Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enforce the "sites" JWT claim for PACTA #200

Merged
merged 1 commit into from
Jul 10, 2024
Merged

Enforce the "sites" JWT claim for PACTA #200

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions cmd/server/BUILD.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ go_library(
"@com_github_jackc_pgx_v5//pgxpool",
"@com_github_lestrrat_go_jwx_v2//jwk",
"@com_github_namsral_flag//:flag",
"@com_github_rmi_credential_service//allowlist",
"@com_github_rmi_credential_service//siteverify",
"@com_github_rs_cors//:cors",
"@org_uber_go_zap//:zap",
"@org_uber_go_zap_exp//zapfield",
Expand Down
3 changes: 3 additions & 0 deletions cmd/server/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@ import (
"strings"
"time"

"github.com/RMI/credential-service/allowlist"
"github.com/RMI/credential-service/siteverify"
"github.com/RMI/pacta/azure/azblob"
"github.com/RMI/pacta/azure/azcreds"
"github.com/RMI/pacta/azure/azevents"
Expand Down Expand Up @@ -314,6 +316,7 @@ func run(args []string) error {

chimiddleware.Recoverer,
jwtauth.Verifier(jwtauth.New("EdDSA", nil, jwKey)),
siteverify.CheckSite(allowlist.SitePACTA, *logger),
requireJWTIfNotPublicEndpoint,
session.WithAuthn(logger, db),
}, addl...)
Expand Down
22 changes: 14 additions & 8 deletions deps.bzl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,8 +244,8 @@ def go_dependencies():
go_repository(
name = "com_github_benbjohnson_clock",
importpath = "github.com/benbjohnson/clock",
sum = "h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=",
version = "v1.1.0",
sum = "h1:ip6w0uFQkncKQ979AypyG0ER7mqUSBdKLOgAle/AT8A=",
version = "v1.3.0",
)
go_repository(
name = "com_github_beorn7_perks",
Expand Down Expand Up @@ -1558,6 +1558,12 @@ def go_dependencies():
sum = "h1:OdAsTTz6OkFY5QxjkYwrChwuRruF69c169dPK26NUlk=",
version = "v0.0.0-20200410134404-eec4a21b6bb0",
)
go_repository(
name = "com_github_rmi_credential_service",
importpath = "github.com/RMI/credential-service",
sum = "h1:2/5ZCoWw57TKH0P7MGy89fIr709ahbTPuU28Q0ZHWFo=",
version = "v0.0.0-20240710165535-63e7f8b52060",
)
go_repository(
name = "com_github_rogpeppe_fastuuid",
importpath = "github.com/rogpeppe/fastuuid",
Expand Down Expand Up @@ -1633,8 +1639,8 @@ def go_dependencies():
go_repository(
name = "com_github_silicon_ally_zaphttplog",
importpath = "github.com/Silicon-Ally/zaphttplog",
sum = "h1:XhVHdwNFJMvn1C7pSuR+FQF6nkIWgxTtEwI/1K1EE0k=",
version = "v0.0.0-20230719190744-b544469cb197",
sum = "h1:vXN2GYxnE42c5XKBQm/Zev372lNwoA3zUR6oZlh5ats=",
version = "v1.0.0",
)
go_repository(
name = "com_github_sirupsen_logrus",
Expand Down Expand Up @@ -2204,8 +2210,8 @@ def go_dependencies():
go_repository(
name = "org_uber_go_goleak",
importpath = "go.uber.org/goleak",
sum = "h1:wy28qYRKZgnJTxGxvye5/wgWr1EKjmUDGYox5mGlRlI=",
version = "v1.1.11",
sum = "h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=",
version = "v1.2.0",
)
go_repository(
name = "org_uber_go_multierr",
Expand All @@ -2216,8 +2222,8 @@ def go_dependencies():
go_repository(
name = "org_uber_go_zap",
importpath = "go.uber.org/zap",
sum = "h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=",
version = "v1.24.0",
sum = "h1:4Hvk6GtkucQ790dqmj7l1eEnRdKm3k3ZUrUMS2d5+5c=",
version = "v1.25.0",
)
go_repository(
name = "org_uber_go_zap_exp",
Expand Down
9 changes: 5 additions & 4 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
module github.com/RMI/pacta

