Move publisher CLI from tools/ to cmd/ (#326)
## Summary Move the publisher CLI from `tools/publisher/` to `cmd/publisher/` as it's a proper application rather than a development utility. This addresses feedback from @rdimitrov in PR #324 that the publisher CLI should be under `cmd/` since it's not really a tool in the same sense as other helpers in the `tools/` folder. ## Changes - Moved `tools/publisher/` directory to `cmd/publisher/` - Updated Makefile build and clean targets - Updated README.md documentation links - Updated VS Code launch configuration - Updated integration test script - Updated FAQ documentation - Fixed Go import paths in publisher code --------- Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
This commit is contained in:
adam jones
GitHub
parent
b8106340bc
commit
53f4d2fd8e
7 changed files with 11 additions and 11 deletions
121
cmd/publisher/auth/common.go
Normal file
121
cmd/publisher/auth/common.go
Normal file
|
|
@ -0,0 +1,121 @@
|
|||
package auth
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"time"
|
||||
)
|
||||
|
||||
// CryptoProvider provides common functionality for DNS and HTTP authentication
|
||||
type CryptoProvider struct {
|
||||
registryURL string
|
||||
domain string
|
||||
hexSeed string
|
||||
authMethod string
|
||||
}
|
||||
|
||||
// GetToken retrieves the registry JWT token using cryptographic authentication
|
||||
func (c *CryptoProvider) GetToken(ctx context.Context) (string, error) {
|
||||
if c.domain == "" {
|
||||
return "", fmt.Errorf("%s domain is required", c.authMethod)
|
||||
}
|
||||
|
||||
if c.hexSeed == "" {
|
||||
return "", fmt.Errorf("%s private key (hex seed) is required", c.authMethod)
|
||||
}
|
||||
|
||||
// Decode hex seed to private key
|
||||
seedBytes, err := hex.DecodeString(c.hexSeed)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("invalid hex seed format: %w", err)
|
||||
}
|
||||
|
||||
if len(seedBytes) != ed25519.SeedSize {
|
||||
return "", fmt.Errorf("invalid seed length: expected %d bytes, got %d", ed25519.SeedSize, len(seedBytes))
|
||||
}
|
||||
|
||||
privateKey := ed25519.NewKeyFromSeed(seedBytes)
|
||||
|
||||
// Generate current timestamp
|
||||
timestamp := time.Now().UTC().Format(time.RFC3339)
|
||||
|
||||
// Sign the timestamp
|
||||
signature := ed25519.Sign(privateKey, []byte(timestamp))
|
||||
signedTimestamp := hex.EncodeToString(signature)
|
||||
|
||||
// Exchange signature for registry token
|
||||
registryToken, err := c.exchangeTokenForRegistry(ctx, c.domain, timestamp, signedTimestamp)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to exchange %s signature: %w", c.authMethod, err)
|
||||
}
|
||||
|
||||
return registryToken, nil
|
||||
}
|
||||
|
||||
// NeedsLogin always returns false for cryptographic auth since no interactive login is needed
|
||||
func (c *CryptoProvider) NeedsLogin() bool {
|
||||
return false
|
||||
}
|
||||
|
||||
// Login is not needed for cryptographic auth since authentication is cryptographic
|
||||
func (c *CryptoProvider) Login(_ context.Context) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// exchangeTokenForRegistry exchanges signature for a registry JWT token
|
||||
func (c *CryptoProvider) exchangeTokenForRegistry(ctx context.Context, domain, timestamp, signedTimestamp string) (string, error) {
|
||||
if c.registryURL == "" {
|
||||
return "", fmt.Errorf("registry URL is required for token exchange")
|
||||
}
|
||||
|
||||
// Prepare the request body
|
||||
payload := map[string]string{
|
||||
"domain": domain,
|
||||
"timestamp": timestamp,
|
||||
"signed_timestamp": signedTimestamp,
|
||||
}
|
||||
|
||||
jsonData, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to marshal request: %w", err)
