName ResultList | ||
| err := m.New().Resource("ram/security-credentials/").Do(&roleName) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| return roleName.result[0], nil | ||
| } | ||
|
|
||
| // RamRoleToken returns ram role token | ||
| func (m *MetaData) RAMRoleToken(role string) (RoleAuth, error) { | ||
| var roleauth RoleAuth | ||
| err := m.New().Resource(ramSecurity).SubResource(role).Do(&roleauth) | ||
| if err != nil { | ||
| return RoleAuth{}, err | ||
| } | ||
| return roleauth, nil | ||
| } | ||
|
|
||
| type requestMock func(resource string) (string, error) | ||
|
|
||
| // ResultList struct | ||
| type ResultList struct { | ||
| result []string | ||
| } | ||
|
|
||
| // nolint: stylecheck | ||
| // RoleAuth struct | ||
| type RoleAuth struct { | ||
| AccessKeyId string | ||
| AccessKeySecret string | ||
| Expiration time.Time | ||
| SecurityToken string | ||
| LastUpdated time.Time | ||
| Code string | ||
| } | ||
|
|
||
| // MetaDataRequest struct | ||
| type MetaDataRequest struct { | ||
| version string | ||
| resourceType string | ||
| resource string | ||
| subResource string | ||
| client *http.Client | ||
|
|
||
| sendRequest requestMock | ||
| } | ||
|
|
||
| // Version sets version | ||
| func (r *MetaDataRequest) Version(version string) *MetaDataRequest { | ||
| r.version = version | ||
| return r | ||
| } | ||
|
|
||
| // ResourceType sets resource type | ||
| func (r *MetaDataRequest) ResourceType(rtype string) *MetaDataRequest { | ||
| r.resourceType = rtype | ||
| return r | ||
| } | ||
|
|
||
| // Resource sets resource | ||
| func (r *MetaDataRequest) Resource(resource string) *MetaDataRequest { | ||
| r.resource = resource | ||
| return r | ||
| } | ||
|
|
||
| // SubResource set sub resource | ||
| func (r *MetaDataRequest) SubResource(sub string) *MetaDataRequest { | ||
| r.subResource = sub | ||
| return r | ||
| } | ||
|
|
||
| // URL returns url | ||
| func (r *MetaDataRequest) URL() (string, error) { | ||
| if r.version == "" { | ||
| r.version = "latest" | ||
| } | ||
| if r.resourceType == "" { | ||
| r.resourceType = "meta-data" | ||
| } | ||
| if r.resource == "" { | ||
| return "", errors.New("the resource you want to visit must not be nil") | ||
| } | ||
| endpoint := os.Getenv("METADATA_ENDPOINT") | ||
| if endpoint == "" { | ||
| endpoint = Endpoint | ||
| } | ||
| url := fmt.Sprintf("%s/%s/%s/%s", endpoint, r.version, r.resourceType, r.resource) | ||
| if r.subResource == "" { | ||
| return url, nil | ||
| } | ||
| return fmt.Sprintf("%s/%s", url, r.subResource), nil | ||
| } | ||
|
|
||
| // Do try to do MetaDataRequest | ||
| func (r *MetaDataRequest) Do(api interface{}) (err error) { | ||
| res := "" | ||
|
|
||
| if r.sendRequest != nil { | ||
| res, err = r.sendRequest(r.resource) | ||
| } else { | ||
| res, err = r.send() | ||
| } | ||
|
|
||
| if err != nil { | ||
| return err | ||
| } | ||
| return r.Decode(res, api) | ||
| } | ||
|
|
||
| // Decode returns decoded content | ||
| func (r *MetaDataRequest) Decode(data string, api interface{}) error { | ||
| if data == "" { | ||
| url, _ := r.URL() | ||
| return fmt.Errorf("metadata: alivpc decode data must not be nil. url=[%s]", url) | ||
| } | ||
| switch api := api.(type) { | ||
| case *ResultList: | ||
| api.result = strings.Split(data, "\n") | ||
| return nil | ||
| case *RoleAuth: | ||
| return json.Unmarshal([]byte(data), api) | ||
| default: | ||
| return fmt.Errorf("metadata: unknow type to decode, type=%s", reflect.TypeOf(api)) | ||
| } | ||
| } | ||
|
|
||
| func (r *MetaDataRequest) send() (string, error) { | ||
| url, err := r.URL() | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| req, err := http.NewRequest(http.MethodGet, url, nil) | ||
|
|
||
| if err != nil { | ||
| return "", err | ||
| } | ||
| resp, err := r.client.Do(req) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| if resp.StatusCode != 200 { | ||
| return "", fmt.Errorf("aliyun Metadata API Error: Status Code: %d", resp.StatusCode) | ||
| } | ||
| defer resp.Body.Close() | ||
|
|
||
| data, err := io.ReadAll(resp.Body) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| return string(data), nil | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Wouldn't it be better to put the getenv operation at the top level and pass it here? Avoid overriding possible future logic.