Skip to content

Commit c42b852

Browse files
mpgxviimpgxvii
authored
Merge pull request #162 from RADAR-base/fix/audience-claim
Add audience claim in UserRepository
2 parents 88dbcc4 + 10bfd1b commit c42b852

File tree

13 files changed

+189
-43
lines changed

13 files changed

+189
-43
lines changed

‎.github/workflows/scheduled-snyk-docker.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Snyk scheduled Docker base image scan
2+
3+
on:
4+
schedule:
5+
- cron: '0 3 * * 1'
6+
workflow_dispatch:
7+
8+
env:
9+
DOCKER_IMAGE_FITBIT: radarbase/kafka-connect-rest-fitbit-source
10+
DOCKER_IMAGE_OURA: radarbase/kafka-connect-rest-oura-source
11+
12+
jobs:
13+
security:
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- uses: actions/checkout@v3
18+
19+
- name: Run Snyk to check for vulnerabilities on Fitbit image
20+
continue-on-error: true # To make sure that SARIF upload gets called
21+
uses: snyk/actions/docker@master
22+
env:
23+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
24+
with:
25+
image: ${{ env.DOCKER_IMAGE_FITBIT }}
26+
args: >-
27+
--file=kafka-connect-fitbit-source/Dockerfile
28+
--fail-on=upgradable
29+
--severity-threshold=high
30+
--policy-path=.snyk
31+
--exclude-app-vulns
32+
--org=radar-base
33+
--sarif-file-output=snyk.sarif
34+
35+
# Detected vulnerabilities will appear on Github in Security->Code_scanning_alerts tab
36+
- name: Upload Fitbit result to GitHub Code Scanning
37+
uses: github/codeql-action/upload-sarif@v3
38+
with:
39+
category: fitbit
40+
sarif_file: snyk.sarif
41+
42+
- name: Run Snyk to check for vulnerabilities on Oura image
43+
continue-on-error: true # To make sure that SARIF upload gets called
44+
uses: snyk/actions/docker@master
45+
env:
46+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
47+
with:
48+
image: ${{ env.DOCKER_IMAGE_OURA }}
49+
args: >-
50+
--file=kafka-connect-oura-source/Dockerfile
51+
--fail-on=upgradable
52+
--severity-threshold=high
53+
--policy-path=.snyk
54+
--exclude-app-vulns
55+
--org=radar-base
56+
--sarif-file-output=snyk.sarif
57+
58+
- name: Upload Oura result to GitHub Code Scanning
59+
uses: github/codeql-action/upload-sarif@v3
60+
with:
61+
category: oura
62+
sarif_file: snyk.sarif

‎.github/workflows/scheduled-snyk.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Snyk scheduled code base scan
2+
3+
on:
4+
schedule:
5+
- cron: '0 2 * * 1'
6+
workflow_dispatch:
7+
8+
jobs:
9+
security:
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
- uses: actions/checkout@v3
14+
15+
- name: Run Snyk to check for vulnerabilities
16+
uses: snyk/actions/gradle-jdk17@master
17+
continue-on-error: true # To make sure that SARIF upload gets called
18+
env:
19+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
20+
with:
21+
args: >-
22+
--all-projects
23+
--configuration-matching='^runtimeClasspath$'
24+
--fail-on=upgradable
25+
--severity-threshold=high
26+
--policy-path=.snyk
27+
--org=radar-base
28+
--sarif-file-output=snyk.sarif
29+
30+
# Detected vulnerabilities will appear on Github in Security->Code_scanning_alerts tab
31+
- name: Upload result to GitHub Code Scanning
32+
uses: github/codeql-action/upload-sarif@v3
33+
with:
34+
sarif_file: snyk.sarif

‎.github/workflows/snyk.yaml‎

Lines changed: 15 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,27 @@
1-
name: Snyk test
1+
name: Snyk test on PR commits
22

33
on:
4-
- pull_request
4+
pull_request:
5+
branches:
6+
- master
7+
- dev
8+
- release-*
59

610
jobs:
711
security:
812
runs-on: ubuntu-latest
9-
1013
steps:
1114
- uses: actions/checkout@v3
12-
- uses: snyk/actions/setup@master
13-
with:
14-
snyk-version: v1.1032.0
15-
16-
- uses: actions/setup-java@v3
17-
with:
18-
distribution: temurin
19-
java-version: 17
20-
21-
- name: Setup Gradle
22-
uses: gradle/gradle-build-action@v2
2315