|
||||
}
|
||||
|
||||
// Make the token exchange request
|
||||
exchangeURL := fmt.Sprintf("%s/v0/auth/%s", c.registryURL, c.authMethod)
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, exchangeURL, bytes.NewBuffer(jsonData))
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to create request: %w", err)
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req.Header.Set("Accept", "application/json")
|
||||
|
||||
client := &http.Client{}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to send request: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to read response: %w", err)
|
||||
}
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return "", fmt.Errorf("token exchange failed with status %d: %s", resp.StatusCode, body)
|
||||
}
|
||||
|
||||
var tokenResp RegistryTokenResponse
|
||||
err = json.Unmarshal(body, &tokenResp)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to unmarshal response: %w", err)
|
||||
}
|
||||
|
||||
return tokenResp.RegistryToken, nil
|
||||
}
|
||||
22
cmd/publisher/auth/dns.go
Normal file
22
cmd/publisher/auth/dns.go
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
package auth
|
||||
|
||||
type DNSProvider struct {
|
||||
*CryptoProvider
|
||||
}
|
||||
|
||||
// NewDNSProvider creates a new DNS-based auth provider
|
||||
func NewDNSProvider(registryURL, domain, hexSeed string) Provider {
|
||||
return &DNSProvider{
|
||||
CryptoProvider: &CryptoProvider{
|
||||
registryURL: registryURL,
|
||||
domain: domain,
|
||||
hexSeed: hexSeed,
|
||||
authMethod: "dns",
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// Name returns the name of this auth provider
|
||||
func (d *DNSProvider) Name() string {
|
||||
return "dns"
|
||||
}
|
||||
426
cmd/publisher/auth/github-at.go
Normal file
426
cmd/publisher/auth/github-at.go
Normal file
|
|
@ -0,0 +1,426 @@
|
|||
package auth
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"os"
|
||||
"time"
|
||||
)
|
||||
|
||||
const (
|
||||
gitHubTokenFilePath = ".mcpregistry_github_token" // #nosec:G101
|
||||
registryTokenFilePath = ".mcpregistry_registry_token" // #nosec:G101
|
||||
// GitHub OAuth URLs
|
||||
GitHubDeviceCodeURL = "https://github.com/login/device/code" // #nosec:G101
|
||||
GitHubAccessTokenURL = "https://github.com/login/oauth/access_token" // #nosec:G101
|
||||
)
|
||||
|
||||
// DeviceCodeResponse represents the response from GitHub's device code endpoint
|
||||
type DeviceCodeResponse struct {
|
||||
DeviceCode string `json:"device_code"`
|
||||
UserCode string `json:"user_code"`
|
||||
VerificationURI string `json:"verification_uri"`
|
||||
ExpiresIn int `json:"expires_in"`
|
||||
Interval int `json:"interval"`
|
||||
}
|
||||
|
||||
// AccessTokenResponse represents the response from GitHub's access token endpoint
|
||||
type AccessTokenResponse struct {
|
||||
AccessToken string `json:"access_token"`
|
||||
TokenType string `json:"token_type"`
|
||||
Scope string `json:"scope"`
|
||||
Error string `json:"error,omitempty"`
|
||||
}
|
||||
|
||||
// RegistryTokenResponse represents the response from registry's token exchange endpoint
|
||||
type RegistryTokenResponse struct {
|
||||
RegistryToken string `json:"registry_token"`
|
||||
ExpiresAt int64 `json:"expires_at"`
|
||||
}
|
||||
|
||||
// StoredRegistryToken represents the registry token with expiration stored locally
|
||||
type StoredRegistryToken struct {
|
||||
Token string `json:"token"`
|
||||
ExpiresAt int64 `json:"expires_at"`
|
||||
}
|
||||
|
||||
// GitHubATProvider implements the Provider interface using GitHub's device flow
|
||||
type GitHubATProvider struct {
|
||||
clientID string
|
||||
forceLogin bool
|
||||
registryURL string
|
||||
}
|
||||
