daml/triggers/service/auth/BUILD.bazel

139 lines
4.6 KiB
Python
Raw Normal View History

# Copyright (c) 2020 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
load(
"//bazel_tools:scala.bzl",
"da_scala_binary",
"da_scala_library",
"da_scala_test",
)
scalacopts = []
da_scala_library(
name = "oauth-middleware",
srcs = glob(["src/main/scala/com/daml/oauth/middleware/**/*.scala"]),
scalacopts = scalacopts,
visibility = ["//visibility:public"],
deps = [
":oauth-test-server", # TODO[AH] Extract OAuth2 request/response types
"//daml-lf/data",
Use auth middleware in trigger service `/v1/start` endpoint (#7654) * Authorize trigger service on middleware changelog_begin changelog_end * Trigger service auth callback handler * Forward token * Do not pin the application ID in the access token The trigger service will assign an individual application ID to each trigger based on its UUID. Requiring tokens on the granularity of application IDs would break the idea of storing the token in a cookie to be able to use it across multiple requests. changelog_begin changelog_end * todo persist trigger token * Add a state parameter to middleware login * add documentation comments * typo * fmt * Align Party type between middleware and trigger service The middleware was using `com.daml.lf.data.Ref.Party` while the trigger service is using `com.daml.ledger.api.refinements.ApiTypes.Party` which requires conversions. This aligns the types to avoid such conversions. * optional application id in oauth2 test server * align party types * configure auth middleware in trigger service tests * handle empty cookie header * follow redirects in trigger service tests * keep track of cookies * keep track of cookies * Replace any previous Cookie header Otherwise on old daml-ledger-token cookie might persist and be preferred over a newly added instance. * DEBUG * Configure test ledger client readAs claims * fmt * docstrings * remove debug output * Avoid endless redirect loops When the replay still fails to authorize on the middleware then we do not want to attempt another login flow. * Store callback routes in authCallbacks * fmt * Push AuthTestConfig into test target https://github.com/digital-asset/daml/pull/7654#discussion_r506510193 * Unbind oauth2 server after middleware https://github.com/digital-asset/daml/pull/7654/files#r506513251 Co-authored-by: Andreas Herrmann <andreas.herrmann@tweag.io>
2020-10-16 18:37:36 +03:00
"//language-support/scala/bindings",
"//ledger-service/jwt",
"//ledger/cli-opts",
"//ledger/ledger-api-auth",
"//libs-scala/ports",
"@maven//:com_github_scopt_scopt_2_12",
"@maven//:com_typesafe_akka_akka_actor_2_12",
"@maven//:com_typesafe_akka_akka_http_2_12",
"@maven//:com_typesafe_akka_akka_http_core_2_12",
"@maven//:com_typesafe_akka_akka_http_spray_json_2_12",
"@maven//:com_typesafe_akka_akka_parsing_2_12",
"@maven//:com_typesafe_akka_akka_stream_2_12",
"@maven//:com_typesafe_scala_logging_scala_logging_2_12",
"@maven//:io_spray_spray_json_2_12",
"@maven//:org_scalaz_scalaz_core_2_12",
"@maven//:org_slf4j_slf4j_api",
],
)
da_scala_binary(
name = "oauth-middleware-binary",
main_class = "com.daml.oauth.middleware.Main",
visibility = ["//visibility:public"],
runtime_deps = [
"@maven//:ch_qos_logback_logback_classic",
],
deps = [
":oauth-middleware",
],
)
da_scala_library(
name = "oauth-test-server",
srcs = glob(["src/main/scala/com/daml/oauth/server/**/*.scala"]),
scalacopts = scalacopts,
visibility = ["//visibility:public"],
deps = [
"//language-support/scala/bindings",
"//ledger-service/jwt",
"//ledger/ledger-api-auth",
"//libs-scala/ports",
"@maven//:com_github_scopt_scopt_2_12",
"@maven//:com_typesafe_akka_akka_actor_2_12",
"@maven//:com_typesafe_akka_akka_http_2_12",
"@maven//:com_typesafe_akka_akka_http_core_2_12",
"@maven//:com_typesafe_akka_akka_http_spray_json_2_12",
"@maven//:com_typesafe_akka_akka_stream_2_12",
"@maven//:com_typesafe_scala_logging_scala_logging_2_12",
"@maven//:io_spray_spray_json_2_12",
"@maven//:org_scalaz_scalaz_core_2_12",
"@maven//:org_slf4j_slf4j_api",
],
)
da_scala_binary(
name = "oauth-test-server-binary",
