feat(lib): Create Auth tokens using inst.Access()

Author: b5

auth/key/key.go

@@ -6,7 +6,6 @@ import (
 	logger "github.com/ipfs/go-log"
 	"github.com/libp2p/go-libp2p-core/crypto"
 	peer "github.com/libp2p/go-libp2p-core/peer"
-	"github.com/multiformats/go-multihash"
 )
 
 var log = logger.Logger("key")
@@ -38,15 +37,9 @@ func IDFromPubKey(pubKey crypto.PubKey) (string, error) {
 		return "", fmt.Errorf("identity: public key is required")
 	}
 
-	pubkeybytes, err := pubKey.Bytes()
+	id, err := peer.IDFromPublicKey(pubKey)
 	if err != nil {
-		return "", fmt.Errorf("getting pubkey bytes: %s", err.Error())
-	}
-
-	mh, err := multihash.Sum(pubkeybytes, multihash.SHA2_256, 32)
-	if err != nil {
-		return "", fmt.Errorf("summing pubkey: %s", err.Error())
+		return "", err
 	}
-
-	return mh.B58String(), nil
+	return id.Pretty(), err
 }

auth/token/token.go

@@ -13,7 +13,9 @@ import (
 
 	jwt "github.com/dgrijalva/jwt-go"
 	"github.com/libp2p/go-libp2p-core/crypto"
+	"github.com/libp2p/go-libp2p-core/peer"
 	"github.com/qri-io/qfs"
+	"github.com/qri-io/qri/auth/key"
 	"github.com/qri-io/qri/profile"
 )
 
@@ -36,6 +38,7 @@ type Token = jwt.Token
 // Claims is a JWT Claims object
 type Claims struct {
 	*jwt.StandardClaims
+	// TODO(b5): this needs to be replaced with a profileID
 	Username string `json:"username"`
 }
 
@@ -44,6 +47,83 @@ func Parse(tokenString string, tokens Source) (*Token, error) {
 	return jwt.Parse(tokenString, tokens.VerificationKey)
 }
 
+// NewPrivKeyAuthToken creates a JWT token string suitable for making requests
+// authenticated as the given private key
+func NewPrivKeyAuthToken(pk crypto.PrivKey, ttl time.Duration) (string, error) {
+	signingMethod, err := jwtSigningMethod(pk)
+	if err != nil {
+		return "", err
+	}
+
+	t := jwt.New(signingMethod)
+
+	id, err := key.IDFromPrivKey(pk)
+	if err != nil {
+		return "", err
+	}
+
+	rawPrivBytes, err := pk.Raw()
+	if err != nil {
+		return "", err
+	}
+	signKey, err := x509.ParsePKCS1PrivateKey(rawPrivBytes)
+	if err != nil {
+		return "", err
+	}
+
+	var exp int64
+	if ttl != time.Duration(0) {
+		exp = Timestamp().Add(ttl).In(time.UTC).Unix()
+	}
+
+	// set our claims
+	t.Claims = &Claims{
+		StandardClaims: &jwt.StandardClaims{
+			Issuer:  id,
+			Subject: id,
+			// set the expire time
+			// see http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-20#section-4.1.4
+			ExpiresAt: exp,
+		},
+	}
+
+	// Creat token string
+	return t.SignedString(signKey)
+}
+
+// ParseAuthToken will parse, validate and return a token
+func ParseAuthToken(tokenString string, keystore key.Store) (*Token, error) {
+	claims := &Claims{}
+	return jwt.ParseWithClaims(tokenString, claims, func(t *Token) (interface{}, error) {
+		pid, err := peer.Decode(claims.Issuer)
+		if err != nil {
+			return nil, err
+		}
+		pubKey := keystore.PubKey(pid)
+		if pubKey == nil {
+			for _, pid := range keystore.IDsWithKeys() {
+				fmt.Printf("key %s has a pid\n", pid)
+			}
+			return nil, fmt.Errorf("cannot verify key. missing public key for id %s", claims.Issuer)
+		}
+		rawPubBytes, err := pubKey.Raw()
+		if err != nil {
+			return nil, err
+		}
+
+		verifyKeyiface, err := x509.ParsePKIXPublicKey(rawPubBytes)
+		if err != nil {
+			return nil, err
+		}
+
+		verifyKey, ok := verifyKeyiface.(*rsa.PublicKey)
+		if !ok {
+			return nil, fmt.Errorf("public key is not an RSA key. got type: %T", verifyKeyiface)
+		}
+		return verifyKey, nil
+	})
+}
+
 // Source creates tokens, and provides a verification key for all tokens
 // it creates
 //
@@ -69,17 +149,11 @@ var _ Source = (*pkSource)(nil)
 // NewPrivKeySource creates an authentication interface backed by a single
 // private key. Intended for a node running as remote, or providing a public API
 func NewPrivKeySource(privKey crypto.PrivKey) (Source, error) {
-	methodStr := ""
-	keyType := privKey.Type().String()
-	switch keyType {
-	case "RSA":
-		methodStr = "RS256"
-	default:
-		return nil, fmt.Errorf("unsupported key type for token creation: %q", keyType)
+	signingMethod, err := jwtSigningMethod(privKey)
+	if err != nil {
+		return nil, err
 	}
 
