spiffe / java-spiffe / 76

pending completion

Build # 76

Build Type

Pull #22

travis-ci

Committed by

web-flow

Commit Message

<a href="https://github.com/spiffe/java-spiffe/commit/<a class=hub.com/spiffe/java-spiffe/commit/3850a72f7e25160f4f25bec1666befd52afc11b7">3850a72f7<a href="https://github.com/spiffe/java-spiffe/commit/3850a72f7e25160f4f25bec1666befd52afc11b7">">Merge </a><a class="double-link" href="https://github.com/spiffe/java-spiffe/commit/<a class="double-link" href="https://github.com/spiffe/java-spiffe/commit/0c542c198c5b59810ecebcc9441443d6703b3b57">0c542c198</a>">0c542c198</a><a href="https://github.com/spiffe/java-spiffe/commit/3850a72f7e25160f4f25bec1666befd52afc11b7"> into 8c3866ee8">8c3866ee8</a>

Pull Request Pull Request #22: Define and implement v2 interface.

Run Details

1222 of 1222 new or added lines in 27 files covered. (100.0%)

1187 of 1222 relevant lines covered (97.14%)

2.91 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

98.59

/java-spiffe-core/src/main/java/io/spiffe/workloadapi/JwtSource.java

package io.spiffe.workloadapi;

import io.spiffe.bundle.BundleSource;
import io.spiffe.bundle.jwtbundle.JwtBundle;
import io.spiffe.bundle.jwtbundle.JwtBundleSet;
import io.spiffe.bundle.x509bundle.X509Bundle;
import io.spiffe.exception.BundleNotFoundException;
import io.spiffe.exception.JwtSourceException;
import io.spiffe.exception.JwtSvidException;
import io.spiffe.exception.SocketEndpointAddressException;
import io.spiffe.exception.WatcherException;
import io.spiffe.spiffeid.SpiffeId;
import io.spiffe.spiffeid.TrustDomain;
import io.spiffe.svid.jwtsvid.JwtSvid;
import io.spiffe.svid.jwtsvid.JwtSvidSource;
import lombok.AccessLevel;
import lombok.Builder;
import lombok.Data;
import lombok.NonNull;
import lombok.Setter;
import lombok.SneakyThrows;
import lombok.extern.java.Log;
import lombok.val;

import java.io.Closeable;
import java.time.Duration;
import java.util.concurrent.CountDownLatch;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.TimeoutException;
import java.util.logging.Level;

import static io.spiffe.workloadapi.internal.ThreadUtils.await;

/**
 * Represents a source of SPIFFE JWT SVIDs and JWT bundles maintained via the Workload API.
 */
@Log
public class JwtSource implements JwtSvidSource, BundleSource<JwtBundle>, Closeable {

    static final String TIMEOUT_SYSTEM_PROPERTY = "spiffe.newJwtSource.timeout";

    static final Duration DEFAULT_TIMEOUT =
            Duration.parse(System.getProperty(TIMEOUT_SYSTEM_PROPERTY, "PT0S"));

    private JwtBundleSet bundles;

    private final WorkloadApiClient workloadApiClient;
    private volatile boolean closed;

    // private constructor
    private JwtSource(final WorkloadApiClient workloadApiClient) {
        this.workloadApiClient = workloadApiClient;
    }

    /**
     * Creates a new JWT source. It blocks until the initial update with the JWT bundles
     * has been received from the Workload API or until the timeout configured
     * through the system property `spiffe.newJwtSource.timeout` expires.
     * If no timeout is configured, it blocks until it gets a JWT update from the Workload API.
     * <p>
     * It uses the default address socket endpoint from the environment variable to get the Workload API address.
     *
     * @return an instance of {@link JwtSource}, with the JWT bundles initialized
     * @throws SocketEndpointAddressException if the address to the Workload API is not valid
     * @throws JwtSourceException            if the source could not be initialized
     */
    public static JwtSource newSource() throws JwtSourceException, SocketEndpointAddressException {
        JwtSourceOptions options = JwtSourceOptions.builder().initTimeout(DEFAULT_TIMEOUT).build();
        return newSource(options);
    }