2416
- name: Run Snyk to check for vulnerabilities
17+
uses: snyk/actions/gradle-jdk17@master
2518
env:
2619
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
27-
run: >
28-
snyk test
29-
--all-projects
30-
--configuration-matching="^runtimeClasspath$"
31-
--fail-on=upgradable
32-
--org=radar-base
33-
--policy-path=.snyk
34-
--severity-threshold=high
20+
with:
21+
args: >-
22+
--all-projects
23+
--configuration-matching="^runtimeClasspath$"
24+
--severity-threshold=high
25+
--fail-on=upgradable
26+
--org=radar-base
27+
--policy-path=.snyk

‎.snyk‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
2+
version: v1.25.0
3+
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
4+
ignore:
5+
patch: {}

‎buildSrc/src/main/kotlin/Versions.kt‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
@Suppress("ConstPropertyName", "MemberVisibilityCanBePrivate")
22
object Versions {
3-
const val project = "0.5.4"
3+
const val project = "0.6.1"
44

55
const val java = 17
66
const val kotlin = "1.9.22"
7-
const val wrapper = "8.4"
7+
const val wrapper = "8.9"
88

99
const val radarCommons = "1.1.3"
10-
const val confluent = "7.7.0"
10+
const val confluent = "7.8.1"
1111
const val kafka = "$confluent-ce"
1212
const val avro = "1.12.0"
1313

@@ -29,4 +29,6 @@ object Versions {
2929
const val junit = "5.10.2"
3030
const val wiremock = "3.0.1"
3131
const val mockito = "5.11.0"
32+
33+
const val nettyVersion = "4.1.118.Final"
3234
}

‎kafka-connect-fitbit-source/Dockerfile‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
FROM --platform=$BUILDPLATFORM gradle:8.4-jdk17 as builder
15+
FROM --platform=$BUILDPLATFORM gradle:8.9-jdk17 AS builder
1616

1717
RUN mkdir /code
1818
WORKDIR /code
@@ -32,16 +32,11 @@ COPY ./kafka-connect-fitbit-source/src/ /code/kafka-connect-fitbit-source/src
3232

3333
RUN gradle jar
3434

35-
FROM confluentinc/cp-kafka-connect-base:7.6.0
36-
37-
USER root
38-
39-
RUN yum remove -y zulu11-ca-jdk-headless && yum remove -y zulu11-ca-jre-headless
40-
RUN yum install -y zulu17-ca-jdk-headless && yum install -y zulu17-ca-jre-headless
35+
FROM confluentinc/cp-kafka-connect-base:7.8.1
4136

4237
USER appuser
4338

44-
MAINTAINER Pim van Nierop <[email protected]>
39+
LABEL org.opencontainers.image.authors="[email protected]"
4540

4641
LABEL description="Kafka REST API Source connector"
4742

‎kafka-connect-fitbit-source/build.gradle.kts‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
description = "Kafka connector for Fitbit API source"
22

33
dependencies {
4+
5+
/* The entries in the block below are added here to force the version of
6+
* transitive dependencies and mitigate reported vulnerabilities
7+
*/
8+
implementation("io.netty:netty-handler-proxy:${Versions.nettyVersion}")
9+
implementation("io.netty:netty-handler:${Versions.nettyVersion}")
10+
411
api(project(":kafka-connect-rest-source"))
512
api(project(":oura-library"))
613
api("io.confluent:kafka-connect-avro-converter:${Versions.confluent}")

‎kafka-connect-fitbit-source/src/main/java/org/radarbase/connect/rest/fitbit/user/ServiceUserRepository.kt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,8 @@ class ServiceUserRepository : UserRepository {
9090
tokenUrl = URLBuilder(config.fitbitUserRepositoryTokenUrl.toString()).build(),
9191
clientId = config.fitbitUserRepositoryClientId,
9292
clientSecret = config.fitbitUserRepositoryClientSecret,
93+
scope = "SUBJECT.READ MEASUREMENT.CREATE",
94+
audience = "res_restAuthorizer",
9395
)
9496

