Skip to content

Commit ec6ad8c

Browse files
bdpipravabdpiprava
authored
Merge pull request #45 from vrushaliwaykole/authorization-v2
Use authorisation extension v2.
2 parents da1df1f + 0965104 commit ec6ad8c

40 files changed

+972
-381
lines changed

‎build.gradle‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ apply from: 'plugin-helpers.gradle'
2424
sourceCompatibility = 1.8
2525
targetCompatibility = 1.8
2626

27-
project.ext.pluginVersion = '2.2.0'
27+
project.ext.pluginVersion = '3.0.0'
2828
project.ext.fullVersion = project.git.distVersion() ? "${project.pluginVersion}-${project.git.distVersion()}" : project.pluginVersion
2929

3030
version = project.fullVersion
@@ -34,7 +34,7 @@ project.ext.pluginDesc = [
3434
id : 'cd.go.authorization.github',
3535
repo : rootProject.name,
3636
version : project.fullVersion,
37-
goCdVersion: '17.5.0',
37+
goCdVersion: '19.2.0',
3838
name : 'GitHub OAuth authorization plugin',
3939
description: 'GitHub OAuth authorization plugin for GoCD',
4040
vendorName : 'GoCD Contributors',
@@ -59,6 +59,7 @@ dependencies {
5959
testCompile group: 'org.skyscreamer', name: 'jsonassert', version: '1.5.0'
6060
testCompile group: 'org.jsoup', name: 'jsoup', version: '1.11.3'
6161
testCompile group: 'com.squareup.okhttp3', name: 'mockwebserver', version: '3.12.0'
62+
testCompile group: 'org.jsoup', name: 'jsoup', version: '1.11.3'
6263
}
6364

6465
sourceSets {

‎plugin-helpers.gradle‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ static String gitRevision() {
2222
}
2323

2424
static String distVersion() {
25-
def process = "git rev-list --count HEAD".execute()
25+
def process = "git rev-list HEAD".execute()
2626
process.waitFor()
27-
return process.text.stripIndent().trim()
27+
return process.text.stripIndent().trim().split("\n").size()
2828
}
2929

3030
static def getLastTag(boolean isExperimental) {

‎src/main/java/cd/go/authorization/github/Constants.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ public interface Constants {
2525
String EXTENSION_TYPE = "authorization";
2626

2727
// The extension point API version that this plugin understands
28-
String API_VERSION = "1.0";
28+
String API_VERSION = "2.0";
2929

3030
// the identifier of this plugin
3131
GoPluginIdentifier PLUGIN_IDENTIFIER = new GoPluginIdentifier(EXTENSION_TYPE, Collections.singletonList(API_VERSION));

‎src/main/java/cd/go/authorization/github/GitHubAuthenticator.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ public LoggedInUserInfo authenticate(TokenInfo tokenInfo, AuthConfig authConfig)
4545
final List<String> allowedOrganizations = authConfig.gitHubConfiguration().organizationsAllowed();
4646
final LoggedInUserInfo loggedInUserInfo = new LoggedInUserInfo(gitHub);
4747

48-
if (allowedOrganizations.isEmpty() || membershipChecker.isAMemberOfAtLeastOneOrganization(loggedInUserInfo, authConfig, allowedOrganizations)) {
48+
if (allowedOrganizations.isEmpty() || membershipChecker.isAMemberOfAtLeastOneOrganization(loggedInUserInfo.getGitHubUser(), authConfig, allowedOrganizations)) {
4949
LOG.info(format("[Authenticate] User `{0}` authenticated successfully.", loggedInUserInfo.getUser().username()));
5050
return loggedInUserInfo;
5151
}

‎src/main/java/cd/go/authorization/github/GitHubAuthorizer.java‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,8 @@
1717
package cd.go.authorization.github;
1818

1919
import cd.go.authorization.github.models.AuthConfig;
20-
import cd.go.authorization.github.models.LoggedInUserInfo;
2120
import cd.go.authorization.github.models.Role;
22-
import cd.go.authorization.github.models.User;
21+
import org.kohsuke.github.GHUser;
2322

