mirror of
https://github.com/coder/coder.git
synced 2026-09-22 05:05:20 +08:00
dylanhuff-at-coder
76ae64391a
This PR migrates 224 typed JSON response sites across 46 files to `codersdk.ReadBodyAsJSON`, so invalid 2xx bodies return structured errors while preserving URL credential redaction. It intentionally excludes agent-direct HTTP, Azure IMDS, `UseNumber`, and chat paths; stacked on coder/coder#27804, with chat and lint follow-ups in coder/coder#27858 and coder/coder#27859. Refs coder/coder#27044. Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.
79 lines
2.6 KiB
Go
79 lines
2.6 KiB
Go
package agentsdk
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net/http"
|
|
|
|
"cloud.google.com/go/compute/metadata"
|
|
"golang.org/x/xerrors"
|
|
|
|
"github.com/coder/coder/v2/codersdk"
|
|
)
|
|
|
|
type GoogleInstanceIdentityToken struct {
|
|
JSONWebToken string `json:"json_web_token" validate:"required"`
|
|
// AgentName optionally selects a specific agent when multiple
|
|
// agents share the same instance identity. An empty string is
|
|
// treated as unspecified.
|
|
AgentName string `json:"agent_name,omitempty"`
|
|
}
|
|
|
|
// GoogleSessionTokenExchanger exchanges a Google instance JWT document for a Coder session token.
|
|
// @typescript-ignore GoogleSessionTokenExchanger
|
|
type GoogleSessionTokenExchanger struct {
|
|
serviceAccount string
|
|
gcpClient *metadata.Client
|
|
client *codersdk.Client
|
|
agentName string
|
|
}
|
|
|
|
func WithGoogleInstanceIdentity(serviceAccount string, gcpClient *metadata.Client, opts ...InstanceIdentityOption) SessionTokenSetup {
|
|
cfg := applyInstanceIdentityOptions(opts)
|
|
return func(client *codersdk.Client) RefreshableSessionTokenProvider {
|
|
return &InstanceIdentitySessionTokenProvider{
|
|
TokenExchanger: &GoogleSessionTokenExchanger{
|
|
client: client,
|
|
gcpClient: gcpClient,
|
|
serviceAccount: serviceAccount,
|
|
agentName: cfg.AgentName,
|
|
},
|
|
}
|
|
}
|
|
}
|
|
|
|
// exchange uses the Google Compute Engine Metadata API to fetch a signed JWT, and exchange it for a session token for a
|
|
// workspace agent.
|
|
//
|
|
// The requesting instance must be registered as a resource in the latest history for a workspace.
|
|
func (g *GoogleSessionTokenExchanger) exchange(ctx context.Context) (AuthenticateResponse, error) {
|
|
if g.serviceAccount == "" {
|
|
// This is the default name specified by Google.
|
|
g.serviceAccount = "default"
|
|
}
|
|
gcpClient := metadata.NewClient(g.client.HTTPClient)
|
|
if g.gcpClient != nil {
|
|
gcpClient = g.gcpClient
|
|
}
|
|
|
|
// "format=full" is required, otherwise the responding payload will be missing "instance_id".
|
|
jwt, err := gcpClient.Get(fmt.Sprintf("instance/service-accounts/%s/identity?audience=coder&format=full", g.serviceAccount))
|
|
if err != nil {
|
|
return AuthenticateResponse{}, xerrors.Errorf("get metadata identity: %w", err)
|
|
}
|
|
// request without the token to avoid re-entering this function
|
|
res, err := g.client.RequestWithoutSessionToken(ctx, http.MethodPost, "/api/v2/workspaceagents/google-instance-identity", GoogleInstanceIdentityToken{
|
|
JSONWebToken: jwt,
|
|
AgentName: g.agentName,
|
|
})
|
|
if err != nil {
|
|
return AuthenticateResponse{}, err
|
|
}
|
|
defer res.Body.Close()
|
|
if res.StatusCode != http.StatusOK {
|
|
return AuthenticateResponse{}, codersdk.ReadBodyAsError(res)
|
|
}
|
|
var resp AuthenticateResponse
|
|
return resp, codersdk.ReadBodyAsJSON(res, &resp)
|
|
}
|