Skip to content

Migrate github.com/SermoDigital to github.com/golang-jwt for 1.27.0 c… #3872

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
benjaminguttmann-avtq wants to merge 1 commit into
base: v8
Choose a base branch
from
+127 −117
Open

Migrate github.com/SermoDigital to github.com/golang-jwt for 1.27.0 c… #3872

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions actor/v7action/logging.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import (
"time"

"code.cloudfoundry.org/cli/v8/actor/sharedaction"
"github.com/SermoDigital/jose/jws"
utiljwt "code.cloudfoundry.org/cli/v8/util/jwt"
)

func (actor Actor) GetStreamingLogsForApplicationByNameAndSpace(appName string, spaceGUID string, client sharedaction.LogCacheClient) (<-chan sharedaction.LogMessage, <-chan error, context.CancelFunc, Warnings, error) {
Expand Down Expand Up @@ -92,17 +92,17 @@ func (actor Actor) refreshAccessTokenIfNecessary() (*time.Duration, error) {
}

accessToken = strings.TrimPrefix(accessToken, "bearer ")
token, err := jws.ParseJWT([]byte(accessToken))
claims, err := utiljwt.ParseUnverified(accessToken)
if err != nil {
return nil, err
}

var timeToRefresh time.Duration
expiration, ok := token.Claims().Expiration()
if !ok {
expiration, err := claims.GetExpirationTime()
if err != nil || expiration == nil {
return nil, errors.New("Failed to get an expiry time from the current access token")
}
expiresIn := time.Until(expiration)
expiresIn := time.Until(expiration.Time)
if expiresIn >= 2*time.Minute {
timeToRefresh = expiresIn - time.Minute
} else {
Expand All @@ -115,14 +115,14 @@ func (actor Actor) tokenExpiryTime(accessToken string) (*time.Duration, error) {
var expiresIn time.Duration

accessTokenString := strings.TrimPrefix(accessToken, "bearer ")
token, err := jws.ParseJWT([]byte(accessTokenString))
claims, err := utiljwt.ParseUnverified(accessTokenString)
if err != nil {
return nil, err
}

expiration, ok := token.Claims().Expiration()
if ok {
expiresIn = time.Until(expiration)
expiration, err := claims.GetExpirationTime()
if err == nil && expiration != nil {
expiresIn = time.Until(expiration.Time)
}
return &expiresIn, nil
}
16 changes: 8 additions & 8 deletions actor/v7action/token.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ import (
"strings"
"time"

"github.com/SermoDigital/jose/jws"
"github.com/SermoDigital/jose/jwt"
utiljwt "code.cloudfoundry.org/cli/v8/util/jwt"
jwtv5 "github.com/golang-jwt/jwt/v5"
)

func (actor Actor) RefreshAccessToken() (string, error) {
Expand All @@ -14,12 +14,12 @@ func (actor Actor) RefreshAccessToken() (string, error) {
refreshToken := actor.Config.RefreshToken()

accessTokenString := strings.TrimPrefix(actor.Config.AccessToken(), "bearer ")
token, err := jws.ParseJWT([]byte(accessTokenString))
claims, err := utiljwt.ParseUnverified(accessTokenString)

if err == nil {
expiration, ok := token.Claims().Expiration()
if ok {
expiresIn = time.Until(expiration)
expiration, err := claims.GetExpirationTime()
if err == nil && expiration != nil {
expiresIn = time.Until(expiration.Time)
}
}

Expand All @@ -37,7 +37,7 @@ func (actor Actor) RefreshAccessToken() (string, error) {
return actor.Config.AccessToken(), nil
}

func (actor Actor) ParseAccessToken(accessToken string) (jwt.JWT, error) {
func (actor Actor) ParseAccessToken(accessToken string) (jwtv5.MapClaims, error) {
tokenStr := strings.TrimPrefix(accessToken, "bearer ")
return jws.ParseJWT([]byte(tokenStr))
return utiljwt.ParseUnverified(tokenStr)
}
27 changes: 14 additions & 13 deletions api/cloudcontroller/wrapper/kubernetes_authentication_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,7 @@ import (
"code.cloudfoundry.org/cli/v8/api/cloudcontroller/wrapper"
"code.cloudfoundry.org/cli/v8/command/commandfakes"
"code.cloudfoundry.org/cli/v8/integration/helpers"
"github.com/SermoDigital/jose/crypto"
"github.com/SermoDigital/jose/jws"
jwtv5 "github.com/golang-jwt/jwt/v5"
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
Expand Down Expand Up @@ -146,11 +145,13 @@ var _ = Describe("KubernetesAuthentication", func() {
checkBearerTokenInAuthHeader := func() {
actualReq := checkCalls()

