credentials/providers/oauth.go - Code Metrics - Inspection of "Merge pull request #136 from aliyun/feature/oauth" - aliyun/credentials-go - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( fe6920...0b968c )

unknown

created 2025-10-24 11:12 UTC

credentials/providers/oauth.go C

↳ Parent: Project

Size/Duplication

Total Lines	292
Duplicated Lines	0 %

Importance

Changes

Metric	Value
cc	53
eloc	191
dl	0
loc	292
rs	6.96
c	0
b	0
f	0

14 Methods

Rating	Name	Size	Complexity
B	providers.*OAuthCredentialsProvider.GetCredentials	32	7
A	providers.*OAuthCredentialsProviderBuilder.WithAccessToken	3	1
A	providers.*OAuthCredentialsProviderBuilder.WithTokenUpdateCallback	3	1
A	providers.*OAuthCredentialsProviderBuilder.WithHttpOptions	3	1
A	providers.*OAuthCredentialsProviderBuilder.WithClientId	3	1
A	providers.*OAuthCredentialsProviderBuilder.WithSignInUrl	3	1
A	providers.*OAuthCredentialsProvider.GetProviderName	2	1
F	providers.*OAuthCredentialsProvider.getCredentials	69	18
A	providers.*OAuthCredentialsProviderBuilder.WithRefreshToken	3	1
D	providers.*OAuthCredentialsProvider.tryRefreshOauthToken	62	13
A	providers.*OAuthCredentialsProviderBuilder.Build	18	4
A	providers.*OAuthCredentialsProviderBuilder.WithAccessTokenExpire	3	1
A	providers.*OAuthCredentialsProvider.needUpdateCredential	6	2
A	providers.NewOAuthCredentialsProviderBuilder	3	1

package providers

import (
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"net/url"
	"time"

	httputil "github.com/aliyun/credentials-go/credentials/internal/http"
	"github.com/aliyun/credentials-go/credentials/internal/utils"
)

// OAuthTokenUpdateCallback 定义OAuth令牌更新回调函数类型
type OAuthTokenUpdateCallback func(refreshToken, accessToken, accessKey, secret, securityToken string, accessTokenExpire, stsExpire int64) error

type oauthCredentialResponse struct {
	AccessKeyId     string `json:"accessKeyId"`
	AccessKeySecret string `json:"accessKeySecret"`
	SecurityToken   string `json:"securityToken"`
	Expiration      string `json:"expiration"`
	RequestId       string `json:"requestId"`
}

type oauthRefreshTokenResponse struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token"`
	ExpiresIn    int64  `json:"expires_in"`
	TokenType    string `json:"token_type"`
}

type OAuthCredentialsProvider struct {
	clientId          string
	signInUrl         string
	refreshToken      string
	accessToken       string
	accessTokenExpire int64

	lastUpdateTimestamp int64
	expirationTimestamp int64
	sessionCredentials  *sessionCredentials
	// for http options
	httpOptions *HttpOptions
	// OAuth token call back
	tokenUpdateCallback OAuthTokenUpdateCallback
}

type OAuthCredentialsProviderBuilder struct {
	provider *OAuthCredentialsProvider
}

func NewOAuthCredentialsProviderBuilder() *OAuthCredentialsProviderBuilder {
	return &OAuthCredentialsProviderBuilder{
		provider: &OAuthCredentialsProvider{},
	}
}

func (b *OAuthCredentialsProviderBuilder) WithClientId(clientId string) *OAuthCredentialsProviderBuilder {
	b.provider.clientId = clientId
	return b
}

func (b *OAuthCredentialsProviderBuilder) WithSignInUrl(signInUrl string) *OAuthCredentialsProviderBuilder {
	b.provider.signInUrl = signInUrl
	return b
}

func (b *OAuthCredentialsProviderBuilder) WithRefreshToken(refreshToken string) *OAuthCredentialsProviderBuilder {
	b.provider.refreshToken = refreshToken
	return b
}