2423
import java.io.IOException;
2524
import java.util.ArrayList;
@@ -39,37 +38,36 @@ public GitHubAuthorizer(MembershipChecker membershipChecker) {
3938
this.membershipChecker = membershipChecker;
4039
}
4140

42-
public List<String> authorize(LoggedInUserInfo loggedInUserInfo, AuthConfig authConfig, List<Role> roles) throws IOException {
43-
final User user = loggedInUserInfo.getUser();
41+
public List<String> authorize(GHUser user, AuthConfig authConfig, List<Role> roles) throws IOException {
4442
final List<String> assignedRoles = new ArrayList<>();
4543

4644
if (roles.isEmpty()) {
4745
return assignedRoles;
4846
}
4947

50-
LOG.debug(format("[Authorize] Authorizing user {0}", user.username()));
48+
LOG.debug(format("[Authorize] Authorizing user {0}", user.getLogin()));
5149

5250
for (Role role : roles) {
5351
final List<String> allowedUsers = role.roleConfiguration().users();
54-
if (!allowedUsers.isEmpty() && allowedUsers.contains(user.username().toLowerCase())) {
55-
LOG.info(format("[Authorize] Assigning role `{0}` to user `{1}`. As user belongs to allowed users list.", role.name(), user.username()));
52+
if (!allowedUsers.isEmpty() && allowedUsers.contains(user.getLogin().toLowerCase())) {
53+
LOG.info(format("[Authorize] Assigning role `{0}` to user `{1}`. As user belongs to allowed users list.", role.name(), user.getLogin()));
5654
assignedRoles.add(role.name());
5755
continue;
5856
}
5957

60-
if (membershipChecker.isAMemberOfAtLeastOneOrganization(loggedInUserInfo, authConfig, role.roleConfiguration().organizations())) {
61-
LOG.debug(format("[Authorize] Assigning role `{0}` to user `{1}`. As user is a member of at least one organization.", role.name(), user.username()));
58+
if (membershipChecker.isAMemberOfAtLeastOneOrganization(user, authConfig, role.roleConfiguration().organizations())) {
59+
LOG.debug(format("[Authorize] Assigning role `{0}` to user `{1}`. As user is a member of at least one organization.", role.name(), user.getLogin()));
6260
assignedRoles.add(role.name());
6361
continue;
6462
}
6563

66-
if (membershipChecker.isAMemberOfAtLeastOneTeamOfOrganization(loggedInUserInfo, authConfig, role.roleConfiguration().teams())) {
67-
LOG.debug(format("[Authorize] Assigning role `{0}` to user `{1}`. As user is a member of at least one team of the organization.", role.name(), user.username()));
64+
if (membershipChecker.isAMemberOfAtLeastOneTeamOfOrganization(user, authConfig, role.roleConfiguration().teams())) {
65+
LOG.debug(format("[Authorize] Assigning role `{0}` to user `{1}`. As user is a member of at least one team of the organization.", role.name(), user.getLogin()));
6866
assignedRoles.add(role.name());
6967
}
7068
}
7169

72-
LOG.debug(format("[Authorize] User `{0}` is authorized with `{1}` role(s).", user.username(), assignedRoles));
70+
LOG.debug(format("[Authorize] User `{0}` is authorized with `{1}` role(s).", user.getLogin(), assignedRoles));
7371

7472
return assignedRoles;
7573
}

‎src/main/java/cd/go/authorization/github/GitHubPlugin.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ public void initializeGoApplicationAccessor(GoApplicationAccessor accessor) {
4242
}
4343

