auth.go (10506B)
1 // Code generated by smithy-go-codegen DO NOT EDIT. 2 3 package signin 4 5 import ( 6 "context" 7 "fmt" 8 "slices" 9 "strings" 10 11 awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware" 12 smithy "github.com/aws/smithy-go" 13 smithyauth "github.com/aws/smithy-go/auth" 14 "github.com/aws/smithy-go/metrics" 15 "github.com/aws/smithy-go/middleware" 16 "github.com/aws/smithy-go/tracing" 17 smithyhttp "github.com/aws/smithy-go/transport/http" 18 ) 19 20 func bindAuthParamsRegion(_ interface{}, params *AuthResolverParameters, _ interface{}, options Options) error { 21 params.Region = options.Region 22 return nil 23 } 24 25 type setLegacyContextSigningOptionsMiddleware struct { 26 } 27 28 func (*setLegacyContextSigningOptionsMiddleware) ID() string { 29 return "setLegacyContextSigningOptions" 30 } 31 32 func (m *setLegacyContextSigningOptionsMiddleware) HandleFinalize(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) ( 33 out middleware.FinalizeOutput, metadata middleware.Metadata, err error, 34 ) { 35 rscheme := getResolvedAuthScheme(ctx) 36 schemeID := rscheme.Scheme.SchemeID() 37 38 if sn := awsmiddleware.GetSigningName(ctx); sn != "" { 39 if schemeID == "aws.auth#sigv4" { 40 smithyhttp.SetSigV4SigningName(&rscheme.SignerProperties, sn) 41 } else if schemeID == "aws.auth#sigv4a" { 42 smithyhttp.SetSigV4ASigningName(&rscheme.SignerProperties, sn) 43 } 44 } 45 46 if sr := awsmiddleware.GetSigningRegion(ctx); sr != "" { 47 if schemeID == "aws.auth#sigv4" { 48 smithyhttp.SetSigV4SigningRegion(&rscheme.SignerProperties, sr) 49 } else if schemeID == "aws.auth#sigv4a" { 50 smithyhttp.SetSigV4ASigningRegions(&rscheme.SignerProperties, []string{sr}) 51 } 52 } 53 54 return next.HandleFinalize(ctx, in) 55 } 56 57 func addSetLegacyContextSigningOptionsMiddleware(stack *middleware.Stack) error { 58 return stack.Finalize.Insert(&setLegacyContextSigningOptionsMiddleware{}, "Signing", middleware.Before) 59 } 60 61 type withAnonymous struct { 62 resolver AuthSchemeResolver 63 } 64 65 var _ AuthSchemeResolver = (*withAnonymous)(nil) 66 67 func (v *withAnonymous) ResolveAuthSchemes(ctx context.Context, params *AuthResolverParameters) ([]*smithyauth.Option, error) { 68 opts, err := v.resolver.ResolveAuthSchemes(ctx, params) 69 if err != nil { 70 return nil, err 71 } 72 73 opts = append(opts, &smithyauth.Option{ 74 SchemeID: smithyauth.SchemeIDAnonymous, 75 }) 76 return opts, nil 77 } 78 79 func wrapWithAnonymousAuth(options *Options) { 80 if _, ok := options.AuthSchemeResolver.(*defaultAuthSchemeResolver); !ok { 81 return 82 } 83 84 options.AuthSchemeResolver = &withAnonymous{ 85 resolver: options.AuthSchemeResolver, 86 } 87 } 88 89 // AuthResolverParameters contains the set of inputs necessary for auth scheme 90 // resolution. 91 type AuthResolverParameters struct { 92 // The name of the operation being invoked. 93 Operation string 94 95 // The region in which the operation is being invoked. 96 Region string 97 } 98 99 func bindAuthResolverParams(ctx context.Context, operation string, input interface{}, options Options) (*AuthResolverParameters, error) { 100 params := &AuthResolverParameters{ 101 Operation: operation, 102 } 103 104 if err := bindAuthParamsRegion(ctx, params, input, options); err != nil { 105 return nil, err 106 } 107 108 return params, nil 109 } 110 111 // AuthSchemeResolver returns a set of possible authentication options for an 112 // operation. 