|
||||
// ServerHealthResponse represents the response from the health endpoint
|
||||
type ServerHealthResponse struct {
|
||||
Status string `json:"status"`
|
||||
GitHubClientID string `json:"github_client_id"`
|
||||
}
|
||||
|
||||
// NewGitHubATProvider creates a new GitHub OAuth provider
|
||||
func NewGitHubATProvider(forceLogin bool, registryURL string) Provider {
|
||||
return &GitHubATProvider{
|
||||
forceLogin: forceLogin,
|
||||
registryURL: registryURL,
|
||||
}
|
||||
}
|
||||
|
||||
// GetToken retrieves the registry JWT token (exchanges GitHub token if needed)
|
||||
func (g *GitHubATProvider) GetToken(ctx context.Context) (string, error) {
|
||||
// Check if we have a valid registry token
|
||||
registryToken, err := readRegistryToken()
|
||||
if err == nil && registryToken != "" {
|
||||
return registryToken, nil
|
||||
}
|
||||
|
||||
// If no valid registry token, exchange GitHub token for registry token
|
||||
githubToken, err := readToken()
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to read GitHub token: %w", err)
|
||||
}
|
||||
|
||||
// Exchange GitHub token for registry token
|
||||
registryToken, expiresAt, err := g.exchangeTokenForRegistry(ctx, githubToken)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to exchange token: %w", err)
|
||||
}
|
||||
|
||||
// Store the registry token
|
||||
err = saveRegistryToken(registryToken, expiresAt)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to save registry token: %w", err)
|
||||
}
|
||||
|
||||
return registryToken, nil
|
||||
}
|
||||
|
||||
// NeedsLogin checks if a new login is required
|
||||
func (g *GitHubATProvider) NeedsLogin() bool {
|
||||
if g.forceLogin {
|
||||
return true
|
||||
}
|
||||
|
||||
// Check if GitHub token exists
|
||||
_, statErr := os.Stat(gitHubTokenFilePath)
|
||||
if os.IsNotExist(statErr) {
|
||||
return true
|
||||
}
|
||||
|
||||
// Check if valid registry token exists
|
||||
_, err := readRegistryToken()
|
||||
if err != nil {
|
||||
// No valid registry token, but we have GitHub token
|
||||
// We don't need to login, just exchange tokens
|
||||
return false
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
// Login performs the GitHub device flow authentication
|
||||
func (g *GitHubATProvider) Login(ctx context.Context) error {
|
||||
// If clientID is not set, try to retrieve it from the server's health endpoint
|
||||
if g.clientID == "" {
|
||||
clientID, err := getClientID(ctx, g.registryURL)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error getting GitHub Client ID: %w", err)
|
||||
}
|
||||
g.clientID = clientID
|
||||
}
|
||||
|
||||
// Device flow login logic using GitHub's device flow
|
||||
// First, request a device code
|
||||
deviceCode, userCode, verificationURI, err := g.requestDeviceCode(ctx)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error requesting device code: %w", err)
|
||||
}
|
||||
|
||||
// Display instructions to the user
|
||||
_, _ = fmt.Fprintln(os.Stdout, "\nTo authenticate, please:")
|
||||
_, _ = fmt.Fprintln(os.Stdout, "1. Go to:", verificationURI)
|
||||
_, _ = fmt.Fprintln(os.Stdout, "2. Enter code:", userCode)
|
||||
_, _ = fmt.Fprintln(os.Stdout, "3. Authorize this application")
|
||||
|
||||
// Poll for the token
|
||||
_, _ = fmt.Fprintln(os.Stdout, "Waiting for authorization...")
|
||||
token, err := g.pollForToken(ctx, deviceCode)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error polling for token: %w", err)
|
||||
}
|
||||
|
||||
// Store the token locally
|
||||
err = saveToken(token)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error saving token: %w", err)
|
||||
}
|
||||
|
||||
_, _ = fmt.Fprintln(os.Stdout, "Successfully authenticated!")
