Skip to content

Commit 79ffa83

Browse files
csweichelcsweichel
committed
Add remote report authorization
1 parent 3e6f8c7 commit 79ffa83

File tree

6 files changed

+135
-9
lines changed

6 files changed

+135
-9
lines changed

‎cmd/build.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ func getBuildOpts(cmd *cobra.Command) ([]leeway.BuildOption, *leeway.FilesystemC
254254
if ep, err := cmd.Flags().GetString("remote-report"); err != nil {
255255
log.Fatal(err)
256256
} else if ep != "" {
257-
reporter = append(reporter, remotereporter.NewReporter(ep))
257+
reporter = append(reporter, remotereporter.NewReporter(ep, os.Getenv("LEEWAY_REMOTE_REPORT_TOKEN")))
258258
}
259259

260260
dontTest, err := cmd.Flags().GetBool("dont-test")

‎pkg/remotereporter/reporter.go

+9-2
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,21 @@ import (
1515
"github.com/sirupsen/logrus"
1616
)
1717

18-
func NewReporter(endpoint string) *Reporter {
18+
func NewReporter(endpoint, token string) *Reporter {
1919
id, err := uuid.NewRandom()
2020
if err != nil {
2121
panic(fmt.Sprintf("cannot create remote reporting sesison UUID: %v.\nTry running without --remote-report", err))
2222
}
2323

2424
httpclient := &http.Client{Timeout: 2 * time.Second}
25-
client := v1connect.NewReporterServiceClient(httpclient, endpoint)
25+
client := v1connect.NewReporterServiceClient(httpclient, endpoint, connect_go.WithInterceptors(connect_go.UnaryInterceptorFunc(func(uf connect_go.UnaryFunc) connect_go.UnaryFunc {
26+
return func(ctx context.Context, req connect_go.AnyRequest) (connect_go.AnyResponse, error) {
27+
if token != "" {
28+
req.Header().Set("Authorization", token)
29+
}
30+
return uf(ctx, req)
31+
}
32+
})))
2633
return &Reporter{
2734
sessionID: id.String(),
2835
times: make(map[string]time.Time),

‎tracker/backend/ingestor/go.mod

+10
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ go 1.19
44

55
require (
66
github.com/InfluxCommunity/influxdb3-go v0.1.0
7+
github.com/MicahParks/keyfunc v1.9.0
78
github.com/aws/aws-lambda-go v1.41.0
89
github.com/aws/aws-sdk-go-v2 v1.18.1
910
github.com/aws/aws-sdk-go-v2/config v1.18.27
@@ -12,8 +13,11 @@ require (
1213
github.com/bufbuild/connect-go v1.9.0
1314
github.com/bufbuild/connect-grpcreflect-go v1.1.0
1415
github.com/gitpod-io/leeway v0.0.0-00010101000000-000000000000
16+
github.com/golang-jwt/jwt/v4 v4.4.2
1517
github.com/segmentio/analytics-go/v3 v3.2.1
1618
github.com/sirupsen/logrus v1.9.3
19+
github.com/spf13/pflag v1.0.5
20+
github.com/zitadel/oidc v1.13.4
1721
)
1822

1923
require (
@@ -36,6 +40,8 @@ require (
3640
github.com/golang/snappy v0.0.4 // indirect
3741
github.com/google/flatbuffers v2.0.8+incompatible // indirect
3842
github.com/google/uuid v1.3.0 // indirect
43+
github.com/gorilla/schema v1.2.0 // indirect
44+
github.com/gorilla/securecookie v1.1.1 // indirect
3945
github.com/influxdata/line-protocol/v2 v2.2.1 // indirect
4046
github.com/jmespath/go-jmespath v0.4.0 // indirect
4147
github.com/klauspost/asmfmt v1.3.2 // indirect
@@ -46,16 +52,20 @@ require (
4652
github.com/pierrec/lz4/v4 v4.1.15 // indirect
4753
github.com/segmentio/backo-go v1.0.0 // indirect
4854
github.com/zeebo/xxh3 v1.0.2 // indirect
55+
golang.org/x/crypto v0.7.0 // indirect
4956
golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1 // indirect
5057
golang.org/x/mod v0.10.0 // indirect
5158
golang.org/x/net v0.10.0 // indirect
59+
golang.org/x/oauth2 v0.6.0 // indirect
5260
golang.org/x/sys v0.8.0 // indirect
5361
golang.org/x/text v0.9.0 // indirect
5462
golang.org/x/tools v0.9.3 // indirect
5563
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
64+
google.golang.org/appengine v1.6.7 // indirect
5665
google.golang.org/genproto v0.0.0-20230320184635-7606e756e683 // indirect
5766
google.golang.org/grpc v1.55.0 // indirect
5867
google.golang.org/protobuf v1.31.0 // indirect
68+
gopkg.in/square/go-jose.v2 v2.6.0 // indirect
5969
)
6070