113 type AuthSchemeResolver interface { 114 ResolveAuthSchemes(context.Context, *AuthResolverParameters) ([]*smithyauth.Option, error) 115 } 116 117 type defaultAuthSchemeResolver struct{} 118 119 var _ AuthSchemeResolver = (*defaultAuthSchemeResolver)(nil) 120 121 func (*defaultAuthSchemeResolver) ResolveAuthSchemes(ctx context.Context, params *AuthResolverParameters) ([]*smithyauth.Option, error) { 122 if overrides, ok := operationAuthOptions[params.Operation]; ok { 123 return overrides(params), nil 124 } 125 return serviceAuthOptions(params), nil 126 } 127 128 var operationAuthOptions = map[string]func(*AuthResolverParameters) []*smithyauth.Option{ 129 "CreateOAuth2Token": func(params *AuthResolverParameters) []*smithyauth.Option { 130 return []*smithyauth.Option{ 131 {SchemeID: smithyauth.SchemeIDAnonymous}, 132 } 133 }, 134 } 135 136 func serviceAuthOptions(params *AuthResolverParameters) []*smithyauth.Option { 137 return []*smithyauth.Option{ 138 { 139 SchemeID: smithyauth.SchemeIDSigV4, 140 SignerProperties: func() smithy.Properties { 141 var props smithy.Properties 142 smithyhttp.SetSigV4SigningName(&props, "signin") 143 smithyhttp.SetSigV4SigningRegion(&props, params.Region) 144 return props 145 }(), 146 }, 147 } 148 } 149 150 type resolveAuthSchemeMiddleware struct { 151 operation string 152 options Options 153 } 154 155 func (*resolveAuthSchemeMiddleware) ID() string { 156 return "ResolveAuthScheme" 157 } 158 159 func (m *resolveAuthSchemeMiddleware) HandleFinalize(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) ( 160 out middleware.FinalizeOutput, metadata middleware.Metadata, err error, 161 ) { 162 _, span := tracing.StartSpan(ctx, "ResolveAuthScheme") 163 defer span.End() 164 165 params, err := bindAuthResolverParams(ctx, m.operation, getOperationInput(ctx), m.options) 166 if err != nil { 167 return out, metadata, fmt.Errorf("bind auth scheme params: %w", err) 168 } 169 options, err := m.options.AuthSchemeResolver.ResolveAuthSchemes(ctx, params) 170 if err != nil { 171 return out, metadata, fmt.Errorf("resolve auth scheme: %w", err) 172 } 173 174 scheme, ok := m.selectScheme(options) 175 if !ok { 176 return out, metadata, fmt.Errorf("could not select an auth scheme") 177 } 178 179 ctx = setResolvedAuthScheme(ctx, scheme) 180 181 span.SetProperty("auth.scheme_id", scheme.Scheme.SchemeID()) 182 span.End() 183 return next.HandleFinalize(ctx, in) 184 } 185 186 func (m *resolveAuthSchemeMiddleware) selectScheme(options []*smithyauth.Option) (*resolvedAuthScheme, bool) { 187 sorted := sortAuthOptions(options, m.options.AuthSchemePreference) 188 for _, option := range sorted { 189 if option.SchemeID == smithyauth.SchemeIDAnonymous { 190 return newResolvedAuthScheme(smithyhttp.NewAnonymousScheme(), option), true 191 } 192 193 for _, scheme := range m.options.AuthSchemes { 194 if !matchSchemeID(scheme.SchemeID(), option.SchemeID) { 195 continue 196 } 197 198 if scheme.IdentityResolver(m.options) != nil { 199 return newResolvedAuthScheme(scheme, option), true 200 } 201 } 202 } 203 204 return nil, false 205 } 206 207 func matchSchemeID(registered, option string) bool { 208 if registered == option { 209 return true 210 } 211 if i := strings.LastIndex(registered, "#"); i != -1 { 212 return registered[i+1:] == option 213 } 214 return false 215 } 216 217 func sortAuthOptions(options []*smithyauth.Option, preferred []string) []*smithyauth.Option { 218 byPriority := make([]*smithyauth.Option, 0, len(options)) 219 for _, prefName := range preferred { 220 for _, option := range options { 221 optName := option.SchemeID 222 if parts := strings.Split(option.SchemeID, "#"); len(parts) == 2 { 223 optName = parts[1] 224 } 225 if prefName == optName { 226 byPriority = append(byPriority, option) 227 } 228 } 229 } 230 for _, option := range options { 231 if !slices.ContainsFunc(byPriority, func(o *smithyauth.Option) bool { 232 return o.SchemeID == option.SchemeID 233 }) { 234 byPriority = append(byPriority, option) 235 } 236 } 237 return byPriority 238 } 239 240 type resolvedAuthSchemeKey struct{} 241 242 type resolvedAuthScheme struct { 243 