feat: add auth support for server mode (#283)

* chore: refactory the body verify

* feat: add auth support

---------

Co-authored-by: rick <[email protected]>

Makefile

@@ -129,6 +129,9 @@ grpc-gw:
     --grpc-gateway_opt logtostderr=true \
     --grpc-gateway_opt paths=source_relative \
     --grpc-gateway_opt generate_unbound_methods=true \
+	--openapiv2_out . \
+	--openapiv2_opt logtostderr=true \
+	--openapiv2_opt generate_unbound_methods=true \
     pkg/server/server.proto
 grpc-java:
 	protoc --plugin=protoc-gen-grpc-java \
@@ -162,12 +165,15 @@ grpc-testproto:
     --go-grpc_out=. --go-grpc_opt=paths=source_relative \
 	pkg/runner/grpc_test/test.proto
 
-install-tool:
+hd:
+	curl https://linuxsuren.github.io/tools/install.sh|bash
+install-tool: hd
 	go install google.golang.org/protobuf/cmd/[email protected]
 	go install google.golang.org/grpc/cmd/[email protected]
 	hd i protoc-gen-grpc-web
 	hd i protoc-gen-grpc-gateway
-init-env:
-	curl https://linuxsuren.github.io/tools/install.sh|bash
+	sudo hd get https://github.com/grpc-ecosystem/grpc-gateway/releases/download/v2.18.1/protoc-gen-openapiv2-v2.18.1-linux-x86_64 -o /usr/local/bin/protoc-gen-openapiv2
+	sudo chmod +x /usr/local/bin/protoc-gen-openapiv2
+init-env: hd
 	hd i cli/cli
 	gh extension install linuxsuren/gh-dev

cmd/convert_test.go

@@ -40,7 +40,7 @@ import (
 
 func TestConvert(t *testing.T) {
 	c := cmd.NewRootCmd(fakeruntime.FakeExecer{ExpectOS: "linux"},
-		cmd.NewFakeGRPCServer(), server.NewFakeHTTPServer())
+		server.NewFakeHTTPServer())
 	c.SetOut(io.Discard)
 
 	t.Run("normal", func(t *testing.T) {

cmd/function_test.go

@@ -74,7 +74,7 @@ func TestCreateFunctionCommand(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			c := cmd.NewRootCmd(fakeruntime.FakeExecer{ExpectOS: "linux"},
-				cmd.NewFakeGRPCServer(), server.NewFakeHTTPServer())
+				server.NewFakeHTTPServer())
 
 			buf := new(bytes.Buffer)
 			c.SetOut(buf)

cmd/jsonschema_test.go

@@ -13,7 +13,7 @@ import (
 
 func TestJSONSchemaCmd(t *testing.T) {
 	c := cmd.NewRootCmd(fakeruntime.FakeExecer{ExpectOS: "linux"},
-		cmd.NewFakeGRPCServer(), server.NewFakeHTTPServer())
+		server.NewFakeHTTPServer())
 
 	buf := new(bytes.Buffer)
 	c.SetOut(buf)

cmd/root.go

@@ -10,8 +10,7 @@ import (
 )
 
 // NewRootCmd creates the root command
-func NewRootCmd(execer fakeruntime.Execer, gRPCServer gRPCServer,
-	httpServer server.HTTPServer) (c *cobra.Command) {
+func NewRootCmd(execer fakeruntime.Execer, httpServer server.HTTPServer) (c *cobra.Command) {
 	c = &cobra.Command{
 		Use:   "atest",
 		Short: "API testing tool",
@@ -20,7 +19,7 @@ func NewRootCmd(execer fakeruntime.Execer, gRPCServer gRPCServer,
 	c.Version = "\n" + version.GetDetailedVersion()
 	c.AddCommand(createInitCommand(execer),
 		createRunCommand(), createSampleCmd(),
-		createServerCmd(execer, gRPCServer, httpServer), createJSONSchemaCmd(),
+		createServerCmd(execer, httpServer), createJSONSchemaCmd(),
 		createServiceCommand(execer), createFunctionCmd(), createConvertCommand())
 	return
 }

cmd/root_test.go

@@ -18,18 +18,18 @@ func TestCreateRunCommand(t *testing.T) {
 	init := createInitCommand(execer)
 	assert.Equal(t, "init", init.Use)
 