|
||||
return nil
|
||||
}
|
||||
|
||||
// Name returns the name of this auth provider
|
||||
func (g *GitHubATProvider) Name() string {
|
||||
return "github"
|
||||
}
|
||||
|
||||
// requestDeviceCode initiates the device authorization flow
|
||||
func (g *GitHubATProvider) requestDeviceCode(ctx context.Context) (string, string, string, error) {
|
||||
if g.clientID == "" {
|
||||
return "", "", "", fmt.Errorf("GitHub Client ID is required for device flow login")
|
||||
}
|
||||
|
||||
payload := map[string]string{
|
||||
"client_id": g.clientID,
|
||||
"scope": "read:org read:user",
|
||||
}
|
||||
|
||||
jsonData, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
return "", "", "", err
|
||||
}
|
||||
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, GitHubDeviceCodeURL, bytes.NewBuffer(jsonData))
|
||||
if err != nil {
|
||||
return "", "", "", err
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req.Header.Set("Accept", "application/json")
|
||||
|
||||
client := &http.Client{}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return "", "", "", err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
return "", "", "", err
|
||||
}
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return "", "", "", fmt.Errorf("request device code failed: %s", body)
|
||||
}
|
||||
|
||||
var deviceCodeResp DeviceCodeResponse
|
||||
err = json.Unmarshal(body, &deviceCodeResp)
|
||||
if err != nil {
|
||||
return "", "", "", err
|
||||
}
|
||||
|
||||
return deviceCodeResp.DeviceCode, deviceCodeResp.UserCode, deviceCodeResp.VerificationURI, nil
|
||||
}
|
||||
|
||||
// pollForToken polls for access token after user completes authorization
|
||||
func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) (string, error) {
|
||||
if g.clientID == "" {
|
||||
return "", fmt.Errorf("GitHub Client ID is required for device flow login")
|
||||
}
|
||||
|
||||
payload := map[string]string{
|
||||
"client_id": g.clientID,
|
||||
"device_code": deviceCode,
|
||||
"grant_type": "urn:ietf:params:oauth:grant-type:device_code",
|
||||
}
|
||||
|
||||
jsonData, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
// Default polling interval and expiration time
|
||||
interval := 5 // seconds
|
||||
expiresIn := 900 // 15 minutes
|
||||
deadline := time.Now().Add(time.Duration(expiresIn) * time.Second)
|
||||
|
||||
for time.Now().Before(deadline) {
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, GitHubAccessTokenURL, bytes.NewBuffer(jsonData))
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req.Header.Set("Accept", "application/json")
|
||||
|
||||
client := &http.Client{}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
resp.Body.Close()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
var tokenResp AccessTokenResponse
|
||||
err = json.Unmarshal(body, &tokenResp)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
if tokenResp.Error == "authorization_pending" {
|
||||
// User hasn't authorized yet, wait and retry
|
||||
time.Sleep(time.Duration(interval) * time.Second)
|
||||
continue
|
||||
}
|
||||
|
||||
if tokenResp.Error != "" {
|
||||
return "", fmt.Errorf("token request failed: %s", tokenResp.Error)
|
||||
}
|
||||
|
||||
if tokenResp.AccessToken != "" {
|
||||
return tokenResp.AccessToken, nil
|
||||
}
|
||||
|
||||
// If we reach here, something unexpected happened
|
||||
return "", fmt.Errorf("failed to obtain access token")
|
||||
}
|
||||
|
||||
return "", fmt.Errorf("device code authorization timed out")
|
||||
}
|
||||
|
||||
// saveToken saves the GitHub access token to a local file
|
||||
func saveToken(token string) error {
|
||||
return os.WriteFile(gitHubTokenFilePath, []byte(token), 0600)
|
||||
}
|
||||
|
||||
// readToken reads the GitHub access token from a local file
|
||||
func readToken() (string, error) {
|
||||
tokenData, err := os.ReadFile(gitHubTokenFilePath)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return string(tokenData), nil
|
||||
}
|
||||
|
||||
func getClientID(ctx context.Context, registryURL string) (string, error) {
|
||||
// This function should retrieve the GitHub Client ID from the registry URL
