feat: implement the resolve endpoint #18
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| // Package github verifies the OIDC tokens GitHub Actions issues to workflow runs. | ||
| package github |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| package github | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "strconv" | ||
|
|
||
| "github.com/coreos/go-oidc/v3/oidc" | ||
| "github.com/sonolink/arbiterer/internal/config" | ||
| ) | ||
|
|
||
| const ( | ||
| issuerURL = "https://token.actions.githubusercontent.com" | ||
| jwksURL = issuerURL + "/.well-known/jwks" | ||
| ) | ||
|
|
||
| // Verifier checks OIDC tokens GitHub Actions issues to workflow runs. | ||
| type Verifier struct { | ||
| verifier *oidc.IDTokenVerifier | ||
| } | ||
|
|
||
| // NewVerifier builds a Verifier that trusts tokens issued by GitHub Actions for the | ||
| // configured audience. | ||
| func NewVerifier(ctx context.Context, cfg config.GitHub) *Verifier { | ||
| keySet := oidc.NewRemoteKeySet(ctx, jwksURL) | ||
| verifier := oidc.NewVerifier( | ||
| issuerURL, | ||
| keySet, | ||
| &oidc.Config{ | ||
| ClientID: cfg.OIDCAudience, | ||
| SupportedSigningAlgs: []string{oidc.RS256}, | ||
| }, | ||
| ) | ||
| return &Verifier{verifier: verifier} | ||
| } | ||
|
|
||
| // Claims holds the parts of a verified token the application acts on. | ||
| type Claims struct { | ||
| RepositoryID int64 | ||
| } | ||
|
|
||
| // tokenClaims mirrors the claims GitHub Actions puts in an OIDC token. Numeric ids | ||
| // arrive as strings. | ||
| type tokenClaims struct { | ||
| RepositoryID string `json:"repository_id"` | ||
| } | ||
|
|
||
| func (tc tokenClaims) claims() (*Claims, error) { | ||
| repositoryID, err := strconv.ParseInt(tc.RepositoryID, 10, 64) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("github: parsing repository id %q: %w", tc.RepositoryID, err) | ||
| } | ||
|
|
||
| return &Claims{RepositoryID: repositoryID}, nil | ||
| } | ||
|
|
||
| // Verify checks a GitHub Actions OIDC token and returns the claims it carries. | ||
| func (v *Verifier) Verify(ctx context.Context, rawIDToken string) (*Claims, error) { | ||
| idToken, err := v.verifier.Verify(ctx, rawIDToken) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("github: verifying token: %w", err) | ||
| } | ||
|
|
||
| var tc tokenClaims | ||
| if err := idToken.Claims(&tc); err != nil { | ||
| return nil, fmt.Errorf("github: decoding claims: %w", err) | ||
| } | ||
|
|
||
| return tc.claims() | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| // Package secrets encrypts values at rest using AES-GCM. | ||
| package secrets |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| package secrets | ||
|
|
||
| import ( | ||
| "crypto/aes" | ||
| "crypto/cipher" | ||
| "crypto/rand" | ||
| "errors" | ||
| "fmt" | ||
| ) | ||
|
|
||
| // Sealer encrypts and decrypts secrets with AES-GCM. | ||
| type Sealer struct { | ||
| aead cipher.AEAD | ||
| } | ||
|
|
||
| // NewSealer builds a Sealer from the given key. | ||
| func NewSealer(key []byte) (*Sealer, error) { | ||
| block, err := aes.NewCipher(key) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("secrets: creating cipher: %w", err) | ||
| } | ||
|
|
||
| aead, err := cipher.NewGCM(block) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("secrets: creating gcm: %w", err) | ||
| } | ||
|
|
||
| return &Sealer{aead: aead}, nil | ||
| } | ||
|
|
||
| // Seal encrypts plaintext, prepending a fresh nonce so the result can | ||
| // be stored as it stands. | ||
| func (s *Sealer) Seal(plaintext, additionalData []byte) ([]byte, error) { | ||
| nonce := make([]byte, s.aead.NonceSize()) | ||
| if _, err := rand.Read(nonce); err != nil { | ||
| return nil, fmt.Errorf("secrets: generating nonce: %w", err) | ||
| } | ||
|
|
||
| return s.aead.Seal(nonce, nonce, plaintext, additionalData), nil | ||
| } | ||
|
|
||
| // Open decrypts a value produced by Seal. | ||
| func (s *Sealer) Open(sealed, additionalData []byte) ([]byte, error) { | ||
| nonceSize := s.aead.NonceSize() | ||
| if len(sealed) < nonceSize+s.aead.Overhead() { | ||
| return nil, errors.New("secrets: sealed value too short") | ||
| } | ||
|
|
||
| nonce, ciphertext := sealed[:nonceSize], sealed[nonceSize:] | ||
|
|
||
| plaintext, err := s.aead.Open(nil, nonce, ciphertext, additionalData) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("secrets: opening: %w", err) | ||
| } | ||
|
|
||
| return plaintext, nil | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| package server | ||
|
|
||
| import ( | ||
| "net/http" | ||
| ) | ||
|
|
||
| // problemDetails is an RFC 9457 error response. The type member is omitted, | ||
| // which the RFC defines as equivalent to "about:blank". | ||
| type problemDetails struct { | ||
| Title string `json:"title"` | ||
| Status int `json:"status"` | ||
| Detail string `json:"detail,omitempty"` | ||
| Instance string `json:"instance,omitempty"` | ||
| } | ||
|
|
||
| // writeProblem sends an RFC 9457 problem response describing a failed request. | ||
| func (s *Server) writeProblem(w http.ResponseWriter, r *http.Request, status int, detail string) { | ||
| s.write(w, status, contentTypeProblem, problemDetails{ | ||
| Title: http.StatusText(status), | ||
| Status: status, | ||
| Detail: detail, | ||
| Instance: r.URL.Path, | ||
| }) | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.