main_class = "com.daml.oauth.server.Main",
visibility = ["//visibility:public"],
runtime_deps = [
"@maven//:ch_qos_logback_logback_classic",
],
deps = [
":oauth-test-server",
],
)
da_scala_test(
name = "server-tests",
srcs = glob(["src/test/scala/com/daml/oauth/server/**/*.scala"]),
scalacopts = scalacopts,
deps = [
":oauth-test-server",
"//language-support/scala/bindings",
"//ledger-api/rs-grpc-bridge",
"//ledger-api/testing-utils",
"//ledger-service/jwt",
"//ledger/ledger-api-auth",
resources: Customizable contexts. (#7678) * resources: Move builders into //ledger/ledger-resources. Keep the actual constructors in a trait, but instantiate it when working with ledger code. This allows us to later introduce an extra "context" type parameter to ResourceOwner. * resources-akka: Move the builders in to //ledger/ledger-resources. * resources: Introduce an abstract `Context` parameter for owners. This replaces the concrete `ExecutionContext`. While it _can_ be an execution context, it really doesn't matter as long as we can get at one somehow. This is being introduced so we can wrap the context in a container, either for type tagging or to include extra information. Because our current context _is_ `ExecutionContext`, and an implicit is provided to extract it, we can end up with two ways to get the same value. We use shadowing to prevent this. This problem should go away in the near future when a new context type is added. CHANGELOG_BEGIN - [Integration Kit] The `ResourceOwner` type is now parameterized by a `Context`, which is filled in by the corresponding `Context` class in the _ledger-resources_ dependency. This allows us to pass extra information through resource acquisition. CHANGELOG_END * ledger-resources: Move `ResourceOwner` here from `resources`. * ledger-resources: Remove dependencies from outside //ledger. * ledger-resource: Wrap the acquisition execution context in `Context`. So we can add a logging context to it. * resources: Pass the Context, not the ExecutionContext, to Resource. * Avoid importing `HasExecutionContext`. * ledger-resources: Publish to Maven Central. * resources: Make the small changes suggested by @stefanobaghino-da. Co-Authored-By: Stefano Baghino <43749967+stefanobaghino-da@users.noreply.github.com> * ledger-resources: Pull out a trait for test resource contexts. Saves a few lines of code. * Restore some imports that were accidentally wildcarded. * resources: Replace an `implicit def` with a couple of imports. * participant-integration-api: Simplify the JdbcLedgerDaoBackend tests. Try and use the right execution context where possible. Co-authored-by: Stefano Baghino <43749967+stefanobaghino-da@users.noreply.github.com>
2020-10-20 12:26:28 +03:00
"//ledger/ledger-resources",
"//libs-scala/ports",
"//libs-scala/resources",
"@maven//:com_typesafe_akka_akka_actor_2_12",
"@maven//:com_typesafe_akka_akka_http_2_12",
"@maven//:com_typesafe_akka_akka_http_core_2_12",
"@maven//:com_typesafe_akka_akka_http_spray_json_2_12",
"@maven//:com_typesafe_akka_akka_parsing_2_12",
"@maven//:com_typesafe_akka_akka_stream_2_12",
"@maven//:io_spray_spray_json_2_12",
"@maven//:org_scalaz_scalaz_core_2_12",
],
)
da_scala_test(
name = "middleware-tests",
srcs = glob(["src/test/scala/com/daml/oauth/middleware/**/*.scala"]),
scalacopts = scalacopts,
deps = [
":oauth-middleware",
":oauth-test-server",
"//daml-lf/data",
Use auth middleware in trigger service `/v1/start` endpoint (#7654) * Authorize trigger service on middleware changelog_begin changelog_end * Trigger service auth callback handler * Forward token * Do not pin the application ID in the access token The trigger service will assign an individual application ID to each trigger based on its UUID. Requiring tokens on the granularity of application IDs would break the idea of storing the token in a cookie to be able to use it across multiple requests. changelog_begin changelog_end * todo persist trigger token * Add a state parameter to middleware login * add documentation comments * typo * fmt * Align Party type between middleware and