4444
@Override
45-
public GoPluginApiResponse handle(GoPluginApiRequest request) throws UnhandledRequestTypeException {
45+
public GoPluginApiResponse handle(GoPluginApiRequest request) {
4646
try {
4747
switch (RequestFromServer.fromString(request.requestName())) {
4848
case REQUEST_GET_PLUGIN_ICON:
@@ -67,10 +67,14 @@ public GoPluginApiResponse handle(GoPluginApiRequest request) throws UnhandledRe
6767
return GetAuthorizationServerUrlRequest.from(request).execute();
6868
case REQUEST_ACCESS_TOKEN:
6969
return FetchAccessTokenRequest.from(request).execute();
70+
case REQUEST_IS_VALID_USER:
71+
return ValidateUserRequest.from(request).execute();
7072
case REQUEST_AUTHENTICATE_USER:
7173
return UserAuthenticationRequest.from(request).execute();
7274
case REQUEST_SEARCH_USERS:
73-
return new SearchUsersRequestExecutor(request).execute();
75+
return SearchUsersRequest.from(request).execute();
76+
case REQUEST_GET_USER_ROLES:
77+
return GetRolesRequest.from(request).execute();
7478
default:
7579
throw new UnhandledRequestTypeException(request.requestName());
7680
}

‎src/main/java/cd/go/authorization/github/MembershipChecker.java‎

Lines changed: 23 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -17,77 +17,64 @@
1717
package cd.go.authorization.github;
1818

1919
import cd.go.authorization.github.models.AuthConfig;
20-
import cd.go.authorization.github.models.LoggedInUserInfo;
2120
import org.kohsuke.github.GHOrganization;
2221
import org.kohsuke.github.GHTeam;
22+
import org.kohsuke.github.GHUser;
2323
import org.kohsuke.github.GitHub;
2424

2525
import java.io.IOException;
2626
import java.util.List;
2727
import java.util.Map;
28-
import java.util.Set;
2928

3029
import static cd.go.authorization.github.GitHubPlugin.LOG;
31-
import static cd.go.authorization.github.utils.Util.toLowerCase;
3230
import static java.text.MessageFormat.format;
3331

3432
public class MembershipChecker {
33+
private GitHubClientBuilder clientBuilder;
3534

36-
public boolean isAMemberOfAtLeastOneOrganization(LoggedInUserInfo loggedInUserInfo, AuthConfig authConfig, List<String> organizationsAllowed) throws IOException {
35+
public MembershipChecker() {
36+
this(new GitHubClientBuilder());
37+
}
38+
39+
MembershipChecker(GitHubClientBuilder clientBuilder) {
40+
this.clientBuilder = clientBuilder;
41+
}
42+
43+
44+
public boolean isAMemberOfAtLeastOneOrganization(GHUser ghUser, AuthConfig authConfig, List<String> organizationsAllowed) throws IOException {
3745
if (organizationsAllowed.isEmpty()) {
3846
LOG.debug("[MembershipChecker] No organizations provided.");
3947
return false;
4048
}
4149

42-
if (authConfig.gitHubConfiguration().authorizeUsingPersonalAccessToken()) {
43-
return checkMembershipUsingPersonalAccessToken(loggedInUserInfo, authConfig, organizationsAllowed);
44-
}
45-
46-
return checkMembershipUsingUsersAccessToken(loggedInUserInfo, organizationsAllowed);
50+
return checkMembershipUsingPersonalAccessToken(ghUser, authConfig, organizationsAllowed);
4751
}
4852

49-
private boolean checkMembershipUsingPersonalAccessToken(LoggedInUserInfo loggedInUserInfo, AuthConfig authConfig, List<String> organizationsAllowed) throws IOException {
50-
final GitHub gitHubForPersonalAccessToken = authConfig.gitHubConfiguration().gitHubClient();
53+
private boolean checkMembershipUsingPersonalAccessToken(GHUser ghUser, AuthConfig authConfig, List<String> organizationsAllowed) throws IOException {
54+
final GitHub gitHubForPersonalAccessToken = clientBuilder.build(null, authConfig.gitHubConfiguration());
5155