token, err := jws.ParseJWTFromRequest(actualReq.Request)
token, err := jwtv5.Parse(strings.TrimPrefix(actualReq.Header.Get("Authorization"), "Bearer "), func(_ *jwtv5.Token) (interface{}, error) {
return keyPair.Public(), nil
}, jwtv5.WithValidMethods([]string{jwtv5.SigningMethodRS256.Alg()}))
Expect(err).NotTo(HaveOccurred())
Expect(token.Validate(keyPair.Public(), crypto.SigningMethodRS256)).To(Succeed())
Expect(token.Valid).To(BeTrue())

claims := token.Claims()
claims := token.Claims.(jwtv5.MapClaims)
Expect(claims).To(HaveKeyWithValue("another", "thing"))
}

Expand Down Expand Up @@ -178,13 +179,13 @@ var _ = Describe("KubernetesAuthentication", func() {
var token []byte

BeforeEach(func() {
jwt := jws.NewJWT(jws.Claims{
claims := jwtv5.MapClaims{
"exp": time.Now().Add(time.Hour).Unix(),
"another": "thing",
}, crypto.SigningMethodRS256)
var err error
token, err = jwt.Serialize(keyPair)
}
tokenString, err := jwtv5.NewWithClaims(jwtv5.SigningMethodRS256, claims).SignedString(keyPair)
Expect(err).NotTo(HaveOccurred())
token = []byte(tokenString)

kubeConfig.AuthInfos["auth-test"] = &api.AuthInfo{
AuthProvider: &api.AuthProviderConfig{
Expand Down Expand Up @@ -368,13 +369,13 @@ var _ = Describe("KubernetesAuthentication", func() {
var token []byte

BeforeEach(func() {
jwt := jws.NewJWT(jws.Claims{
claims := jwtv5.MapClaims{
"exp": time.Now().Add(time.Hour).Unix(),
"another": "thing",
}, crypto.SigningMethodRS256)
var err error
token, err = jwt.Serialize(keyPair)
}
tokenString, err := jwtv5.NewWithClaims(jwtv5.SigningMethodRS256, claims).SignedString(keyPair)
Expect(err).NotTo(HaveOccurred())
token = []byte(tokenString)
})

Context("inline tokens", func() {
Expand Down
10 changes: 5 additions & 5 deletions api/cloudcontroller/wrapper/uaa_authentication.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ import (
"strings"
"time"

"github.com/SermoDigital/jose/jws"
utiljwt "code.cloudfoundry.org/cli/v8/util/jwt"

"code.cloudfoundry.org/cli/v8/api/cloudcontroller"
"code.cloudfoundry.org/cli/v8/api/uaa"
Expand Down Expand Up @@ -81,12 +81,12 @@ func (t *UAAAuthentication) refreshTokenIfNecessary(accessToken string) error {
var expiresIn time.Duration

tokenStr := strings.TrimPrefix(accessToken, "bearer ")
token, err := jws.ParseJWT([]byte(tokenStr))
claims, err := utiljwt.ParseUnverified(tokenStr)

if err == nil {
expiration, ok := token.Claims().Expiration()
if ok {
expiresIn = time.Until(expiration)
expiration, err := claims.GetExpirationTime()
if err == nil && expiration != nil {
expiresIn = time.Until(expiration.Time)
}
}

Expand Down
12 changes: 5 additions & 7 deletions api/cloudcontroller/wrapper/uaa_authentication_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,7 @@ import (

"code.cloudfoundry.org/cli/v8/api/uaa"

"github.com/SermoDigital/jose/crypto"
"github.com/SermoDigital/jose/jws"
jwtv5 "github.com/golang-jwt/jwt/v5"

"code.cloudfoundry.org/cli/v8/api/cloudcontroller/ccerror"