6171
replace github.com/gitpod-io/leeway => ../../.. // leeway

‎tracker/backend/ingestor/go.sum

+18
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ github.com/InfluxCommunity/influxdb3-go v0.1.0 h1:c+5H7qD7WZ0KSTCtCrVjBoMEspIP8K
4747
github.com/InfluxCommunity/influxdb3-go v0.1.0/go.mod h1:6hVZLGqLyfEvXu14JRm4Ai938q8BzJ73TGQ7VKh8qPA=
4848
github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c h1:RGWPOewvKIROun94nF7v2cua9qP+thov/7M50KEoeSU=
4949
github.com/Joker/hpp v1.0.0/go.mod h1:8x5n+M1Hp5hC0g8okX3sR3vFQwynaX/UgSOM9MeBKzY=
50+
github.com/MicahParks/keyfunc v1.9.0 h1:lhKd5xrFHLNOWrDc4Tyb/Q1AJ4LCzQ48GVJyVIID3+o=
51+
github.com/MicahParks/keyfunc v1.9.0/go.mod h1:IdnCilugA0O/99dW+/MkvlyrsX8+L8+x95xuVNtM5jw=
5052
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
5153
github.com/Shopify/goreferrer v0.0.0-20210630161223-536fa16abd6f/go.mod h1:a1uqRtAwp2Xwc6WNPJEufxJ7fx3npB4UV/JOLmbu5I0=
5254
github.com/ajg/form v1.5.1/go.mod h1:uL1WgH+h2mgNtvBq0339dVnzXdBETtL2LeUXaIv25UY=
@@ -179,6 +181,8 @@ github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5x
179181
github.com/gofiber/fiber/v2 v2.1.0/go.mod h1:aG+lMkwy3LyVit4CnmYUbUdgjpc3UYOltvlJZ78rgQ0=
180182
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
181183
github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
184+
github.com/golang-jwt/jwt/v4 v4.4.2 h1:rcc4lwaZgFMCZ5jxF9ABolDcIHdBytAFgqFPbSJQAYs=
185+
github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
182186
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
183187
github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
184188
github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -259,6 +263,10 @@ github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORR
259263
github.com/gopherjs/gopherjs v0.0.0-20220221023154-0b2280d3ff96/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
260264
github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c=
261265
github.com/gorilla/mux v1.7.4/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
266+
github.com/gorilla/schema v1.2.0 h1:YufUaxZYCKGFuAq3c96BOhjgd5nmXiOY9NGzF247Tsc=
267+
github.com/gorilla/schema v1.2.0/go.mod h1:kgLaKoK1FELgZqMAVxx/5cbj0kT+57qxUrAlIO2eleU=
268+
github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
269+
github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
262270
github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
263271
github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
264272
github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
@@ -449,6 +457,7 @@ github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t6
449457
github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
450458
github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
451459
github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
460+
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
452461
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
453462
github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
454463
github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH9Ns=
@@ -499,6 +508,8 @@ github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQ
499508
github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
500509
github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
501510
github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
511+
github.com/zitadel/oidc v1.13.4 h1:+k2GKqP9Ld9S2MSFlj+KaNsoZ3J9oy+Ezw51EzSFuC8=
512+
github.com/zitadel/oidc v1.13.4/go.mod h1:3h2DhUcP02YV6q/CA/BG4yla0o6rXjK+DkJGK/dwJfw=
502513
go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
503514
go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
504515
go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
@@ -527,6 +538,8 @@ golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5y
527538
golang.org/x/crypto v0.0.0-20220112180741-5e0467b6c7ce/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
528539
golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
529540
golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
541+
golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
542+
golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
530543
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
531544
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
532545
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -626,6 +639,8 @@ golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ
626639
golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
627640
golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
628641
golang.org/x/oauth2 v0.0.0-20210402161424-2e8d93401602/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
642+
golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw=
643+
golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
629644
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
630645
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
631646
golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -819,6 +834,7 @@ google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7
819834
google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
820835
google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
821836
google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
837+
google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
822838
google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
823839
google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
824840
google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -912,6 +928,8 @@ gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMy
912928
gopkg.in/ini.v1 v1.62.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
913929
gopkg.in/ini.v1 v1.66.4/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
914930
gopkg.in/ini.v1 v1.66.6/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
931+
gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
932+
gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
915933
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
916934
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
917935
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