|
||||
// For now, we will return a placeholder value
|
||||
// In a real implementation, this would likely involve querying the registry or configuration
|
||||
if registryURL == "" {
|
||||
return "", fmt.Errorf("registry URL is required to get GitHub Client ID")
|
||||
}
|
||||
// get the clientID from the server's health endpoint
|
||||
healthURL := registryURL + "/v0/health"
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, healthURL, nil)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
client := &http.Client{}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
body, _ := io.ReadAll(resp.Body)
|
||||
return "", fmt.Errorf("health endpoint returned status %d: %s", resp.StatusCode, body)
|
||||
}
|
||||
|
||||
var healthResponse ServerHealthResponse
|
||||
err = json.NewDecoder(resp.Body).Decode(&healthResponse)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if healthResponse.GitHubClientID == "" {
|
||||
return "", fmt.Errorf("GitHub Client ID is not set in the server's health response")
|
||||
}
|
||||
|
||||
githubClientID := healthResponse.GitHubClientID
|
||||
|
||||
return githubClientID, nil
|
||||
}
|
||||
|
||||
// exchangeTokenForRegistry exchanges a GitHub token for a registry JWT token
|
||||
func (g *GitHubATProvider) exchangeTokenForRegistry(ctx context.Context, githubToken string) (string, int64, error) {
|
||||
if g.registryURL == "" {
|
||||
return "", 0, fmt.Errorf("registry URL is required for token exchange")
|
||||
}
|
||||
|
||||
// Prepare the request body
|
||||
payload := map[string]string{
|
||||
"github_token": githubToken,
|
||||
}
|
||||
|
||||
jsonData, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
return "", 0, fmt.Errorf("failed to marshal request: %w", err)
|
||||
}
|
||||
|
||||
// Make the token exchange request
|
||||
exchangeURL := g.registryURL + "/v0/auth/github-at"
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, exchangeURL, bytes.NewBuffer(jsonData))
|
||||
if err != nil {
|
||||
return "", 0, fmt.Errorf("failed to create request: %w", err)
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req.Header.Set("Accept", "application/json")
|
||||
|
||||
client := &http.Client{}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return "", 0, fmt.Errorf("failed to send request: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
return "", 0, fmt.Errorf("failed to read response: %w", err)
|
||||
}
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return "", 0, fmt.Errorf("token exchange failed with status %d: %s", resp.StatusCode, body)
|
||||
}
|
||||
|
||||
var tokenResp RegistryTokenResponse
|
||||
err = json.Unmarshal(body, &tokenResp)
|
||||
if err != nil {
|
||||
return "", 0, fmt.Errorf("failed to unmarshal response: %w", err)
|
||||
}
|
||||
|
||||
return tokenResp.RegistryToken, tokenResp.ExpiresAt, nil
|
||||
}
|
||||
|
||||
// saveRegistryToken saves the registry JWT token to a local file with expiration
|
||||
func saveRegistryToken(token string, expiresAt int64) error {
|
||||
storedToken := StoredRegistryToken{
|
||||
Token: token,
|
||||
ExpiresAt: expiresAt,
|
||||
}
|
||||
|
||||
data, err := json.Marshal(storedToken)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to marshal token: %w", err)
|
||||
}
|
||||
|
||||
return os.WriteFile(registryTokenFilePath, data, 0600)
|
||||
}
|
||||
|
||||
// readRegistryToken reads the registry JWT token from a local file
|
||||
func readRegistryToken() (string, error) {
|
||||
data, err := os.ReadFile(registryTokenFilePath)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
var storedToken StoredRegistryToken
|
||||
err = json.Unmarshal(data, &storedToken)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to unmarshal token: %w", err)
|
||||
}
|
||||
|
||||
// Check if token has expired
|
||||
if time.Now().Unix() >= storedToken.ExpiresAt {
|
||||
// Token has expired, remove the file
|
||||
os.Remove(registryTokenFilePath)
|
||||
return "", fmt.Errorf("registry token has expired")
|
||||
}
|
||||
|
||||
return storedToken.Token, nil
|
||||
}
|
||||
166
cmd/publisher/auth/github-oidc.go
Normal file
166