func (b *OAuthCredentialsProviderBuilder) WithAccessToken(accessToken string) *OAuthCredentialsProviderBuilder {
	b.provider.accessToken = accessToken
	return b
}

func (b *OAuthCredentialsProviderBuilder) WithAccessTokenExpire(accessTokenExpire int64) *OAuthCredentialsProviderBuilder {
	b.provider.accessTokenExpire = accessTokenExpire
	return b
}

func (b *OAuthCredentialsProviderBuilder) WithHttpOptions(httpOptions *HttpOptions) *OAuthCredentialsProviderBuilder {
	b.provider.httpOptions = httpOptions
	return b
}

func (b *OAuthCredentialsProviderBuilder) WithTokenUpdateCallback(callback OAuthTokenUpdateCallback) *OAuthCredentialsProviderBuilder {
	b.provider.tokenUpdateCallback = callback
	return b
}

func (b *OAuthCredentialsProviderBuilder) Build() (provider *OAuthCredentialsProvider, err error) {
	if b.provider.clientId == "" {
		err = errors.New("the ClientId is empty")
		return
	}

	if b.provider.signInUrl == "" {
		err = errors.New("the url for sign-in is empty")
		return
	}

	if b.provider.refreshToken == "" {
		err = errors.New("OAuth access token is empty or expired, please re-login with cli")
		return
	}

	provider = b.provider
	return
}

func (provider *OAuthCredentialsProvider) getCredentials() (session *sessionCredentials, err error) {

	if provider.accessToken == "" || provider.accessTokenExpire == 0 || provider.accessTokenExpire-time.Now().Unix() <= 180 {
		err = provider.tryRefreshOauthToken()
		if err != nil {
			return nil, err
		}
	}

	url, err := url.Parse(provider.signInUrl)
	if err != nil {
		return nil, err
	}

	req := &httputil.Request{
		Method:   "POST",
		Protocol: url.Scheme,
		Host:     url.Host,
		Path:     "/v1/exchange",
		Headers:  map[string]string{},
	}

	connectTimeout := 5 * time.Second
	readTimeout := 10 * time.Second

	if provider.httpOptions != nil && provider.httpOptions.ConnectTimeout > 0 {
		connectTimeout = time.Duration(provider.httpOptions.ConnectTimeout) * time.Millisecond
	}
	if provider.httpOptions != nil && provider.httpOptions.ReadTimeout > 0 {
		readTimeout = time.Duration(provider.httpOptions.ReadTimeout) * time.Millisecond
	}
	if provider.httpOptions != nil && provider.httpOptions.Proxy != "" {
		req.Proxy = provider.httpOptions.Proxy
	}
	req.ConnectTimeout = connectTimeout
	req.ReadTimeout = readTimeout

	// set headers
	req.Headers["Content-Type"] = "application/json"
	req.Headers["Authorization"] = fmt.Sprintf("Bearer %s", provider.accessToken)
	res, err := httpDo(req)
	if err != nil {
		return
	}

	if res.StatusCode != http.StatusOK {
		message := "get session token from OAuth failed: "
		err = errors.New(message + string(res.Body))
		return
	}
	var data oauthCredentialResponse
	err = json.Unmarshal(res.Body, &data)
	if err != nil {
		err = fmt.Errorf("get session token from OAuth failed, json.Unmarshal fail: %s", err.Error())
		return
	}

	if data.AccessKeyId == "" || data.AccessKeySecret == "" || data.SecurityToken == "" {
		err = fmt.Errorf("refresh session token err, fail to get credentials from OAuth: " + string(res.Body))
		return
	}

	session = &sessionCredentials{
		AccessKeyId:     data.AccessKeyId,
		AccessKeySecret: data.AccessKeySecret,
		SecurityToken:   data.SecurityToken,
		Expiration:      data.Expiration,
	}
	return
}

func (provider *OAuthCredentialsProvider) tryRefreshOauthToken() (err error) {
	refreshToken := provider.refreshToken
	clientId := provider.clientId

