Repository navigation
Enable deploy from url with token
#1928
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -804,3 +804,6 @@ definitions: | |
| password: | ||
| type: "string" | ||
| readOnly: true | ||
| token: | ||
| type: "string" | ||
| readOnly: true | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| package org.cloudfoundry.multiapps.controller.web.upload.client.auth; | ||
|
|
||
| import java.net.URI; | ||
|
|
||
| import jakarta.inject.Named; | ||
|
|
||
| import org.apache.commons.lang3.StringUtils; | ||
| import org.cloudfoundry.multiapps.controller.api.model.UserCredentials; | ||
|
|
||
| /** | ||
| * Resolves the single {@link RequestAuthenticator} to apply to a deploy-from-URL fetch, from the | ||
| * request's credentials and the target URI. The precedence is stated here, in one place: | ||
| * <ol> | ||
| * <li>{@code token} on the credentials object → {@link BearerTokenAuthenticator}</li> | ||
| * <li>username/password on the credentials object → {@link BasicAuthenticator}</li> | ||
| * <li>user info embedded in the URL ({@code user:pass@host}) → {@link UrlUserInfoAuthenticator}</li> | ||
| * <li>otherwise → {@link NoAuthenticator}</li> | ||
| * </ol> | ||
| * Adding a new scheme means adding one branch here plus its authenticator class — the downloader and | ||
| * the job/orchestration code stay untouched. | ||
| */ | ||
| @Named | ||
| public class AuthenticatorResolver { | ||
|
|
||
| public RequestAuthenticator resolve(UserCredentials userCredentials, String decodedUrl) { | ||
| if (userCredentials != null) { | ||
| if (StringUtils.isNotBlank(userCredentials.getToken())) { | ||
| return new BearerTokenAuthenticator(userCredentials.getToken()); | ||
| } | ||
| return new BasicAuthenticator(userCredentials.getUsername(), userCredentials.getPassword()); | ||
| } | ||
|
Comment on lines
+27
to
+31
Contributor
There was a problem hiding this comment. The token branch guards with |
||
| if (URI.create(decodedUrl).getUserInfo() != null) { | ||
| return new UrlUserInfoAuthenticator(decodedUrl); | ||
| } | ||
| return new NoAuthenticator(); | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| package org.cloudfoundry.multiapps.controller.web.upload.client.auth; | ||
|
|
||
| import java.net.URI; | ||
| import java.net.http.HttpRequest; | ||
| import java.nio.charset.StandardCharsets; | ||
| import java.util.Base64; | ||
|
|
||
| import org.springframework.http.HttpHeaders; | ||
|
|
||
| /** | ||
| * HTTP Basic authenticator built from an explicit username and password. Encodes {@code username:password} | ||
| * as Base64 and sets the {@code Authorization: Basic ...} header. The URI is used as-is. | ||
| */ | ||
| public class BasicAuthenticator implements RequestAuthenticator { | ||
|
|
||
| private final String username; | ||
| private final String password; | ||
|
|
||
| public BasicAuthenticator(String username, String password) { | ||
| this.username = username; | ||
| this.password = password; | ||
| } | ||
|
|
||
| @Override | ||
| public void applyTo(HttpRequest.Builder builder, URI uri) { | ||
| builder.uri(uri); | ||
| String credentials = username + ":" + password; | ||
| String encodedAuth = Base64.getEncoder() | ||
| .encodeToString(credentials.getBytes(StandardCharsets.UTF_8)); | ||
| builder.header(HttpHeaders.AUTHORIZATION, "Basic " + encodedAuth); | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| package org.cloudfoundry.multiapps.controller.web.upload.client.auth; | ||
|
|
||
| import java.net.URI; | ||
| import java.net.http.HttpRequest; | ||
|
|
||
| import org.springframework.http.HttpHeaders; | ||
|
|
||
| /** | ||
| * Bearer-token authenticator. Sets {@code Authorization: Bearer <token>} with the caller-supplied token | ||
| * verbatim and targets the URI as-is. This is the scheme required by GitHub (fine-grained/classic PATs, | ||
| * GitHub App installation tokens, {@code GITHUB_TOKEN}), which all present identically on the wire. | ||