cmd/publisher/auth/github-oidc.go
Normal file
|
|
@ -0,0 +1,166 @@
|
|||
package auth
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"os"
|
||||
)
|
||||
|
||||
type GitHubOIDCProvider struct {
|
||||
registryURL string
|
||||
}
|
||||
|
||||
// NewGitHubOIDCProvider creates a new GitHub OIDC provider
|
||||
func NewGitHubOIDCProvider(registryURL string) Provider {
|
||||
return &GitHubOIDCProvider{
|
||||
registryURL: registryURL,
|
||||
}
|
||||
}
|
||||
|
||||
// GetToken retrieves the registry JWT token using GitHub Actions OIDC token
|
||||
func (o *GitHubOIDCProvider) GetToken(ctx context.Context) (string, error) {
|
||||
// Get OIDC token from GitHub Actions endpoint
|
||||
oidcToken, err := o.getOIDCTokenFromGitHub(ctx)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to get OIDC token from GitHub: %w", err)
|
||||
}
|
||||
|
||||
// Exchange OIDC token for registry token
|
||||
registryToken, err := o.exchangeOIDCTokenForRegistry(ctx, oidcToken)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to exchange OIDC token: %w", err)
|
||||
}
|
||||
|
||||
return registryToken, nil
|
||||
}
|
||||
|
||||
// NeedsLogin always returns false for OIDC since the token is provided by GitHub Actions
|
||||
func (o *GitHubOIDCProvider) NeedsLogin() bool {
|
||||
// OIDC tokens are provided by GitHub Actions runtime, no interactive login needed
|
||||
return false
|
||||
}
|
||||
|
||||
// Login is not needed for OIDC since tokens are provided by GitHub Actions
|
||||
func (o *GitHubOIDCProvider) Login(_ context.Context) error {
|
||||
// No interactive login needed for OIDC
|
||||
return nil
|
||||
}
|
||||
|
||||
// Name returns the name of this auth provider
|
||||
func (o *GitHubOIDCProvider) Name() string {
|
||||
return "github-oidc"
|
||||
}
|
||||
|
||||
// exchangeOIDCTokenForRegistry exchanges a GitHub OIDC token for a registry JWT token
|
||||
func (o *GitHubOIDCProvider) exchangeOIDCTokenForRegistry(ctx context.Context, oidcToken string) (string, error) {
|
||||
if o.registryURL == "" {
|
||||
return "", fmt.Errorf("registry URL is required for token exchange")
|
||||
}
|
||||
|
||||
// Prepare the request body
|
||||
payload := map[string]string{
|
||||
"oidc_token": oidcToken,
|
||||
}
|
||||
|
||||
jsonData, err := json.Marshal(payload)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to marshal request: %w", err)
|
||||
}
|
||||
|
||||
// Make the token exchange request
|
||||
exchangeURL := o.registryURL + "/v0/auth/github-oidc"
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, exchangeURL, bytes.NewBuffer(jsonData))
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to create request: %w", err)
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req.Header.Set("Accept", "application/json")
|
||||
|
||||
client := &http.Client{}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to send request: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to read response: %w", err)
|
||||
}
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return "", fmt.Errorf("token exchange failed with status %d: %s", resp.StatusCode, body)
|
||||
}
|
||||
|
||||
var tokenResp RegistryTokenResponse
|
||||
err = json.Unmarshal(body, &tokenResp)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to unmarshal response: %w", err)
|
||||
}
|
||||
|
||||
return tokenResp.RegistryToken, nil
|
||||
}
|
||||
|
||||
// getOIDCTokenFromGitHub fetches the OIDC token from GitHub Actions endpoint
|
||||
func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string, error) {
|
||||
// Check for required environment variables
|
||||
requestToken := os.Getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN")
|
||||
if requestToken == "" {
|
||||
return "", fmt.Errorf("ACTIONS_ID_TOKEN_REQUEST_TOKEN environment variable not found - are you running in GitHub Actions with id-token: write permissions?")
|
||||
}
|
||||
|
||||
requestURL := os.Getenv("ACTIONS_ID_TOKEN_REQUEST_URL")
|
||||
if requestURL == "" {
|
||||
return "", fmt.Errorf("ACTIONS_ID_TOKEN_REQUEST_URL environment variable not found - are you running in GitHub Actions with id-token: write permissions?")