go 1.21
go 1.21.1

toolchain go1.21.6
toolchain go1.22.4

require (
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.8.0
Expand All @@ -12,7 +12,7 @@ require (
github.com/Silicon-Ally/cryptorand v1.0.1
github.com/Silicon-Ally/idgen v1.0.1
github.com/Silicon-Ally/testpgx v0.0.5
github.com/Silicon-Ally/zaphttplog v0.0.0-20230719190744-b544469cb197
github.com/Silicon-Ally/zaphttplog v1.0.0
github.com/bazelbuild/rules_go v0.45.0
github.com/deepmap/oapi-codegen v1.12.4
github.com/dimuska139/go-email-normalizer v1.2.1
Expand All @@ -28,14 +28,15 @@ require (
github.com/opencontainers/image-spec v1.0.2
github.com/rs/cors v1.9.0
github.com/spf13/cobra v1.1.3
go.uber.org/zap v1.24.0
go.uber.org/zap v1.25.0
)

require (
github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/messaging/azeventgrid v0.3.0 // indirect
github.com/AzureAD/microsoft-authentication-library-for-go v1.1.1 // indirect
github.com/Microsoft/go-winio v0.6.1 // indirect
github.com/RMI/credential-service v0.0.0-20240710165535-63e7f8b52060 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
github.com/docker/distribution v2.8.2+incompatible // indirect
Expand Down
5 changes: 5 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,8 @@ github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym
github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
github.com/RMI/credential-service v0.0.0-20240710165535-63e7f8b52060 h1:2/5ZCoWw57TKH0P7MGy89fIr709ahbTPuU28Q0ZHWFo=
github.com/RMI/credential-service v0.0.0-20240710165535-63e7f8b52060/go.mod h1:ctXZHu60bVQQhnfwluF2J3nO5R7g0cL+xRHmigcQUQ4=
github.com/Silicon-Ally/cryptorand v1.0.1 h1:CSZ9dYlY++GN9g/+znhk2qZevjkZ+nSlBJh2rB7jj8A=
github.com/Silicon-Ally/cryptorand v1.0.1/go.mod h1:NxU07fWVigUzimVH2WOVanUHcjwvPA9CRpnfS7Cm3/c=
github.com/Silicon-Ally/idgen v1.0.1 h1:O8DFr1W7jhTV5xvVrvYfYFXT8OgI4pRi6ZCO87BIC0M=
Expand All @@ -43,6 +45,7 @@ github.com/Silicon-Ally/testpgx v0.0.5 h1:wxI10yCtptIyx1XuwaJy9T34Y7sGSdU64tIoNC
github.com/Silicon-Ally/testpgx v0.0.5/go.mod h1:nkiAcFdbY92EoeKoKiwq+BpXGfnFWnQq4lNZRy6VOBU=
github.com/Silicon-Ally/zaphttplog v0.0.0-20230719190744-b544469cb197 h1:XhVHdwNFJMvn1C7pSuR+FQF6nkIWgxTtEwI/1K1EE0k=
github.com/Silicon-Ally/zaphttplog v0.0.0-20230719190744-b544469cb197/go.mod h1:MOYLV+7Ug2sTUbsp4fMV1CUooTD4RFD2+eQ+Glq5wxk=
github.com/Silicon-Ally/zaphttplog v1.0.0/go.mod h1:MOYLV+7Ug2sTUbsp4fMV1CUooTD4RFD2+eQ+Glq5wxk=
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
Expand Down Expand Up @@ -357,6 +360,8 @@ go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN8
go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
go.uber.org/zap v1.25.0 h1:4Hvk6GtkucQ790dqmj7l1eEnRdKm3k3ZUrUMS2d5+5c=
go.uber.org/zap v1.25.0/go.mod h1:JIAUzQIH94IC4fOJQm7gMmBJP5k7wQfdcnYdPoEXJYk=
go.uber.org/zap/exp v0.2.0 h1:FtGenNNeCATRB3CmB/yEUnjEFeJWpB/pMcy7e2bKPYs=
go.uber.org/zap/exp v0.2.0/go.mod h1:t0gqAIdh1MfKv9EwN/dLwfZnJxe9ITAZN78HEWPFWDQ=
golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
Expand Down
Loading