Plugins and profiles (#2764)

* feat: more plugins

* chore(ci): split out benchmarks

Attempt to resolve too many open files in ci

* chore(ci): split out benchmarks

* fix(ci): Attempt to resolve too many open files in ci

* fix: set DefaultX for cli flag and service option

* fix: restore http broker

* fix: default http broker

* feat: full nats profile

* chore: still ugly, not ready

* fix: better initialization for profiles

* fix(tests): comment out flaky listen tests

* fix: disable benchmarks on gha

* chore: cleanup, comments

* chore: add nats config source

Author: bketelsen

.github/workflows/tests.yaml

@@ -27,7 +27,7 @@ jobs:
           go get -v -t -d ./...
       - name: Run tests
         id: tests
-        run: richgo test -v -race -cover -bench=. ./...
+        run: richgo test -v -race -cover ./...
         env:
           IN_TRAVIS_CI: yes
           RICHGO_FORCE_COLOR: 1

auth/jwt/jwt.go

@@ -0,0 +1,157 @@
+package jwt
+
+import (
+	"sync"
+	"time"
+
+	jwtToken "github.com/micro/plugins/v5/auth/jwt/token"
+	"go-micro.dev/v5/auth"
+	"go-micro.dev/v5/cmd"
+)
+
+func init() {
+	cmd.DefaultAuths["jwt"] = NewAuth
+}
+
+// NewAuth returns a new instance of the Auth service.
+func NewAuth(opts ...auth.Option) auth.Auth {
+	j := new(jwt)
+	j.Init(opts...)
+	return j
+}
+
+func NewRules() auth.Rules {
+	return new(jwtRules)
+}
+
+type jwt struct {
+	sync.Mutex
+	options auth.Options
+	jwt     jwtToken.Provider
+}
+
+type jwtRules struct {
+	sync.Mutex
+	rules []*auth.Rule
+}
+
+func (j *jwt) String() string {
+	return "jwt"
+}
+
+func (j *jwt) Init(opts ...auth.Option) {
+	j.Lock()
+	defer j.Unlock()
+
+	for _, o := range opts {
+		o(&j.options)
+	}
+
+	j.jwt = jwtToken.New(
+		jwtToken.WithPrivateKey(j.options.PrivateKey),
+		jwtToken.WithPublicKey(j.options.PublicKey),
+	)
+}
+
+func (j *jwt) Options() auth.Options {
+	j.Lock()
+	defer j.Unlock()
+	return j.options
+}
+
+func (j *jwt) Generate(id string, opts ...auth.GenerateOption) (*auth.Account, error) {
+	options := auth.NewGenerateOptions(opts...)
+	account := &auth.Account{
+		ID:       id,
+		Type:     options.Type,
+		Scopes:   options.Scopes,
+		Metadata: options.Metadata,
+		Issuer:   j.Options().Namespace,
+	}
+
+	// generate a JWT secret which can be provided to the Token() method
+	// and exchanged for an access token
+	secret, err := j.jwt.Generate(account)
+	if err != nil {
+		return nil, err
+	}
+	account.Secret = secret.Token
+
+	// return the account
+	return account, nil
+}
+
+func (j *jwtRules) Grant(rule *auth.Rule) error {
+	j.Lock()
+	defer j.Unlock()
+	j.rules = append(j.rules, rule)
+	return nil
+}
+
+func (j *jwtRules) Revoke(rule *auth.Rule) error {
+	j.Lock()
+	defer j.Unlock()
+
+	rules := make([]*auth.Rule, 0, len(j.rules))
+	for _, r := range j.rules {
+		if r.ID != rule.ID {
+			rules = append(rules, r)
+		}
+	}
+
+	j.rules = rules
+	return nil
+}
+
+func (j *jwtRules) Verify(acc *auth.Account, res *auth.Resource, opts ...auth.VerifyOption) error {
+	j.Lock()
+	defer j.Unlock()
+
+	var options auth.VerifyOptions
+	for _, o := range opts {
+		o(&options)
+	}
+
+	return auth.Verify(j.rules, acc, res)
+}
+
+func (j *jwtRules) List(opts ...auth.ListOption) ([]*auth.Rule, error) {
+	j.Lock()
+	defer j.Unlock()
+	return j.rules, nil
+}
+
+func (j *jwt) Inspect(token string) (*auth.Account, error) {
+	return j.jwt.Inspect(token)
+}
+
+func (j *jwt) Token(opts ...auth.TokenOption) (*auth.Token, error) {
+	options := auth.NewTokenOptions(opts...)
+
+	secret := options.RefreshToken
+	if len(options.Secret) > 0 {
+		secret = options.Secret
+	}
+
+	account, err := j.jwt.Inspect(secret)
+	if err != nil {
+		return nil, err
+	}
+
+	access, err := j.jwt.Generate(account, jwtToken.WithExpiry(options.Expiry))
+	if err != nil {
+		return nil, err
+	}
+
+	refresh, err := j.jwt.Generate(account, jwtToken.WithExpiry(options.Expiry+time.Hour))
+	if err != nil {
+		return nil, err
+	}
+
+	return &auth.Token{
+		Created:      access.Created,
+		Expiry:       access.Expiry,
+		AccessToken:  access.Token,
+		RefreshToken: refresh.Token,
+	}, nil
+}