	url, err := url.Parse(provider.signInUrl)
	if err != nil {
		return
	}

	req := &httputil.Request{
		Method:   "POST",
		Protocol: url.Scheme,
		Host:     url.Host,
		Path:     "/v1/token",
		Headers:  map[string]string{},
	}

	connectTimeout := 5 * time.Second
	readTimeout := 10 * time.Second

	if provider.httpOptions != nil && provider.httpOptions.ConnectTimeout > 0 {
		connectTimeout = time.Duration(provider.httpOptions.ConnectTimeout) * time.Millisecond
	}
	if provider.httpOptions != nil && provider.httpOptions.ReadTimeout > 0 {
		readTimeout = time.Duration(provider.httpOptions.ReadTimeout) * time.Millisecond
	}
	if provider.httpOptions != nil && provider.httpOptions.Proxy != "" {
		req.Proxy = provider.httpOptions.Proxy
	}
	req.ConnectTimeout = connectTimeout
	req.ReadTimeout = readTimeout

	bodyForm := make(map[string]string)
	bodyForm["grant_type"] = "refresh_token"
	bodyForm["refresh_token"] = refreshToken
	bodyForm["client_id"] = clientId
	bodyForm["Timestamp"] = utils.GetTimeInFormatISO8601()
	req.Form = bodyForm

	req.Headers["Content-Type"] = "application/x-www-form-urlencoded"
	resp, err := httpDo(req)
	if err != nil {
		return
	}
	if resp.StatusCode != http.StatusOK {
		return fmt.Errorf("failed to refresh token, status code: %d", resp.StatusCode)
	}
	var tokenResp oauthRefreshTokenResponse
	err = json.Unmarshal(resp.Body, &tokenResp)
	if err != nil {
		err = fmt.Errorf("get refresh token from OAuth failed, json.Unmarshal fail: %s", err.Error())
		return
	}
	if tokenResp.RefreshToken == "" || tokenResp.AccessToken == "" {
		err = fmt.Errorf("failed to refresh token from OAuth: " + string(resp.Body))
		return
	}
	provider.accessToken = tokenResp.AccessToken
	provider.refreshToken = tokenResp.RefreshToken
	provider.accessTokenExpire = time.Now().Unix() + tokenResp.ExpiresIn

	return nil
}

func (provider *OAuthCredentialsProvider) needUpdateCredential() (result bool) {
	if provider.expirationTimestamp == 0 {
		return true
	}

	return provider.expirationTimestamp-time.Now().Unix() <= 180
}

func (provider *OAuthCredentialsProvider) GetCredentials() (cc *Credentials, err error) {
	if provider.sessionCredentials == nil || provider.needUpdateCredential() {
		sessionCredentials, err1 := provider.getCredentials()
		if err1 != nil {
			return nil, err1
		}

		provider.sessionCredentials = sessionCredentials
		expirationTime, err2 := time.Parse("2006-01-02T15:04:05Z", sessionCredentials.Expiration)
		if err2 != nil {
			return nil, err2
		}

		provider.lastUpdateTimestamp = time.Now().Unix()
		provider.expirationTimestamp = expirationTime.Unix()

		// 如果设置了回调函数，则调用回调函数写回配置文件
		if provider.tokenUpdateCallback != nil {
			err1 := provider.tokenUpdateCallback(provider.refreshToken, provider.accessToken, sessionCredentials.AccessKeyId, sessionCredentials.AccessKeySecret, sessionCredentials.SecurityToken, provider.accessTokenExpire, provider.expirationTimestamp)
			if err1 != nil {
				fmt.Printf("Warning: failed to update OAuth tokens in config file: %v\n", err)
			}
		}
	}

	cc = &Credentials{
		AccessKeyId:     provider.sessionCredentials.AccessKeyId,
		AccessKeySecret: provider.sessionCredentials.AccessKeySecret,
		SecurityToken:   provider.sessionCredentials.SecurityToken,
		ProviderName:    provider.GetProviderName(),
	}
	return
}

func (provider *OAuthCredentialsProvider) GetProviderName() string {
	return "oauth"
}


