github-mirrors/VictoriaMetrics
1
0
Fork 0
mirror of https://github.com/VictoriaMetrics/VictoriaMetrics.git synced 2024-11-21 14:44:00 +00:00
Code Issues Projects Releases Packages Wiki Activity

lib/auth: add NewTokenPossibleMultitenant() for parsing auth token, which can be multitenant

Browse source 
Disallow parsing multitenant token at auth.NewToken().

Use auth.NewTokenPossibleMultitenant() at vminsert only. All the other callers should call auth.NewToken(),
since they do not support multitenant token.

This is a follow-up for f0c06b428e

Updates https://github.com/VictoriaMetrics/VictoriaMetrics/issues/4910
This commit is contained in:
Aliaksandr Valialkin 2023-08-30 14:08:47 +02:00
parent bda9699657
commit 3a2d035283
No known key found for this signature in database
GPG key ID: A72BEC6CD3D0DED1
4 changed files with 31 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/vminsert/main.go
View file

@ -208,7 +208,7 @@ func requestHandler(w http.ResponseWriter, r *http.Request) bool {
// This is not our link.
return false
}
at, err := auth.NewToken(p.AuthToken)
at, err := auth.NewTokenPossibleMultitenant(p.AuthToken)
if err != nil {
httpserver.Errorf(w, r, "auth error: %s", err)
return true

5
app/vmselect/main.go
View file

@ -292,11 +292,6 @@ func requestHandler(w http.ResponseWriter, r *http.Request) bool {
httpserver.Errorf(w, r, "auth error: %s", err)
return true
}
if at == nil {
// the only option for at to be nil is when p.AuthToken == "multitenant"
// vmselect does not have multitenant endpoint, so request must be rejected
return false
}
switch p.Prefix {
case "select":
return selectHandler(qt, startTime, w, r, p, at)

15
lib/auth/auth.go
View file

@ -24,12 +24,7 @@ func (t *Token) String() string {
}
// NewToken returns new Token for the given authToken.
//
// If authToken == "multitenant", then nil Token is returned.
func NewToken(authToken string) (*Token, error) {
if authToken == "multitenant" {
return nil, nil
}
var t Token
if err := t.Init(authToken); err != nil {
return nil, err
@ -37,6 +32,16 @@ func NewToken(authToken string) (*Token, error) {
return &t, nil
}
// NewTokenPossibleMultitenant returns new Token for the given authToken.
//
// If authToken == "multitenant", then nil Token is returned.
func NewTokenPossibleMultitenant(authToken string) (*Token, error) {
if authToken == "multitenant" {
return nil, nil
}
return NewToken(authToken)
}
// Init initializes t from authToken.
func (t *Token) Init(authToken string) error {
tmp := strings.Split(authToken, ":")

20
lib/auth/auth_test.go
View file

@ -26,6 +26,24 @@ func TestNewTokenSuccess(t *testing.T) {
f("1:4294967295", "1:4294967295")
// max uint32 accountID and projectID
f("4294967295:4294967295", "4294967295:4294967295")
}
func TestNewTokenPossibleMultitenantSuccess(t *testing.T) {
f := func(token string, want string) {
t.Helper()
newToken, err := NewTokenPossibleMultitenant(token)
if err != nil {
t.Fatalf("unexpected error: %s", err)
}
got := newToken.String()
if got != want {
t.Fatalf("unexpected NewToken() result;got\n%s\nwant\n%s", got, want)
}
}
// token with accountID only
f("1", "1")
// token with accountID and projecTID
f("1:2", "1:2")
// multitenant
f("multitenant", "multitenant")
}
@ -75,4 +93,6 @@ func TestNewTokenFailure(t *testing.T) {
f("a:b:c")
// many int parts in the token"
f("1:2:3")
// multitenant
f("multitenant")
}