fix: access-token does not get refreshed if not present

Author: macrozone

src/cloud_auth.ts

@@ -7,51 +7,69 @@ import { User } from './config_types';
 
 export class CloudAuth implements Authenticator {
     public isAuthProvider(user: User): boolean {
-        return user.authProvider.name === 'azure' ||
-            user.authProvider.name === 'gcp';
+        return (
+            user.authProvider.name === 'azure' ||
+            user.authProvider.name === 'gcp'
+        );
     }
 
     public getToken(user: User): string | null {
         const config = user.authProvider.config;
-        // This should probably be extracted as auth-provider specific plugins...
-        let token: string = 'Bearer ' + config['access-token'];
+        if (this.isExpired(config)) {
+            this.updateAccessToken(config);
+        }
+        return 'Bearer ' + config['access-token'];
+    }
+
+    private isExpired(config) {
+        const token = config['access-token']
         const expiry = config.expiry;
+        if (!token) {
+            return true;
+        }
+        if(!expiry) {
+            return false
+        }
+
+        const expiration = Date.parse(expiry);
+        if (expiration < Date.now()) {
+            return true;
+        }
+        return false;
+    }
 
-        if (expiry) {
-            const expiration = Date.parse(expiry);
-            if (expiration < Date.now()) {
-                if (config['cmd-path']) {
-                    const args = config['cmd-args'];
-                    // TODO: Cache to file?
-                    // TODO: do this asynchronously
-                    let result: any;
-                    try {
-                        let cmd = config['cmd-path'];
-                        if (args) {
-                            cmd = `${cmd} ${args}`;
-                        }
-                        result = shelljs.exec(cmd);
-                        if (result.code !== 0) {
-                            throw new Error(result.stderr);
-                        }
-                    } catch (err) {
-                        throw new Error('Failed to refresh token: ' + err.message);
-                    }
-
-                    const output = result.stdout.toString();
-                    const resultObj = JSON.parse(output);
-
-                    let pathKey = config['token-key'];
-                    // Format in file is {<query>}, so slice it out and add '$'
-                    pathKey = '$' + pathKey.slice(1, -1);
-
-                    config['access-token'] = jsonpath.query(resultObj, pathKey);
-                    token = 'Bearer ' + config['access-token'];
-                } else {
-                    throw new Error('Token is expired!');
-                }
+    private updateAccessToken(config) {
+        if (!config['cmd-path']) {
+            throw new Error('Token is expired!');
+        }
+        const args = config['cmd-args'];
+        // TODO: Cache to file?
+        // TODO: do this asynchronously
+        let result: any;
+        try {
+            let cmd = config['cmd-path'];
+            if (args) {
+                cmd = `${cmd} ${args}`;
             }
+            result = shelljs.exec(cmd);
+            if (result.code !== 0) {
+                throw new Error(result.stderr);
+            }
+        } catch (err) {
+            throw new Error('Failed to refresh token: ' + err.message);
         }
-        return token;
+
+        const output = result.stdout.toString();
+        const resultObj = JSON.parse(output);
+
+        let tokenPathKey = config['token-key'];
+
+        let expiryPathKey = config['token-key'];
+        // Format in file is {<query>}, so slice it out and add '$'
+        tokenPathKey = '$' + tokenPathKey.slice(1, -1);
+        expiryPathKey = '$' + expiryPathKey.slice(1, -1);
+
+        config['access-token'] = jsonpath.query(resultObj, tokenPathKey);
+        config['expiry'] = jsonpath.query(resultObj, expiryPathKey);
     }
 }

src/config_test.ts

@@ -542,6 +542,7 @@ describe('KubeConfig', () => {
             config.applyToRequest(opts);
             expect(opts.headers.Authorization).to.equal(`Bearer ${token}`);
         });
+
         it('should populate from auth provider without expirty', () => {
             const config = new KubeConfig();
             const token = 'token';
@@ -589,14 +590,15 @@ describe('KubeConfig', () => {
                     authProvider: {
                         name: 'azure',
                         config: {
+                            'access-token': 'token',
                             'expiry': 'Aug 24 07:32:05 PDT 2017',
                             'cmd-path': 'non-existent-command',
                         },
                     },
                 } as User);
             const opts = {} as requestlib.Options;
             expect(() => config.applyToRequest(opts)).to.throw(
-                'Failed to refresh token: /bin/sh: 1: non-existent-command: not found');
+                /Failed to refresh token/);
         });
 
         it('should exec with expired token', () => {
@@ -624,6 +626,30 @@ describe('KubeConfig', () => {
             }
         });
 
+        it('should exec without access-token', () => {
+            const config = new KubeConfig();
+            const token = 'token';
+            const responseStr = `{ "token": { "accessToken": "${token}" } }`;
+            config.loadFromClusterAndUser(
+                { skipTLSVerify: false } as Cluster,
+                {
+                    authProvider: {
+                        name: 'azure',
+                        config: {
+                            'cmd-path': 'echo',
+                            'cmd-args': `'${responseStr}'`,
+                            'token-key': '{.token.accessToken}',
+                        },
+                    },
+                } as User);
+            const opts = {} as requestlib.Options;
+            config.applyToRequest(opts);
+            expect(opts.headers).to.not.be.undefined;
+            if (opts.headers) {
+                expect(opts.headers.Authorization).to.equal(`Bearer ${token}`);
+            }
+        });
+
         it('should exec with exec auth', () => {
             const config = new KubeConfig();
             const token = 'token';