-	s := createServerCmd(execer, &fakeGRPCServer{}, server.NewFakeHTTPServer())
+	s := createServerCmd(execer, server.NewFakeHTTPServer())
 	assert.NotNil(t, s)
 	assert.Equal(t, "server", s.Use)
 
-	root := NewRootCmd(execer, NewFakeGRPCServer(), server.NewFakeHTTPServer())
+	root := NewRootCmd(execer, server.NewFakeHTTPServer())
 	root.SetArgs([]string{"init", "-k=demo.yaml", "--wait-namespace", "demo", "--wait-resource", "demo"})
 	err := root.Execute()
 	assert.Nil(t, err)
 }
 
 func TestRootCmd(t *testing.T) {
-	c := NewRootCmd(fakeruntime.FakeExecer{ExpectOS: "linux"}, NewFakeGRPCServer(), server.NewFakeHTTPServer())
+	c := NewRootCmd(fakeruntime.FakeExecer{ExpectOS: "linux"}, server.NewFakeHTTPServer())
 	assert.NotNil(t, c)
 	assert.Equal(t, "atest", c.Use)
 }

cmd/run.go

@@ -1,3 +1,27 @@
+/*
+MIT License
+
+Copyright (c) 2023 API Testing Authors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+
 package cmd
 
 import (

cmd/sample.go

@@ -1,3 +1,27 @@
+/*
+MIT License
+
+Copyright (c) 2023 API Testing Authors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+
 package cmd
 
 import (

cmd/sample_test.go

@@ -1,3 +1,27 @@
+/*
+MIT License
+
+Copyright (c) 2023 API Testing Authors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+
 package cmd_test
 
 import (
@@ -13,7 +37,7 @@ import (
 
 func TestSampleCmd(t *testing.T) {
 	c := cmd.NewRootCmd(fakeruntime.FakeExecer{ExpectOS: "linux"},
-		cmd.NewFakeGRPCServer(), server.NewFakeHTTPServer())
+		server.NewFakeHTTPServer())
 
 	buf := new(bytes.Buffer)
 	c.SetOut(buf)

cmd/server.go

@@ -1,9 +1,34 @@
+/*
+MIT License
+
+Copyright (c) 2023 API Testing Authors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+*/
+
 // Package cmd provides all the commands
 package cmd
 
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"log"
 	"net"
@@ -19,6 +44,7 @@ import (
 	pprof "net/http/pprof"
 
 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/linuxsuren/api-testing/pkg/oauth"
 	template "github.com/linuxsuren/api-testing/pkg/render"
 	"github.com/linuxsuren/api-testing/pkg/server"
 	"github.com/linuxsuren/api-testing/pkg/testing"
@@ -29,13 +55,14 @@ import (
 	"github.com/prometheus/client_golang/prometheus/collectors"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/spf13/cobra"
+	"golang.org/x/oauth2"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/reflection"
 )
 
-func createServerCmd(execer fakeruntime.Execer, gRPCServer gRPCServer, httpServer server.HTTPServer) (c *cobra.Command) {
+func createServerCmd(execer fakeruntime.Execer, httpServer server.HTTPServer) (c *cobra.Command) {
 	opt := &serverOption{
-		gRPCServer: gRPCServer,
 		httpServer: httpServer,
 		execer:     execer,
 	}
@@ -54,6 +81,16 @@ func createServerCmd(execer fakeruntime.Execer, gRPCServer gRPCServer, httpServe
 	flags.StringVarP(&opt.configDir, "config-dir", "", os.ExpandEnv("$HOME/.config/atest"), "The config directory")
 	flags.StringVarP(&opt.secretServer, "secret-server", "", "", "The secret server URL")
 	flags.StringVarP(&opt.skyWalking, "skywalking", "", "", "Push the browser tracing data to the Apache SkyWalking HTTP URL")
+	flags.StringVarP(&opt.auth, "auth", "", "", "The auth mode, supported: oauth. Keep it empty to disable auth")
+	flags.StringVarP(&opt.oauthProvider, "oauth-provider", "", "github", "The oauth provider, supported: github")
+	flags.StringVarP(&opt.oauthServer, "oauth-server", "", "", "The oAuth server address, required if it is a private server")
+	flags.BoolVarP(&opt.oauthSkipTls, "oauth-skip-tls", "", false, "Skip TLS verify when connect to oauth server")
+	flags.StringArrayVarP(&opt.oauthGroup, "oauth-group", "", []string{}, "Alow specific groups, all groups is ok if it is empty")
+	flags.StringVarP(&opt.clientID, "client-id", "", "", "ClientID is the application's ID")
+	flags.StringVarP(&opt.clientSecret, "client-secret", "", "", "ClientSecret is the application's secret")
+	flags.BoolVarP(&opt.dryRun, "dry-run", "", false, "Do not really start a gRPC server")
+
+	c.Flags().MarkHidden("dry-run")
 	return
 }
 