5256
for (String organizationName : organizationsAllowed) {
5357
final GHOrganization organization = gitHubForPersonalAccessToken.getOrganization(organizationName);
54-
if (organization != null && organization.hasMember(loggedInUserInfo.getGitHubUser())) {
55-
LOG.info(format("[MembershipChecker] User `{0}` is a member of `{1}` organization.", loggedInUserInfo.getUser().username(), organizationName));
56-
return true;
57-
}
58-
}
59-
60-
return false;
61-
}
62-
63-
private boolean checkMembershipUsingUsersAccessToken(LoggedInUserInfo loggedInUserInfo, List<String> organizationsAllowed) throws IOException {
64-
final Map<String, GHOrganization> myGitHubOrganizations = loggedInUserInfo.getGitHub().getMyOrganizations();
65-
66-
for (String organizationName : myGitHubOrganizations.keySet()) {
67-
if (organizationsAllowed.contains(toLowerCase(organizationName))) {
68-
LOG.info(format("[MembershipChecker] User `{0}` is a member of `{1}` organization.", loggedInUserInfo.getUser().username(), organizationName));
58+
if (organization != null && organization.hasMember(ghUser)) {
59+
LOG.info(format("[MembershipChecker] User `{0}` is a member of `{1}` organization.", ghUser.getLogin(), organizationName));
6960
return true;
7061
}
7162
}
7263

7364
return false;
7465
}
7566

76-
public boolean isAMemberOfAtLeastOneTeamOfOrganization(LoggedInUserInfo loggedInUserInfo, AuthConfig authConfig, Map<String, List<String>> organizationAndTeamsAllowed) throws IOException {
67+
public boolean isAMemberOfAtLeastOneTeamOfOrganization(GHUser ghUser, AuthConfig authConfig, Map<String, List<String>> organizationAndTeamsAllowed) throws IOException {
7768
if (organizationAndTeamsAllowed.isEmpty()) {
7869
LOG.debug("[MembershipChecker] No teams provided.");
7970
return false;
8071
}
8172

82-
if (authConfig.gitHubConfiguration().authorizeUsingPersonalAccessToken()) {
83-
return checkTeamMembershipUsingPersonalAccessToken(loggedInUserInfo, authConfig, organizationAndTeamsAllowed);
84-
}
85-
86-
return checkTeamMembershipUsingUserAccessToken(loggedInUserInfo, organizationAndTeamsAllowed);
73+
return checkTeamMembershipUsingPersonalAccessToken(ghUser, authConfig, organizationAndTeamsAllowed);
8774
}
8875

89-
private boolean checkTeamMembershipUsingPersonalAccessToken(LoggedInUserInfo loggedInUserInfo, AuthConfig authConfig, Map<String, List<String>> organizationAndTeamsAllowed) throws IOException {
90-
final GitHub gitHubForPersonalAccessToken = authConfig.gitHubConfiguration().gitHubClient();
76+
private boolean checkTeamMembershipUsingPersonalAccessToken(GHUser ghUser, AuthConfig authConfig, Map<String, List<String>> organizationAndTeamsAllowed) throws IOException {
77+
final GitHub gitHubForPersonalAccessToken = clientBuilder.build(null, authConfig.gitHubConfiguration());
9178

9279
for (String organizationName : organizationAndTeamsAllowed.keySet()) {
9380
final GHOrganization organization = gitHubForPersonalAccessToken.getOrganization(organizationName);
@@ -97,8 +84,8 @@ private boolean checkTeamMembershipUsingPersonalAccessToken(LoggedInUserInfo log
9784
final Map<String, GHTeam> teamsFromGitHub = organization.getTeams();
9885