Expand Down Expand Up @@ -225,9 +224,8 @@ var _ = Describe("UAA Authentication", func() {
})

func buildTokenString(expiration time.Time) (string, error) {
c := jws.Claims{}
c.SetExpiration(expiration)
token := jws.NewJWT(c, crypto.Unsecured)
tokenBytes, err := token.Serialize(nil)
return string(tokenBytes), err
claims := jwtv5.MapClaims{"exp": jwtv5.NewNumericDate(expiration)}
token := jwtv5.NewWithClaims(jwtv5.SigningMethodNone, claims)
tokenBytes, err := token.SignedString(jwtv5.UnsafeAllowNoneSignatureType)
return tokenBytes, err
}
27 changes: 14 additions & 13 deletions api/shared/wrap_for_cf_on_k8s_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,7 @@ import (
"code.cloudfoundry.org/cli/v8/command/commandfakes"
"code.cloudfoundry.org/cli/v8/integration/helpers"

"github.com/SermoDigital/jose/crypto"
"github.com/SermoDigital/jose/jws"
jwtv5 "github.com/golang-jwt/jwt/v5"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
clientauthenticationv1beta1 "k8s.io/client-go/pkg/apis/clientauthentication/v1beta1"
"k8s.io/client-go/tools/clientcmd/api"
Expand Down Expand Up @@ -148,11 +147,13 @@ var _ = Describe("WrapForCFOnK8sAuth", func() {
checkBearerTokenInAuthHeader := func() {
actualReq := checkCalls()

token, err := jws.ParseJWTFromRequest(actualReq)
token, err := jwtv5.Parse(strings.TrimPrefix(actualReq.Header.Get("Authorization"), "Bearer "), func(_ *jwtv5.Token) (interface{}, error) {
return keyPair.Public(), nil
}, jwtv5.WithValidMethods([]string{jwtv5.SigningMethodRS256.Alg()}))
Expect(err).NotTo(HaveOccurred())
Expect(token.Validate(keyPair.Public(), crypto.SigningMethodRS256)).To(Succeed())
Expect(token.Valid).To(BeTrue())

claims := token.Claims()
claims := token.Claims.(jwtv5.MapClaims)
Expect(claims).To(HaveKeyWithValue("another", "thing"))
}

Expand Down Expand Up @@ -180,13 +181,13 @@ var _ = Describe("WrapForCFOnK8sAuth", func() {
var token []byte

BeforeEach(func() {
jwt := jws.NewJWT(jws.Claims{
claims := jwtv5.MapClaims{
"exp": time.Now().Add(time.Hour).Unix(),
"another": "thing",
}, crypto.SigningMethodRS256)
var err error
token, err = jwt.Serialize(keyPair)
}
tokenString, err := jwtv5.NewWithClaims(jwtv5.SigningMethodRS256, claims).SignedString(keyPair)
Expect(err).NotTo(HaveOccurred())
token = []byte(tokenString)

kubeConfig.AuthInfos["auth-test"] = &api.AuthInfo{
AuthProvider: &api.AuthProviderConfig{
Expand Down Expand Up @@ -371,13 +372,13 @@ var _ = Describe("WrapForCFOnK8sAuth", func() {
var token []byte

BeforeEach(func() {
jwt := jws.NewJWT(jws.Claims{
claims := jwtv5.MapClaims{
"exp": time.Now().Add(time.Hour).Unix(),
"another": "thing",
}, crypto.SigningMethodRS256)
var err error
token, err = jwt.Serialize(keyPair)
}
tokenString, err := jwtv5.NewWithClaims(jwtv5.SigningMethodRS256, claims).SignedString(keyPair)
Expect(err).NotTo(HaveOccurred())
token = []byte(tokenString)
})

Context("inline tokens", func() {
Expand Down
8 changes: 4 additions & 4 deletions cf/api/authentication/authentication.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ import (
"strings"
"time"

"github.com/SermoDigital/jose/jws"
utiljwt "code.cloudfoundry.org/cli/v8/util/jwt"

"code.cloudfoundry.org/cli/v8/cf/configuration/coreconfig"
"code.cloudfoundry.org/cli/v8/cf/errors"
Expand Down Expand Up @@ -189,12 +189,12 @@ func (uaa UAARepository) RefreshAuthToken() (string, error) {

func (uaa UAARepository) RefreshToken(t string) (string, error) {
tokenStr := strings.TrimPrefix(t, "bearer ")
token, err := jws.ParseJWT([]byte(tokenStr))
claims, err := utiljwt.ParseUnverified(tokenStr)
if err != nil {
return "", err
}
expiration, ok := token.Claims().Expiration()
if ok && expiration.Sub(time.Now()) > accessTokenExpirationMargin {
expiration, err := claims.GetExpirationTime()
if err == nil && expiration != nil && expiration.Sub(time.Now()) > accessTokenExpirationMargin {
return t, nil
}