auth/jwt/token/jwt.go

@@ -0,0 +1,109 @@
+package token
+
+import (
+	"encoding/base64"
+	"time"
+
+	"github.com/dgrijalva/jwt-go"
+	"go-micro.dev/v5/auth"
+)
+
+// authClaims to be encoded in the JWT.
+type authClaims struct {
+	Type     string            `json:"type"`
+	Scopes   []string          `json:"scopes"`
+	Metadata map[string]string `json:"metadata"`
+
+	jwt.StandardClaims
+}
+
+// JWT implementation of token provider.
+type JWT struct {
+	opts Options
+}
+
+// New returns an initialized basic provider.
+func New(opts ...Option) Provider {
+	return &JWT{
+		opts: NewOptions(opts...),
+	}
+}
+
+// Generate a new JWT.
+func (j *JWT) Generate(acc *auth.Account, opts ...GenerateOption) (*Token, error) {
+	// decode the private key
+	priv, err := base64.StdEncoding.DecodeString(j.opts.PrivateKey)
+	if err != nil {
+		return nil, err
+	}
+
+	// parse the private key
+	key, err := jwt.ParseRSAPrivateKeyFromPEM(priv)
+	if err != nil {
+		return nil, ErrEncodingToken
+	}
+
+	// parse the options
+	options := NewGenerateOptions(opts...)
+
+	// generate the JWT
+	expiry := time.Now().Add(options.Expiry)
+	t := jwt.NewWithClaims(jwt.SigningMethodRS256, authClaims{
+		acc.Type, acc.Scopes, acc.Metadata, jwt.StandardClaims{
+			Subject:   acc.ID,
+			Issuer:    acc.Issuer,
+			ExpiresAt: expiry.Unix(),
+		},
+	})
+	tok, err := t.SignedString(key)
+	if err != nil {
+		return nil, err
+	}
+
+	// return the token
+	return &Token{
+		Token:   tok,
+		Expiry:  expiry,
+		Created: time.Now(),
+	}, nil
+}
+
+// Inspect a JWT.
+func (j *JWT) Inspect(t string) (*auth.Account, error) {
+	// decode the public key
+	pub, err := base64.StdEncoding.DecodeString(j.opts.PublicKey)
+	if err != nil {
+		return nil, err
+	}
+
+	// parse the public key
+	res, err := jwt.ParseWithClaims(t, &authClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return jwt.ParseRSAPublicKeyFromPEM(pub)
+	})
+	if err != nil {
+		return nil, ErrInvalidToken
+	}
+
+	// validate the token
+	if !res.Valid {
+		return nil, ErrInvalidToken
+	}
+	claims, ok := res.Claims.(*authClaims)
+	if !ok {
+		return nil, ErrInvalidToken
+	}
+
+	// return the token
+	return &auth.Account{
+		ID:       claims.Subject,
+		Issuer:   claims.Issuer,
+		Type:     claims.Type,
+		Scopes:   claims.Scopes,
+		Metadata: claims.Metadata,
+	}, nil
+}
+
+// String returns JWT.
+func (j *JWT) String() string {
+	return "jwt"
+}

auth/jwt/token/jwt_test.go

@@ -0,0 +1,85 @@
+package token
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	"go-micro.dev/v5/auth"
+)
+
+func TestGenerate(t *testing.T) {
+	privKey, err := os.ReadFile("test/sample_key")
+	if err != nil {
+		t.Fatalf("Unable to read private key: %v", err)
+	}
+
+	j := New(
+		WithPrivateKey(string(privKey)),
+	)
+
+	_, err = j.Generate(&auth.Account{ID: "test"})
+	if err != nil {
+		t.Fatalf("Generate returned %v error, expected nil", err)
+	}
+}
+
+func TestInspect(t *testing.T) {
+	pubKey, err := os.ReadFile("test/sample_key.pub")
+	if err != nil {
+		t.Fatalf("Unable to read public key: %v", err)
+	}
+	privKey, err := os.ReadFile("test/sample_key")
+	if err != nil {
+		t.Fatalf("Unable to read private key: %v", err)
+	}
+
+	j := New(
+		WithPublicKey(string(pubKey)),
+		WithPrivateKey(string(privKey)),
+	)
+
+	t.Run("Valid token", func(t *testing.T) {
+		md := map[string]string{"foo": "bar"}
+		scopes := []string{"admin"}
+		subject := "test"
+
+		acc := &auth.Account{ID: subject, Scopes: scopes, Metadata: md}
+		tok, err := j.Generate(acc)
+		if err != nil {
+			t.Fatalf("Generate returned %v error, expected nil", err)
+		}
+
+		tok2, err := j.Inspect(tok.Token)
+		if err != nil {
+			t.Fatalf("Inspect returned %v error, expected nil", err)
+		}
+		if acc.ID != subject {
+			t.Errorf("Inspect returned %v as the token subject, expected %v", acc.ID, subject)
+		}
+		if len(tok2.Scopes) != len(scopes) {
+			t.Errorf("Inspect returned %v scopes, expected %v", len(tok2.Scopes), len(scopes))
+		}
+		if len(tok2.Metadata) != len(md) {
+			t.Errorf("Inspect returned %v as the token metadata, expected %v", tok2.Metadata, md)
+		}
+	})
+
+	t.Run("Expired token", func(t *testing.T) {
+		tok, err := j.Generate(&auth.Account{}, WithExpiry(-10*time.Second))
+		if err != nil {
+			t.Fatalf("Generate returned %v error, expected nil", err)
+		}
+
+		if _, err = j.Inspect(tok.Token); err != ErrInvalidToken {
+			t.Fatalf("Inspect returned %v error, expected %v", err, ErrInvalidToken)
+		}
+	})
+
+	t.Run("Invalid token", func(t *testing.T) {
+		_, err := j.Inspect("Invalid token")
+		if err != ErrInvalidToken {
+			t.Fatalf("Inspect returned %v error, expected %v", err, ErrInvalidToken)
+		}
+	})
+}