|
||||
}
|
||||
|
||||
// Build the full URL with audience parameter
|
||||
fullURL := requestURL + "&audience=mcp-registry"
|
||||
|
||||
// Create the request
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to create request: %w", err)
|
||||
}
|
||||
|
||||
// Set the authorization header
|
||||
req.Header.Set("Authorization", "Bearer "+requestToken)
|
||||
req.Header.Set("Accept", "application/json")
|
||||
|
||||
// Make the request
|
||||
client := &http.Client{}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to send request: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
// Read the response
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to read response: %w", err)
|
||||
}
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return "", fmt.Errorf("GitHub OIDC token request failed with status %d: %s", resp.StatusCode, body)
|
||||
}
|
||||
|
||||
// Parse the response to extract the token value
|
||||
var tokenResp struct {
|
||||
Value string `json:"value"`
|
||||
}
|
||||
err = json.Unmarshal(body, &tokenResp)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("failed to unmarshal OIDC token response: %w", err)
|
||||
}
|
||||
|
||||
if tokenResp.Value == "" {
|
||||
return "", fmt.Errorf("OIDC token value is empty in response")
|
||||
}
|
||||
|
||||
return tokenResp.Value, nil
|
||||
}
|
||||
22
cmd/publisher/auth/http.go
Normal file
22
cmd/publisher/auth/http.go
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
package auth
|
||||
|
||||
type HTTPProvider struct {
|
||||
*CryptoProvider
|
||||
}
|
||||
|
||||
// NewHTTPProvider creates a new HTTP-based auth provider
|
||||
func NewHTTPProvider(registryURL, domain, hexSeed string) Provider {
|
||||
return &HTTPProvider{
|
||||
CryptoProvider: &CryptoProvider{
|
||||
registryURL: registryURL,
|
||||
domain: domain,
|
||||
hexSeed: hexSeed,
|
||||
authMethod: "http",
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// Name returns the name of this auth provider
|
||||
func (h *HTTPProvider) Name() string {
|
||||
return "http"
|
||||
}
|
||||
21
cmd/publisher/auth/interface.go
Normal file
21
cmd/publisher/auth/interface.go
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
package auth
|
||||
|
||||
import "context"
|
||||
|
||||
// Provider defines the interface for authentication mechanisms
|
||||
type Provider interface {
|
||||
// GetToken retrieves or generates an authentication token
|
||||
// It returns the token string and any error encountered
|
||||
GetToken(ctx context.Context) (string, error)
|
||||
|
||||
// NeedsLogin checks if a new login is required
|
||||
// This can check for existing tokens, expiry, etc.
|
||||
NeedsLogin() bool
|
||||
|
||||
// Login performs the authentication flow
|
||||
// This might involve user interaction, device flows, etc.
|
||||
Login(ctx context.Context) error
|
||||
|
||||
// Name returns the name of the authentication provider
|
||||
Name() string
|
||||
}
|
||||
76
cmd/publisher/auth/none.go
Normal file
76
cmd/publisher/auth/none.go
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
package auth
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"strings"
|
||||
)
|
||||
|
||||
type NoneProvider struct {
|
||||
registryURL string
|
||||
token string
|
||||
}
|
||||
|
||||
type TokenResponse struct {
|
||||
RegistryToken string `json:"registry_token"`
|
||||
ExpiresAt int64 `json:"expires_at"`
|
||||
}
|
||||
|
||||
func NewNoneProvider(registryURL string) Provider {
|
||||
return &NoneProvider{
|
||||
registryURL: registryURL,
|
||||
}
|
||||
}
|
||||
|
||||
func (p *NoneProvider) GetToken(ctx context.Context) (string, error) {
|
||||
if p.token != "" {
|
||||
return p.token, nil
|
||||
}
|
||||
|
||||
// Get anonymous token from registry
|
||||
if !strings.HasSuffix(p.registryURL, "/") {
|
||||
p.registryURL += "/"
|
||||
}
|
||||
tokenURL := p.registryURL + "v0/auth/none"
|
||||
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, tokenURL, nil)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("error creating request: %w", err)
|
||||
}
|
||||
|
||||
client := &http.Client{}
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("error getting anonymous token: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
body, _ := io.ReadAll(resp.Body)
|
||||
return "", fmt.Errorf("failed to get anonymous token (status %d): %s", resp.StatusCode, body)
|
||||
}
|
||||
|
||||
var tokenResp TokenResponse
|
||||
if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
|
||||
return "", fmt.Errorf("error decoding token response: %w", err)
|
||||
}
|
||||
|
||||
p.token = tokenResp.RegistryToken
|
||||
return p.token, nil
|
||||
}
|
||||
|
||||
func (p *NoneProvider) NeedsLogin() bool {
|
||||
return false
|
||||
}
|
||||
|
||||
func (p *NoneProvider) Login(_ context.Context) error {
|
||||
// No login needed for anonymous auth
|
||||
return nil
|
||||
}
|
||||
|
||||
func (p *NoneProvider) Name() string {
|
||||
return "none"
|
||||
}
|
||||
Loading…
Reference in a new issue