| */ | ||
| public class BearerTokenAuthenticator implements RequestAuthenticator { | ||
|
|
||
| private final String token; | ||
|
|
||
| public BearerTokenAuthenticator(String token) { | ||
| this.token = token; | ||
| } | ||
|
|
||
| @Override | ||
| public void applyTo(HttpRequest.Builder builder, URI uri) { | ||
| builder.uri(uri); | ||
| builder.header(HttpHeaders.AUTHORIZATION, "Bearer " + token); | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| package org.cloudfoundry.multiapps.controller.web.upload.client.auth; | ||
|
|
||
| import java.net.URI; | ||
| import java.net.http.HttpRequest; | ||
|
|
||
| /** | ||
| * No-op authenticator: targets the URI as-is and attaches no {@code Authorization} header. Used when | ||
| * the request carries no credentials. | ||
| */ | ||
| public class NoAuthenticator implements RequestAuthenticator { | ||
|
|
||
| @Override | ||
| public void applyTo(HttpRequest.Builder builder, URI uri) { | ||
| builder.uri(uri); | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| package org.cloudfoundry.multiapps.controller.web.upload.client.auth; | ||
|
|
||
| import java.net.URI; | ||
| import java.net.http.HttpRequest; | ||
|
|
||
| /** | ||
| * Strategy for attaching authentication to an outbound deploy-from-URL fetch request. | ||
| * <p> | ||
| * Each implementation owns a single authentication scheme: how it encodes its credential and which | ||
| * header (if any) it sets. The downloader stays agnostic of Base64 encoding and header names. | ||
| * <p> | ||
| * The resolver ({@link AuthenticatorResolver}) picks exactly one authenticator per request based on | ||
| * the supplied credentials and the URL. Implementations must not mutate anything other than the | ||
| * request builder (and the request URI, when they strip embedded user info from it). | ||
| */ | ||
| public interface RequestAuthenticator { | ||
|
|
||
| /** | ||
| * Applies this scheme to the request being built. | ||
| * | ||
| * @param builder the request builder to mutate (set the URI and, when applicable, the {@code Authorization} header) | ||
| * @param uri the target URI as parsed from the decoded URL | ||
| */ | ||
| void applyTo(HttpRequest.Builder builder, URI uri); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| package org.cloudfoundry.multiapps.controller.web.upload.client.auth; | ||
|
|
||
| import java.net.URI; | ||
| import java.net.http.HttpRequest; | ||
| import java.nio.charset.StandardCharsets; | ||
| import java.util.Base64; | ||
|
|
||
| import org.springframework.http.HttpHeaders; | ||
|
|
||
| /** | ||
| * HTTP Basic authenticator built from user info embedded in the URL itself ({@code https://user:pass@host/...}). | ||
| * Strips the raw user-info component from the URI (so it is not sent in the request line) and sets | ||
| * {@code Authorization: Basic ...} from the decoded user-info string. | ||
| * <p> | ||
| * This preserves the legacy behavior for callers that embed credentials in the URL; it is deliberately | ||
| * not extended for new schemes — new credentials should be passed as explicit fields instead. | ||
| */ | ||
| public class UrlUserInfoAuthenticator implements RequestAuthenticator { | ||
|
|
||
| private final String decodedUrl; | ||
|
|
||
| public UrlUserInfoAuthenticator(String decodedUrl) { | ||
| this.decodedUrl = decodedUrl; | ||
| } | ||
|
|
||
| @Override | ||
| public void applyTo(HttpRequest.Builder builder, URI uri) { | ||
| builder.uri(URI.create(decodedUrl.replace(uri.getRawUserInfo() + "@", ""))); | ||
| String encodedAuth = Base64.getEncoder() | ||
| .encodeToString(uri.getUserInfo() | ||
| .getBytes(StandardCharsets.UTF_8)); | ||
| builder.header(HttpHeaders.AUTHORIZATION, "Basic " + encodedAuth); | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
From what I understood readOnly true means the field is only present in responses but not in the request, which in our case is the opposite. I think it shoule be false here