1			package providers
2
3			import (
4			"encoding/json"
5			"errors"
6			"fmt"
7			"net/http"
8			"net/url"
9			"time"
10
11			httputil "github.com/aliyun/credentials-go/credentials/internal/http"
12			"github.com/aliyun/credentials-go/credentials/internal/utils"
13			)
14
15			// OAuthTokenUpdateCallback 定义OAuth令牌更新回调函数类型
16			type OAuthTokenUpdateCallback func(refreshToken, accessToken, accessKey, secret, securityToken string, accessTokenExpire, stsExpire int64) error
17
18			type oauthCredentialResponse struct {
19			AccessKeyId string `json:"accessKeyId"`
20			AccessKeySecret string `json:"accessKeySecret"`
21			SecurityToken string `json:"securityToken"`
22			Expiration string `json:"expiration"`
23			RequestId string `json:"requestId"`
24			}
25
26			type oauthRefreshTokenResponse struct {
27			AccessToken string `json:"access_token"`
28			RefreshToken string `json:"refresh_token"`
29			ExpiresIn int64 `json:"expires_in"`
30			TokenType string `json:"token_type"`
31			}
32
33			type OAuthCredentialsProvider struct {
34			clientId string
35			signInUrl string
36			refreshToken string
37			accessToken string
38			accessTokenExpire int64
39
40			lastUpdateTimestamp int64
41			expirationTimestamp int64
42			sessionCredentials *sessionCredentials
43			// for http options
44			httpOptions *HttpOptions
45			// OAuth token call back
46			tokenUpdateCallback OAuthTokenUpdateCallback
47			}
48
49			type OAuthCredentialsProviderBuilder struct {
50			provider *OAuthCredentialsProvider
51			}
52
53			func NewOAuthCredentialsProviderBuilder() *OAuthCredentialsProviderBuilder {
54			return &OAuthCredentialsProviderBuilder{
55			provider: &OAuthCredentialsProvider{},
56			}
57			}
58
59			func (b OAuthCredentialsProviderBuilder) WithClientId(clientId string) OAuthCredentialsProviderBuilder {
60			b.provider.clientId = clientId
61			return b
62			}
63
64			func (b OAuthCredentialsProviderBuilder) WithSignInUrl(signInUrl string) OAuthCredentialsProviderBuilder {
65			b.provider.signInUrl = signInUrl
66			return b
67			}
68
69			func (b OAuthCredentialsProviderBuilder) WithRefreshToken(refreshToken string) OAuthCredentialsProviderBuilder {
70			b.provider.refreshToken = refreshToken
71			return b
72			}
73
74			func (b OAuthCredentialsProviderBuilder) WithAccessToken(accessToken string) OAuthCredentialsProviderBuilder {
75			b.provider.accessToken = accessToken
76			return b
77			}
78
79			func (b OAuthCredentialsProviderBuilder) WithAccessTokenExpire(accessTokenExpire int64) OAuthCredentialsProviderBuilder {
80			b.provider.accessTokenExpire = accessTokenExpire
81			return b
82			}
83
84			func (b OAuthCredentialsProviderBuilder) WithHttpOptions(httpOptions HttpOptions) *OAuthCredentialsProviderBuilder {
85			b.provider.httpOptions = httpOptions
86			return b
87			}
88
89			func (b OAuthCredentialsProviderBuilder) WithTokenUpdateCallback(callback OAuthTokenUpdateCallback) OAuthCredentialsProviderBuilder {
90			b.provider.tokenUpdateCallback = callback
91			return b
92			}
93
94			func (b OAuthCredentialsProviderBuilder) Build() (provider OAuthCredentialsProvider, err error) {
95			if b.provider.clientId == "" {
96			err = errors.New("the ClientId is empty")
97			return
98			}
99
100			if b.provider.signInUrl == "" {
101			err = errors.New("the url for sign-in is empty")
102			return
103			}
104
105			if b.provider.refreshToken == "" {