Expand Down
10 changes: 4 additions & 6 deletions cf/util/testhelpers/configuration/access_token.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,7 @@ import (
"fmt"
"time"

"github.com/SermoDigital/jose/crypto"
"github.com/SermoDigital/jose/jws"
jwtv5 "github.com/golang-jwt/jwt/v5"

"code.cloudfoundry.org/cli/v8/cf/configuration/coreconfig"
)
Expand All @@ -24,9 +23,8 @@ func EncodeAccessToken(tokenInfo coreconfig.TokenInfo) (accessToken string, err

// BuildTokenString builds a minimal JWT with the given time as expiration claim.
func BuildTokenString(expiration time.Time) string {
c := jws.Claims{}
c.SetExpiration(expiration)
token := jws.NewJWT(c, crypto.Unsecured)
tokenBytes, _ := token.Serialize(nil)
claims := jwtv5.MapClaims{"exp": jwtv5.NewNumericDate(expiration)}
token := jwtv5.NewWithClaims(jwtv5.SigningMethodNone, claims)
tokenBytes, _ := token.SignedString(jwtv5.UnsafeAllowNoneSignatureType)
return string(tokenBytes)
}
4 changes: 2 additions & 2 deletions command/v7/actor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ import (
"code.cloudfoundry.org/cli/v8/resources"
"code.cloudfoundry.org/cli/v8/types"
"code.cloudfoundry.org/cli/v8/util/configv3"
"github.com/SermoDigital/jose/jwt"
jwtv5 "github.com/golang-jwt/jwt/v5"
)

//go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 . Actor
Expand Down Expand Up @@ -197,7 +197,7 @@ type Actor interface {
MapRoute(routeGUID string, appGUID string, destinationProtocol string, destinationPort int) (v7action.Warnings, error)
Marketplace(filter v7action.MarketplaceFilter) ([]v7action.ServiceOfferingWithPlans, v7action.Warnings, error)
MoveRoute(routeGUID string, spaceGUID string) (v7action.Warnings, error)
ParseAccessToken(accessToken string) (jwt.JWT, error)
ParseAccessToken(accessToken string) (jwtv5.MapClaims, error)
PollBuild(buildGUID string, appName string) (resources.Droplet, v7action.Warnings, error)
PollPackage(pkg resources.Package) (resources.Package, v7action.Warnings, error)
PollStart(app resources.Application, noWait bool, handleProcessStats func(string)) (v7action.Warnings, error)
Expand Down
4 changes: 2 additions & 2 deletions command/v7/oauth_token_command.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,8 +26,8 @@ func (cmd OauthTokenCommand) Execute(_ []string) error {
return errors.New(cmd.UI.TranslateText("Access token is invalid."))
}

expiration, success := token.Claims().Expiration()
if !success {
expiration, err := token.GetExpirationTime()
if err != nil || expiration == nil {
return errors.New(cmd.UI.TranslateText("Access token is missing expiration claim."))
}

Expand Down
7 changes: 3 additions & 4 deletions command/v7/oauth_token_command_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,7 @@ import (
. "code.cloudfoundry.org/cli/v8/command/v7"
"code.cloudfoundry.org/cli/v8/command/v7/v7fakes"
"code.cloudfoundry.org/cli/v8/util/ui"
"github.com/SermoDigital/jose/crypto"
"github.com/SermoDigital/jose/jws"
jwtv5 "github.com/golang-jwt/jwt/v5"
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
. "github.com/onsi/gomega/gbytes"
Expand Down Expand Up @@ -71,7 +70,7 @@ var _ = Describe("oauth-token command", func() {

When("the existing access token is invalid", func() {
BeforeEach(func() {
token := jws.NewJWT(jws.Claims{}, crypto.SigningMethodHS256)
token := jwtv5.MapClaims{}
fakeConfig.AccessTokenReturns("invalid-existing-access-token")
fakeActor.ParseAccessTokenReturns(token, errors.New("Access token is invalid"))
})
Expand All @@ -89,7 +88,7 @@ var _ = Describe("oauth-token command", func() {

When("the existing access token does not have an expiry time", func() {
BeforeEach(func() {
token := jws.NewJWT(jws.Claims{}, crypto.SigningMethodHS256)
token := jwtv5.MapClaims{}
fakeConfig.AccessTokenReturns("existing-access-token")
fakeActor.ParseAccessTokenReturns(token, nil)
})
Expand Down
Loading
Loading