‎tracker/backend/ingestor/handler/auth.go

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
package handler
2+
3+
import (
4+
context "context"
5+
"fmt"
6+
"net/http"
7+
"time"
8+
9+
"github.com/MicahParks/keyfunc"
10+
"github.com/bufbuild/connect-go"
11+
"github.com/golang-jwt/jwt/v4"
12+
"github.com/sirupsen/logrus"
13+
14+
oidc "github.com/zitadel/oidc/pkg/client"
15+
)
16+
17+
func NewOIDCInterceptor(idp, audience string, allowedSubs []string) (connect.Interceptor, error) {
18+
cfg, err := oidc.Discover(idp, &http.Client{Timeout: 10 * time.Second})
19+
if err != nil {
20+
return nil, err
21+
}
22+
jwks, err := keyfunc.Get(cfg.JwksURI, keyfunc.Options{
23+
Ctx: context.Background(),
24+
RefreshErrorHandler: func(err error) {
25+
logrus.WithError(err).WithField("identityProvider", idp).Warn("cannot refresh JWKS")
26+
},
27+
RefreshInterval: time.Hour,
28+
RefreshRateLimit: time.Minute * 5,
29+
RefreshTimeout: time.Second * 10,
30+
RefreshUnknownKID: true,
31+
})
32+
if err != nil {
33+
return nil, err
34+
}
35+
logrus.WithField("issuer", idp).WithField("audience", audience).WithField("sub", allowedSubs).Info("enabled OIDC authorisation")
36+
37+
return connect.UnaryInterceptorFunc(func(uf connect.UnaryFunc) connect.UnaryFunc {
38+
return func(ctx context.Context, ar connect.AnyRequest) (connect.AnyResponse, error) {
39+
rawToken := ar.Header().Get("Authorization")
40+
if rawToken == "" {
41+
return nil, connect.NewError(connect.CodeUnauthenticated, fmt.Errorf("missing Authorization header"))
42+
}
43+
token, err := jwt.Parse(rawToken, jwks.Keyfunc)
44+
if err != nil {
45+
return nil, connect.NewError(connect.CodeUnauthenticated, fmt.Errorf("cannot parse token: %w", err))
46+
}
47+
if !token.Valid {
48+
return nil, connect.NewError(connect.CodeUnauthenticated, fmt.Errorf("invalid JWT token"))
49+
}
50+
claims, ok := token.Claims.(jwt.MapClaims)
51+
if !ok {
52+
return nil, connect.NewError(connect.CodeUnauthenticated, fmt.Errorf("cannot extract claims from JWT"))
53+
}
54+
if !claims.VerifyAudience(audience, true) {
55+
return nil, connect.NewError(connect.CodeUnauthenticated, fmt.Errorf("audience does not match (expected %s, got %s)", audience, claims["aud"]))
56+
}
57+
if !claims.VerifyIssuer(idp, true) {
58+
return nil, connect.NewError(connect.CodeUnauthenticated, fmt.Errorf("issuer does not match (expected %s, got %s)", idp, claims["iss"]))
59+
}
60+
if !claims.VerifyExpiresAt(time.Now().Unix(), true) {
61+
return nil, connect.NewError(connect.CodeUnauthenticated, fmt.Errorf("token has expired"))
62+
}
63+
var validSub bool
64+
for _, sub := range allowedSubs {
65+
if claims["sub"] == sub {
66+
validSub = true
67+
break
68+
}
69+
}
70+
if !validSub {
71+
return nil, connect.NewError(connect.CodeUnauthenticated, fmt.Errorf("unexpected subject %s", claims["sub"]))
72+
}
73+
74+
return uf(ctx, ar)
75+
}
76+
}), nil
77+
}