106			err = errors.New("OAuth access token is empty or expired, please re-login with cli")
107			return
108			}
109
110			provider = b.provider
111			return
112			}
113
114			func (provider OAuthCredentialsProvider) getCredentials() (session sessionCredentials, err error) {
115
116			if provider.accessToken == "" \|\| provider.accessTokenExpire == 0 \|\| provider.accessTokenExpire-time.Now().Unix() <= 180 {
117			err = provider.tryRefreshOauthToken()
118			if err != nil {
119			return nil, err
120			}
121			}
122
123			url, err := url.Parse(provider.signInUrl)
124			if err != nil {
125			return nil, err
126			}
127
128			req := &httputil.Request{
129			Method: "POST",
130			Protocol: url.Scheme,
131			Host: url.Host,
132			Path: "/v1/exchange",
133			Headers: map[string]string{},
134			}
135
136			connectTimeout := 5 * time.Second
137			readTimeout := 10 * time.Second
138
139			if provider.httpOptions != nil && provider.httpOptions.ConnectTimeout > 0 {
140			connectTimeout = time.Duration(provider.httpOptions.ConnectTimeout) * time.Millisecond
141			}
142			if provider.httpOptions != nil && provider.httpOptions.ReadTimeout > 0 {
143			readTimeout = time.Duration(provider.httpOptions.ReadTimeout) * time.Millisecond
144			}
145			if provider.httpOptions != nil && provider.httpOptions.Proxy != "" {
146			req.Proxy = provider.httpOptions.Proxy
147			}
148			req.ConnectTimeout = connectTimeout
149			req.ReadTimeout = readTimeout
150
151			// set headers
152			req.Headers["Content-Type"] = "application/json"
153			req.Headers["Authorization"] = fmt.Sprintf("Bearer %s", provider.accessToken)
154			res, err := httpDo(req)
155			if err != nil {
156			return
157			}
158
159			if res.StatusCode != http.StatusOK {
160			message := "get session token from OAuth failed: "
161			err = errors.New(message + string(res.Body))
162			return
163			}
164			var data oauthCredentialResponse
165			err = json.Unmarshal(res.Body, &data)
166			if err != nil {
167			err = fmt.Errorf("get session token from OAuth failed, json.Unmarshal fail: %s", err.Error())
168			return
169			}
170
171			if data.AccessKeyId == "" \|\| data.AccessKeySecret == "" \|\| data.SecurityToken == "" {
172			err = fmt.Errorf("refresh session token err, fail to get credentials from OAuth: " + string(res.Body))
173			return
174			}
175
176			session = &sessionCredentials{
177			AccessKeyId: data.AccessKeyId,
178			AccessKeySecret: data.AccessKeySecret,
179			SecurityToken: data.SecurityToken,
180			Expiration: data.Expiration,
181			}
182			return
183			}
184
185			func (provider *OAuthCredentialsProvider) tryRefreshOauthToken() (err error) {
186			refreshToken := provider.refreshToken
187			clientId := provider.clientId
188
189			url, err := url.Parse(provider.signInUrl)
190			if err != nil {
191			return
192			}
193
194			req := &httputil.Request{
195			Method: "POST",
196			Protocol: url.Scheme,
197			Host: url.Host,
198			Path: "/v1/token",
199			Headers: map[string]string{},
200			}
201
202			connectTimeout := 5 * time.Second
203			readTimeout := 10 * time.Second
204
205			if provider.httpOptions != nil && provider.httpOptions.ConnectTimeout > 0 {
206			connectTimeout = time.Duration(provider.httpOptions.ConnectTimeout) * time.Millisecond
207			}
208			if provider.httpOptions != nil && provider.httpOptions.ReadTimeout > 0 {
209			readTimeout = time.Duration(provider.httpOptions.ReadTimeout) * time.Millisecond