9597
val refreshDuration = config.userCacheRefreshInterval.toKotlinDuration()
@@ -113,6 +115,8 @@ class ServiceUserRepository : UserRepository {
113115
tokenUrl: Url?,
114116
clientId: String?,
115117
clientSecret: String?,
118+
scope: String?,
119+
audience: String?,
116120
): HttpClient = HttpClient(CIO) {
117121
if (tokenUrl != null) {
118122
install(Auth) {
@@ -121,6 +125,8 @@ class ServiceUserRepository : UserRepository {
121125
tokenUrl.toString(),
122126
clientId,
123127
clientSecret,
128+
scope,
129+
audience,
124130
).copyWithEnv("MANAGEMENT_PORTAL"),
125131
baseUrl.host,
126132
)

‎kafka-connect-fitbit-source/src/main/java/org/radarbase/connect/rest/fitbit/user/ServiceUserRepositoryLegacy.java‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,8 @@
3636
import java.util.stream.Collectors;
3737
import java.util.stream.Stream;
3838
import okhttp3.Credentials;
39-
import okhttp3.HttpUrl;
39+
import okhttp3.FormBody;
40+
import okhttp3.HttpUrl;
4041
import okhttp3.MediaType;
4142
import okhttp3.OkHttpClient;
4243
import okhttp3.Request;
@@ -64,6 +65,9 @@ public class ServiceUserRepositoryLegacy implements UserRepository {
6465
private static final Duration CONNECTION_TIMEOUT = Duration.ofSeconds(60);
6566
private static final Duration CONNECTION_READ_TIMEOUT = Duration.ofSeconds(90);
6667

68+
private static final String CLIENT_AUDIENCE = "res_restAuthorizer";
69+
private static final String CLIENT_AUDIENCE_KEY = "audience";
70+
6771
private final OkHttpClient client;
6872
private final Map<String, OAuth2UserCredentials> cachedCredentials;
6973
private final AtomicReference<Instant> nextFetch = new AtomicReference<>(MIN_INSTANT);
@@ -76,6 +80,19 @@ public class ServiceUserRepositoryLegacy implements UserRepository {
7680

7781
public ServiceUserRepositoryLegacy() {
7882
this.client = new OkHttpClient.Builder()
83+
.addInterceptor(chain -> {
84+
Request req = chain.request();
85+
if ("POST".equalsIgnoreCase(req.method()) && req.body() instanceof FormBody) {
86+
FormBody oldBody = (FormBody) req.body();
87+
FormBody.Builder newBody = new FormBody.Builder();
88+
for (int i = 0; i < oldBody.size(); i++) {
89+
newBody.addEncoded(oldBody.encodedName(i), oldBody.encodedValue(i));
90+
}
91+
newBody.add(CLIENT_AUDIENCE_KEY, CLIENT_AUDIENCE);
92+
req = req.newBuilder().post(newBody.build()).build();
93+
}
94+
return chain.proceed(req);
95+
})
7996
.connectTimeout(CONNECTION_TIMEOUT)
8097
.readTimeout(CONNECTION_READ_TIMEOUT)
8198
.build();

‎kafka-connect-oura-source/Dockerfile‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
FROM --platform=$BUILDPLATFORM gradle:8.4-jdk17 as builder
15+
FROM --platform=$BUILDPLATFORM gradle:8.9-jdk17 AS builder
1616

1717
RUN mkdir /code
1818
WORKDIR /code
@@ -32,16 +32,11 @@ COPY ./oura-library/src/ /code/oura-library/src
3232

3333
RUN gradle jar
3434

35-
FROM confluentinc/cp-kafka-connect-base:7.6.0
36-
37-
USER root
38-
39-
RUN yum remove -y zulu11-ca-jdk-headless && yum remove -y zulu11-ca-jre-headless
40-
RUN yum install -y zulu17-ca-jdk-headless && yum install -y zulu17-ca-jre-headless
35+
FROM confluentinc/cp-kafka-connect-base:7.8.1
4136

4237
USER appuser
4338

44-
MAINTAINER Pauline Conde <[email protected]>
39+
LABEL org.opencontainers.image.authors="[email protected]"
4540

4641
LABEL description="Kafka Oura REST API Source connector"
4742

0 commit comments

Comments
 (0)