Scheme smithyhttp.AuthScheme 244 IdentityProperties smithy.Properties 245 SignerProperties smithy.Properties 246 } 247 248 func newResolvedAuthScheme(scheme smithyhttp.AuthScheme, option *smithyauth.Option) *resolvedAuthScheme { 249 return &resolvedAuthScheme{ 250 Scheme: scheme, 251 IdentityProperties: option.IdentityProperties, 252 SignerProperties: option.SignerProperties, 253 } 254 } 255 256 func setResolvedAuthScheme(ctx context.Context, scheme *resolvedAuthScheme) context.Context { 257 return middleware.WithStackValue(ctx, resolvedAuthSchemeKey{}, scheme) 258 } 259 260 func getResolvedAuthScheme(ctx context.Context) *resolvedAuthScheme { 261 v, _ := middleware.GetStackValue(ctx, resolvedAuthSchemeKey{}).(*resolvedAuthScheme) 262 return v 263 } 264 265 type getIdentityMiddleware struct { 266 options Options 267 } 268 269 func (*getIdentityMiddleware) ID() string { 270 return "GetIdentity" 271 } 272 273 func (m *getIdentityMiddleware) HandleFinalize(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) ( 274 out middleware.FinalizeOutput, metadata middleware.Metadata, err error, 275 ) { 276 innerCtx, span := tracing.StartSpan(ctx, "GetIdentity") 277 defer span.End() 278 279 rscheme := getResolvedAuthScheme(innerCtx) 280 if rscheme == nil { 281 return out, metadata, fmt.Errorf("no resolved auth scheme") 282 } 283 284 resolver := rscheme.Scheme.IdentityResolver(m.options) 285 if resolver == nil { 286 return out, metadata, fmt.Errorf("no identity resolver") 287 } 288 289 identity, err := timeOperationMetric(ctx, "client.call.resolve_identity_duration", 290 func() (smithyauth.Identity, error) { 291 return resolver.GetIdentity(innerCtx, rscheme.IdentityProperties) 292 }, 293 func(o *metrics.RecordMetricOptions) { 294 o.Properties.Set("auth.scheme_id", rscheme.Scheme.SchemeID()) 295 }) 296 if err != nil { 297 return out, metadata, fmt.Errorf("get identity: %w", err) 298 } 299 300 ctx = setIdentity(ctx, identity) 301 302 span.End() 303 return next.HandleFinalize(ctx, in) 304 } 305 306 type identityKey struct{} 307 308 func setIdentity(ctx context.Context, identity smithyauth.Identity) context.Context { 309 return middleware.WithStackValue(ctx, identityKey{}, identity) 310 } 311 312 func getIdentity(ctx context.Context) smithyauth.Identity { 313 v, _ := middleware.GetStackValue(ctx, identityKey{}).(smithyauth.Identity) 314 return v 315 } 316 317 type signRequestMiddleware struct { 318 options Options 319 } 320 321 func (*signRequestMiddleware) ID() string { 322 return "Signing" 323 } 324 325 func (m *signRequestMiddleware) HandleFinalize(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) ( 326 out middleware.FinalizeOutput, metadata middleware.Metadata, err error, 327 ) { 328 _, span := tracing.StartSpan(ctx, "SignRequest") 329 defer span.End() 330 331 req, ok := in.Request.(*smithyhttp.Request) 332 if !ok { 333 return out, metadata, fmt.Errorf("unexpected transport type %T", in.Request) 334 } 335 336 rscheme := getResolvedAuthScheme(ctx) 337 if rscheme == nil { 338 return out, metadata, fmt.Errorf("no resolved auth scheme") 339 } 340 341 identity := getIdentity(ctx) 342 if identity == nil { 343 return out, metadata, fmt.Errorf("no identity") 344 } 345 346 signer := rscheme.Scheme.Signer() 347 if signer == nil { 348 return out, metadata, fmt.Errorf("no signer") 349 } 350 351 _, err = timeOperationMetric(ctx, "client.call.signing_duration", func() (any, error) { 352 return nil, signer.SignRequest(ctx, req, identity, rscheme.SignerProperties) 353 }, func(o *metrics.RecordMetricOptions) { 354 o.Properties.Set("auth.scheme_id", rscheme.Scheme.SchemeID()) 355 }) 356 if err != nil { 357 return out, metadata, fmt.Errorf("sign request: %w", err) 358 } 359 360 span.End() 361 return next.HandleFinalize(ctx, in) 362 }