-	signingMethod := jwt.GetSigningMethod(methodStr)
-
 	rawPrivBytes, err := privKey.Raw()
 	if err != nil {
 		return nil, err
@@ -304,3 +378,13 @@ func (st *qfsStore) save(ctx context.Context) error {
 	st.path = path
 	return nil
 }
+
+func jwtSigningMethod(pk crypto.PrivKey) (jwt.SigningMethod, error) {
+	keyType := pk.Type().String()
+	switch keyType {
+	case "RSA":
+		return jwt.GetSigningMethod("RS256"), nil
+	default:
+		return nil, fmt.Errorf("unsupported key type for token creation: %q", keyType)
+	}
+}

auth/token/token_test.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/qri-io/qfs"
+	"github.com/qri-io/qri/auth/key"
 	testkeys "github.com/qri-io/qri/auth/key/test"
 	"github.com/qri-io/qri/auth/token"
 	token_spec "github.com/qri-io/qri/auth/token/spec"
@@ -64,3 +65,26 @@ func TestTokenStore(t *testing.T) {
 		return ts
 	})
 }
+
+func TestNewPrivKeyAuthToken(t *testing.T) {
+	// create a token from a private key
+	kd := testkeys.GetKeyData(0)
+	str, err := token.NewPrivKeyAuthToken(kd.PrivKey, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// prove we can parse a token with a store that only has a public key
+	ks, err := key.NewMemStore()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := ks.AddPubKey(kd.KeyID, kd.PrivKey.GetPublic()); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = token.ParseAuthToken(str, ks)
+	if err != nil {
+		t.Fatal(err)
+	}
+}

lib/access.go

@@ -0,0 +1,90 @@
+package lib
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/qri-io/qri/auth/token"
+	"github.com/qri-io/qri/profile"
+)
+
+// AccessMethods is a group of methods for access control & user authentication
+type AccessMethods struct {
+	d dispatcher
+}
+
+// Name returns the name of this method group
+func (m AccessMethods) Name() string {
+	return "access"
+}
+
+// Access returns the authentication that Instance has registered
+func (inst *Instance) Access() AccessMethods {
+	return AccessMethods{d: inst}
+}
+
+// CreateAuthTokenParams are input parameters for Access().CreateAuthToken
+type CreateAuthTokenParams struct {
+	GranteeUsername  string
+	GranteeProfileID string
+	TTL              time.Duration
+}
+
+// SetNonZeroDefaults uses default token time-to-live if one isn't set
+func (p *CreateAuthTokenParams) SetNonZeroDefaults() {
+	if p.TTL == 0 {
+		p.TTL = token.DefaultTokenTTL
+	}
+}
+
+// Valid checks if the profile in question is valid
+func (p *CreateAuthTokenParams) Valid() error {
+	if p.GranteeUsername == "" && p.GranteeProfileID == "" {
+		return fmt.Errorf("either grantee username or profile is required")
+	}
+	return nil
+}
+
+// CreateAuthToken constructs a JWT string token suitable for making OAuth
+// requests as the grantee user. Creating an access token requires a stored
+// private key for the grantee.
+// Callers can provide either GranteeUsername OR GranteeProfileID
+func (m AccessMethods) CreateAuthToken(ctx context.Context, p *CreateAuthTokenParams) (string, error) {
+	res, err := m.d.Dispatch(ctx, dispatchMethodName(m, "createauthtoken"), p)
+	if s, ok := res.(string); ok {
+		return s, err
+	}
+	return "", err
+}
+
+// accessImpl is the backing implementation for AccessMethods
+type accessImpl struct{}
+
+func (accessImpl) CreateAuthToken(scp scope, p *CreateAuthTokenParams) (string, error) {
+	var (
+		grantee *profile.Profile
+		err     error
+	)
+
+	if p.GranteeProfileID != "" {
+		id, err := profile.IDB58Decode(p.GranteeProfileID)
+		if err != nil {
+			return "", err
+		}
+		if grantee, err = scp.Profiles().GetProfile(id); err != nil {
+			return "", err
+		}
+	} else if p.GranteeUsername != "" {
+		if grantee, err = profile.ResolveUsername(scp.Profiles(), p.GranteeUsername); err != nil {
+			return "", err
+		}
+	}
+
+	pk := grantee.PrivKey
+	if pk == nil {
+		return "", fmt.Errorf("cannot create token for %q (id: %s), private key is required", grantee.Peername, grantee.ID.String())
+	}
+
+	return token.NewPrivKeyAuthToken(pk, p.TTL)
+}