9986
for (GHTeam team : teamsFromGitHub.values()) {
100-
if (allowedTeamsFromRole.contains(team.getName().toLowerCase()) && team.hasMember(loggedInUserInfo.getGitHubUser())) {
101-
LOG.info(format("[MembershipChecker] User `{0}` is a member of `{1}` team.", loggedInUserInfo.getUser().username(), team.getName()));
87+
if (allowedTeamsFromRole.contains(team.getName().toLowerCase()) && team.hasMember(ghUser)) {
88+
LOG.info(format("[MembershipChecker] User `{0}` is a member of `{1}` team.", ghUser.getLogin(), team.getName()));
10289
return true;
10390
}
10491
}
@@ -107,26 +94,4 @@ private boolean checkTeamMembershipUsingPersonalAccessToken(LoggedInUserInfo log
10794

10895
return false;
10996
}
110-
111-
private boolean checkTeamMembershipUsingUserAccessToken(LoggedInUserInfo loggedInUserInfo, Map<String, List<String>> organizationAndTeamsAllowed) throws IOException {
112-
final Map<String, Set<GHTeam>> myGitHubOrganizationsAndTeams = loggedInUserInfo.getGitHub().getMyTeams();
113-
114-
for (String organizationName : myGitHubOrganizationsAndTeams.keySet()) {
115-
final List<String> teamsAllowed = organizationAndTeamsAllowed.get(toLowerCase(organizationName));
116-
117-
if (teamsAllowed == null || teamsAllowed.isEmpty()) {
118-
LOG.debug(format("[MembershipChecker] No teams specified for organization `{0}`.", organizationName));
119-
continue;
120-
}
121-
122-
for (GHTeam myGitHubTeam : myGitHubOrganizationsAndTeams.get(organizationName)) {
123-
if (teamsAllowed.contains(toLowerCase(myGitHubTeam.getName()))) {
124-
LOG.debug(format("[MembershipChecker] User is a member of `{0}:{1}` team.", organizationName, myGitHubTeam.getName()));
125-
return true;
126-
}
127-
}
128-
}
129-
130-
return false;
131-
}
13297
}

‎src/main/java/cd/go/authorization/github/executors/AuthConfigValidateRequestExecutor.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,15 +34,15 @@ public AuthConfigValidateRequestExecutor(AuthConfigValidateRequest request) {
3434
this.request = request;
3535
}
3636

37-
public GoPluginApiResponse execute() throws Exception {
37+
public GoPluginApiResponse execute() {
3838
final GitHubConfiguration gitHubConfiguration = request.githubConfiguration();
3939
final ValidationResult validationResult = new MetadataValidator().validate(gitHubConfiguration);
4040

4141
if (gitHubConfiguration.authenticateWith() == AuthenticateWith.GITHUB_ENTERPRISE && Util.isBlank(gitHubConfiguration.gitHubEnterpriseUrl())) {
4242
validationResult.addError("GitHubEnterpriseUrl", "GitHubEnterpriseUrl must not be blank.");
4343
}
4444

45-
if (gitHubConfiguration.authorizeUsingPersonalAccessToken() && Util.isBlank(gitHubConfiguration.personalAccessToken())) {
45+
if (Util.isBlank(gitHubConfiguration.personalAccessToken())) {
4646
validationResult.addError("PersonalAccessToken", "PersonalAccessToken must not be blank.");
4747
}
4848

‎src/main/java/cd/go/authorization/github/executors/GetAuthConfigViewRequestExecutor.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
public class GetAuthConfigViewRequestExecutor implements RequestExecutor {
2727

2828
@Override
29-
public GoPluginApiResponse execute() throws Exception {
29+
public GoPluginApiResponse execute() {
3030
JsonObject jsonObject = new JsonObject();
3131
jsonObject.addProperty("template", Util.readResource("/auth-config.template.html"));
3232
return DefaultGoPluginApiResponse.success(GSON.toJson(jsonObject));

‎src/main/java/cd/go/authorization/github/executors/GetCapabilitiesRequestExecutor.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,6 @@ public GoPluginApiResponse execute() {
3131
}
3232

3333
Capabilities getCapabilities() {
34-
return new Capabilities(SupportedAuthType.Web, true, true);
34+
return new Capabilities(SupportedAuthType.Web, true, true, true);
3535
}
3636
}

0 commit comments

Comments
 (0)