trigger service The middleware was using `com.daml.lf.data.Ref.Party` while the trigger service is using `com.daml.ledger.api.refinements.ApiTypes.Party` which requires conversions. This aligns the types to avoid such conversions. * optional application id in oauth2 test server * align party types * configure auth middleware in trigger service tests * handle empty cookie header * follow redirects in trigger service tests * keep track of cookies * keep track of cookies * Replace any previous Cookie header Otherwise on old daml-ledger-token cookie might persist and be preferred over a newly added instance. * DEBUG * Configure test ledger client readAs claims * fmt * docstrings * remove debug output * Avoid endless redirect loops When the replay still fails to authorize on the middleware then we do not want to attempt another login flow. * Store callback routes in authCallbacks * fmt * Push AuthTestConfig into test target https://github.com/digital-asset/daml/pull/7654#discussion_r506510193 * Unbind oauth2 server after middleware https://github.com/digital-asset/daml/pull/7654/files#r506513251 Co-authored-by: Andreas Herrmann <andreas.herrmann@tweag.io>
2020-10-16 18:37:36 +03:00
"//language-support/scala/bindings",
"//ledger-api/rs-grpc-bridge",
"//ledger-api/testing-utils",
"//ledger-service/jwt",
"//ledger/ledger-api-auth",
resources: Customizable contexts. (#7678) * resources: Move builders into //ledger/ledger-resources. Keep the actual constructors in a trait, but instantiate it when working with ledger code. This allows us to later introduce an extra "context" type parameter to ResourceOwner. * resources-akka: Move the builders in to //ledger/ledger-resources. * resources: Introduce an abstract `Context` parameter for owners. This replaces the concrete `ExecutionContext`. While it _can_ be an execution context, it really doesn't matter as long as we can get at one somehow. This is being introduced so we can wrap the context in a container, either for type tagging or to include extra information. Because our current context _is_ `ExecutionContext`, and an implicit is provided to extract it, we can end up with two ways to get the same value. We use shadowing to prevent this. This problem should go away in the near future when a new context type is added. CHANGELOG_BEGIN - [Integration Kit] The `ResourceOwner` type is now parameterized by a `Context`, which is filled in by the corresponding `Context` class in the _ledger-resources_ dependency. This allows us to pass extra information through resource acquisition. CHANGELOG_END * ledger-resources: Move `ResourceOwner` here from `resources`. * ledger-resources: Remove dependencies from outside //ledger. * ledger-resource: Wrap the acquisition execution context in `Context`. So we can add a logging context to it. * resources: Pass the Context, not the ExecutionContext, to Resource. * Avoid importing `HasExecutionContext`. * ledger-resources: Publish to Maven Central. * resources: Make the small changes suggested by @stefanobaghino-da. Co-Authored-By: Stefano Baghino <43749967+stefanobaghino-da@users.noreply.github.com> * ledger-resources: Pull out a trait for test resource contexts. Saves a few lines of code. * Restore some imports that were accidentally wildcarded. * resources: Replace an `implicit def` with a couple of imports. * participant-integration-api: Simplify the JdbcLedgerDaoBackend tests. Try and use the right execution context where possible. Co-authored-by: Stefano Baghino <43749967+stefanobaghino-da@users.noreply.github.com>
2020-10-20 12:26:28 +03:00
"//ledger/ledger-resources",
"//libs-scala/ports",
"//libs-scala/resources",
"@maven//:com_typesafe_akka_akka_actor_2_12",
"@maven//:com_typesafe_akka_akka_http_2_12",
"@maven//:com_typesafe_akka_akka_http_core_2_12",
"@maven//:com_typesafe_akka_akka_http_spray_json_2_12",
"@maven//:com_typesafe_akka_akka_parsing_2_12",
"@maven//:com_typesafe_akka_akka_stream_2_12",
"@maven//:com_typesafe_scala_logging_scala_logging_2_12",
"@maven//:io_spray_spray_json_2_12",
"@maven//:org_scalaz_scalaz_core_2_12",
],
)