@@ -70,9 +107,58 @@ type serverOption struct {
 	secretServer string
 	configDir    string
 	skyWalking   string
+
+	auth          string
+	oauthProvider string
+	// ClientID is the application's ID.
+	clientID string
+	// ClientSecret is the application's secret.
+	clientSecret string
+	oauthServer  string
+	oauthSkipTls bool
+	oauthGroup   []string
+
+	dryRun bool
+
+	// inner fields, not as command flags
+	provider oauth.OAuthProvider
 }
 
 func (o *serverOption) preRunE(cmd *cobra.Command, args []string) (err error) {
+	var grpcOpts []grpc.ServerOption
+
+	if o.auth == "oauth" {
+		if o.provider = oauth.GetOAuthProvider(o.oauthProvider); o.provider == nil {
+			err = fmt.Errorf("not support: %q", o.oauthProvider)
+			return
+		}
+
+		if o.provider.GetServer() != "" {
+			// returns empty string if it's a private server
+			o.oauthServer = o.provider.GetServer()
+		} else {
+			o.provider.SetServer(o.oauthServer)
+		}
+
+		if o.clientID == "" || o.clientSecret == "" {
+			err = errors.New("--client-id and --client-secret flags are required when auth enabled")
+			return
+		}
+
+		if o.oauthServer == "" {
+			err = errors.New("oAuth server address is required")
+			return
+		}
+
+		grpcOpts = append(grpcOpts, oauth.NewAuthInterceptor(o.oauthGroup))
+	}
+
+	if o.dryRun {
+		o.gRPCServer = &fakeGRPCServer{}
+	} else {
+		o.gRPCServer = grpc.NewServer(grpcOpts...)
+	}
+
 	o.configDir = os.ExpandEnv(o.configDir)
 	err = o.execer.MkdirAll(o.configDir, 0755)
 	return
@@ -151,8 +237,8 @@ func (o *serverOption) runE(cmd *cobra.Command, args []string) (err error) {
 		_ = storeExtMgr.StopAll()
 	}()
 
-	mux := runtime.NewServeMux(runtime.WithMetadata(server.MetadataStoreFunc)) //  runtime.WithIncomingHeaderMatcher(func(key string) (s string, b bool) {
-	err = server.RegisterRunnerHandlerServer(ctx, mux, remoteServer)
+	mux := runtime.NewServeMux(runtime.WithMetadata(server.MetadataStoreFunc))
+	err = server.RegisterRunnerHandlerFromEndpoint(ctx, mux, "127.0.0.1:7070", []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())})
 	if err == nil {
 		mux.HandlePath(http.MethodGet, "/", frontEndHandlerWithLocation(o.consolePath))
 		mux.HandlePath(http.MethodGet, "/assets/{asset}", frontEndHandlerWithLocation(o.consolePath))
@@ -166,6 +252,16 @@ func (o *serverOption) runE(cmd *cobra.Command, args []string) (err error) {
 		// Create non-global registry.
 		reg := prometheus.NewRegistry()
 
+		// register oauth endpoint
+		if o.auth == "oauth" {
+			authHandler := oauth.NewAuth(o.provider, oauth2.Config{
+				ClientID:     o.clientID,
+				ClientSecret: o.clientSecret,
+			}, o.oauthSkipTls)
+			mux.HandlePath(http.MethodGet, "/token", authHandler.RequestCode)
+			mux.HandlePath(http.MethodGet, "/oauth2/callback", authHandler.Callback)
+		}
+
 		// Add go runtime metrics and process collectors.
 		reg.MustRegister(
 			collectors.NewGoCollector(),
@@ -265,8 +361,6 @@ func debugHandler(mux *runtime.ServeMux) {
 	})
 }
 
-var filesNeedToBeRemoved = []string{}
-
 func (o *serverOption) getAtestBinary(w http.ResponseWriter, r *http.Request, pathParams map[string]string) {
 	w.Header().Set(util.ContentDisposition, "attachment; filename=atest")
 	w.Header().Set(util.ContentType, "application/octet-stream")