‎tracker/backend/ingestor/main.go

+20-6
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,19 @@ package main
22

33
import (
44
"context"
5-
"flag"
65
"log"
76
"net/http"
87
"os"
98
"time"
109

10+
flag "github.com/spf13/pflag"
11+
1112
"github.com/InfluxCommunity/influxdb3-go/influx"
1213
"github.com/aws/aws-lambda-go/lambda"
1314
"github.com/aws/aws-sdk-go-v2/config"
1415
"github.com/aws/aws-sdk-go-v2/service/cloudwatch"
1516
"github.com/awslabs/aws-lambda-go-api-proxy/httpadapter"
17+
"github.com/bufbuild/connect-go"
1618
grpcreflect "github.com/bufbuild/connect-grpcreflect-go"
1719
segment "github.com/segmentio/analytics-go/v3"
1820
"github.com/sirupsen/logrus"
@@ -22,9 +24,12 @@ import (
2224
)
2325

2426
var (
25-
listen = flag.String("listen", ":8080", "address to listen on when not running as lambda")
26-
verbose = flag.Bool("verbose", false, "enable verbose logging")
27-
sink = flag.String("sink", "console", "where to write samples to. Valid values are: console, cloudwatch, influxdb, segment")
27+
listen = flag.String("listen", ":8080", "address to listen on when not running as lambda")
28+
verbose = flag.Bool("verbose", false, "enable verbose logging")
29+
sink = flag.String("sink", "console", "where to write samples to. Valid values are: console, cloudwatch, influxdb, segment")
30+
idp = flag.String("idp", "", "if set incoming requests must carry a valid ID token from this IDP in their Authorization header")
31+
idpAudience = flag.String("idp-aud", "leeway.gitpod.io", "use in combination with --idp to control the audience the ID token must carry")
32+
idpSub = flag.StringArray("idp-sub", nil, "use in combination with --idp to control the subject the ID token must carry; if any subject matches the token is accepted")
2833
)
2934

3035
func main() {
@@ -62,9 +67,18 @@ func main() {
6267
client := segment.New(os.Getenv("SEGMENT_KEY"))
6368
store = handler.WriteToSegment(client)
6469
default:
65-
logrus.Fatalf("unsupported --sample-sink: %s", *sink)
70+
logrus.Fatalf("unsupported --sink: %s", *sink)
71+
}
72+
73+
var interceptors []connect.Interceptor
74+
if *idp != "" {
75+
ic, err := handler.NewOIDCInterceptor(*idp, *idpAudience, *idpSub)
76+
if err != nil {
77+
logrus.Fatalf("cannot setup OIDC auth with %s: %v", err)
78+
}
79+
interceptors = append(interceptors, ic)
6680
}
67-
mux.Handle(v1connect.NewReporterServiceHandler(handler.NewBuildReportHandler(store)))
81+
mux.Handle(v1connect.NewReporterServiceHandler(handler.NewBuildReportHandler(store), connect.WithInterceptors(interceptors...)))
6882

6983
reflector := grpcreflect.NewStaticReflector(
7084
v1connect.ReporterServiceName,

0 commit comments

Comments
 (0)