210			}
211			if provider.httpOptions != nil && provider.httpOptions.Proxy != "" {
212			req.Proxy = provider.httpOptions.Proxy
213			}
214			req.ConnectTimeout = connectTimeout
215			req.ReadTimeout = readTimeout
216
217			bodyForm := make(map[string]string)
218			bodyForm["grant_type"] = "refresh_token"
219			bodyForm["refresh_token"] = refreshToken
220			bodyForm["client_id"] = clientId
221			bodyForm["Timestamp"] = utils.GetTimeInFormatISO8601()
222			req.Form = bodyForm
223
224			req.Headers["Content-Type"] = "application/x-www-form-urlencoded"
225			resp, err := httpDo(req)
226			if err != nil {
227			return
228			}
229			if resp.StatusCode != http.StatusOK {
230			return fmt.Errorf("failed to refresh token, status code: %d", resp.StatusCode)
231			}
232			var tokenResp oauthRefreshTokenResponse
233			err = json.Unmarshal(resp.Body, &tokenResp)
234			if err != nil {
235			err = fmt.Errorf("get refresh token from OAuth failed, json.Unmarshal fail: %s", err.Error())
236			return
237			}
238			if tokenResp.RefreshToken == "" \|\| tokenResp.AccessToken == "" {
239			err = fmt.Errorf("failed to refresh token from OAuth: " + string(resp.Body))
240			return
241			}
242			provider.accessToken = tokenResp.AccessToken
243			provider.refreshToken = tokenResp.RefreshToken
244			provider.accessTokenExpire = time.Now().Unix() + tokenResp.ExpiresIn
245
246			return nil
247			}
248
249			func (provider *OAuthCredentialsProvider) needUpdateCredential() (result bool) {
250			if provider.expirationTimestamp == 0 {
251			return true
252			}
253
254			return provider.expirationTimestamp-time.Now().Unix() <= 180
255			}
256
257			func (provider OAuthCredentialsProvider) GetCredentials() (cc Credentials, err error) {
258			if provider.sessionCredentials == nil \|\| provider.needUpdateCredential() {
259			sessionCredentials, err1 := provider.getCredentials()
260			if err1 != nil {
261			return nil, err1
262			}
263
264			provider.sessionCredentials = sessionCredentials
265			expirationTime, err2 := time.Parse("2006-01-02T15:04:05Z", sessionCredentials.Expiration)
266			if err2 != nil {
267			return nil, err2
268			}
269
270			provider.lastUpdateTimestamp = time.Now().Unix()
271			provider.expirationTimestamp = expirationTime.Unix()
272
273			// 如果设置了回调函数，则调用回调函数写回配置文件
274			if provider.tokenUpdateCallback != nil {
275			err1 := provider.tokenUpdateCallback(provider.refreshToken, provider.accessToken, sessionCredentials.AccessKeyId, sessionCredentials.AccessKeySecret, sessionCredentials.SecurityToken, provider.accessTokenExpire, provider.expirationTimestamp)
276			if err1 != nil {
277			fmt.Printf("Warning: failed to update OAuth tokens in config file: %v\n", err)
278			}
279			}
280			}
281
282			cc = &Credentials{
283			AccessKeyId: provider.sessionCredentials.AccessKeyId,
284			AccessKeySecret: provider.sessionCredentials.AccessKeySecret,
285			SecurityToken: provider.sessionCredentials.SecurityToken,
286			ProviderName: provider.GetProviderName(),
287			}
288			return
289			}
290
291			func (provider *OAuthCredentialsProvider) GetProviderName() string {
292			return "oauth"
293			}
294

aliyun / credentials-go

GitHub Access Token became invalid

Push — master ( fe6920...0b968c )

credentials/providers/oauth.go C

Size/Duplication

Importance

14 Methods

Duplication Side-by-Side

Filter issues like