lib/access_test.go

@@ -0,0 +1,30 @@
+package lib
+
+import (
+	"context"
+	"testing"
+
+	"github.com/qri-io/qri/auth/token"
+)
+
+func TestAccessCreateAuthToken(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	inst, cleanup := NewMemTestInstance(ctx, t)
+	defer cleanup()
+
+	// create an authentication token using the owner profile
+	p := &CreateAuthTokenParams{
+		GranteeUsername: inst.cfg.Profile.Peername,
+	}
+	s, err := inst.Access().CreateAuthToken(ctx, p)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// prove we can parse & validate that token
+	_, err = token.ParseAuthToken(s, inst.keystore)
+	if err != nil {
+		t.Fatal(err)
+	}
+}

lib/dispatch.go

@@ -134,6 +134,7 @@ func (inst *Instance) RegisterMethods() {
 	// TODO(dustmop): Change registerOne to take both the MethodSet and the Impl, validate
 	// that their signatures agree.
 	inst.registerOne("fsi", &FSIImpl{}, reg)
+	inst.registerOne("access", accessImpl{}, reg)
 	inst.regMethods = &regMethodSet{reg: reg}
 }
 

lib/lib.go

@@ -361,7 +361,7 @@ func NewInstance(ctx context.Context, repoPath string, opts ...Option) (qri *Ins
 	// If configuration does not have a path assigned, but the repo has a path and
 	// is stored on the filesystem, add that path to the configuration.
 	if cfg.Repo.Type == "fs" && cfg.Path() == "" {
-		cfg.SetPath(filepath.Join(repoPath, "config.yal"))
+		cfg.SetPath(filepath.Join(repoPath, "config.yaml"))
 	}
 
 	inst := &Instance{

lib/lib_test.go

@@ -355,3 +355,34 @@ func TestNewInstanceWithAccessControlPolicy(t *testing.T) {
 		t.Errorf("expected no policy enforce error, got: %s", err)
 	}
 }
+
+// NewMemTestInstance creates an in-memory instance
+// TODO(b5): currently "NewInstance" hard-requires a repo-path, even if we can
+// provide a configuration that specifies entirely in-memory stores. We should
+// make it possible to create fully in-memory Instances using NewInstance,
+// but for now I'm working around it with a temp directory & cleanup function
+func NewMemTestInstance(ctx context.Context, t *testing.T) (inst *Instance, cleanup func()) {
+	t.Helper()
+	tmpPath, err := ioutil.TempDir("", "qri_test_mem_instance")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := testcfg.DefaultConfigForTesting()
+	cfg.Filesystems = []qfs.Config{
+		{Type: "mem"},
+		{Type: "local"},
+	}
+	cfg.Repo.Type = "mem"
+	if err := cfg.WriteToFile(filepath.Join(tmpPath, "config.yaml")); err != nil {
+		t.Fatal(err)
+	}
+
+	// TODO(b5): I'd like to be able to do this:
+	// if inst, err = NewInstance(ctx, "", OptConfig(cfg)); err != nil {
+	if inst, err = NewInstance(ctx, tmpPath); err != nil {
+		t.Fatal(err)
+	}
+
+	return inst, func() { os.RemoveAll(tmpPath) }
+}

lib/scope.go

@@ -9,6 +9,7 @@ import (
 	"github.com/qri-io/qri/dsref"
 	"github.com/qri-io/qri/event"
 	"github.com/qri-io/qri/fsi"
+	"github.com/qri-io/qri/profile"
 	"github.com/qri-io/qri/repo"
 )
 
@@ -53,6 +54,11 @@ func (s *scope) Dscache() *dscache.Dscache {
 	return s.inst.Dscache()
 }
 
+// Profiles accesses the profile store
+func (s *scope) Profiles() profile.Store {
+	return s.inst.profiles
+}
+
 // ParseAndResolveRef parses a reference and resolves it
 func (s *scope) ParseAndResolveRef(ctx context.Context, refStr, source string) (dsref.Ref, string, error) {
 	return s.inst.ParseAndResolveRef(ctx, refStr, source)