    /**
     * Creates a new JWT source. It blocks until the initial update with the JWT bundles
     * has been received from the Workload API, doing retries with a backoff exponential policy,
     * or until the initTimeout has expired.
     * <p>
     * If the timeout is not provided in the options, the default timeout is read from the
     * system property `spiffe.newJwtSource.timeout`. If none is configured, this method will
     * block until the JWT bundles can be retrieved from the Workload API.
     * <p>
     * The {@link WorkloadApiClient} can be provided in the options, if it is not,
     * a new client is created.
     *
     * @param options {@link JwtSourceOptions}
     * @return an instance of {@link JwtSource}, with the JWT bundles initialized
     * @throws SocketEndpointAddressException if the address to the Workload API is not valid
     * @throws JwtSourceException if the source could not be initialized
     */
    public static JwtSource newSource(@NonNull final JwtSourceOptions options)
            throws SocketEndpointAddressException, JwtSourceException {
        if (options.workloadApiClient == null) {
            options.workloadApiClient = createClient(options);
        }

        if (options.initTimeout == null) {
            options.initTimeout = DEFAULT_TIMEOUT;
        }

        JwtSource jwtSource = new JwtSource(options.workloadApiClient);

        try {
            jwtSource.init(options.initTimeout);
        } catch (Exception e) {
            jwtSource.close();
            throw new JwtSourceException("Error creating JWT source", e);
        }

        return jwtSource;
    }

    @Override
    public JwtSvid fetchJwtSvid(String audience, String... extraAudiences) throws JwtSvidException {
        if (isClosed()) {
            throw new IllegalStateException("JWT SVID source is closed");
        }
        return workloadApiClient.fetchJwtSvid(audience, extraAudiences);
    }

    /**
     * Fetches a new JWT SVID from the Workload API for the given subject SPIFFE ID and audiences.
     *
     * @return a {@link JwtSvid}
     * @throws IllegalStateException if the source is closed
     */
    @Override
    public JwtSvid fetchJwtSvid(final SpiffeId subject, final String audience, final String... extraAudiences)
            throws JwtSvidException {
        if (isClosed()) {
            throw new IllegalStateException("JWT SVID source is closed");
        }

        return workloadApiClient.fetchJwtSvid(subject, audience, extraAudiences);
    }

    /**
     * Returns the JWT bundle for a given trust domain.
     *
     * @return an instance of a {@link X509Bundle}
     *
     * @throws BundleNotFoundException is there is no bundle for the trust domain provided
     * @throws IllegalStateException if the source is closed
     */
    @Override
    public JwtBundle getBundleForTrustDomain(@NonNull final TrustDomain trustDomain) throws BundleNotFoundException {
        if (isClosed()) {
            throw new IllegalStateException("JWT bundle source is closed");
        }
        return bundles.getBundleForTrustDomain(trustDomain);
    }

    /**
     * Closes this source, dropping the connection to the Workload API.
     * Other source methods will return an error after close has been called.
     * <p>
     * It is marked with {@link SneakyThrows} because it is not expected to throw
     * the checked exception defined on the {@link Closeable} interface.
     */
    @SneakyThrows
    @Override
    public void close() {
        if (!closed) {
            synchronized (this) {
                if (!closed) {
                    workloadApiClient.close();
                    closed = true;
                }
            }
        }
    }

    private void init(final Duration timeout) throws TimeoutException {
        CountDownLatch done = new CountDownLatch(1);
        setJwtBundlesWatcher(done);

        boolean success;
        if (timeout.isZero()) {
            await(done);
            success = true;
        } else {
            success = await(done, timeout.getSeconds(), TimeUnit.SECONDS);
        }
        if (!success) {
            throw new TimeoutException("Timeout waiting for JWT bundles update");
        }
    }

    private void setJwtBundlesWatcher(final CountDownLatch done) {
        workloadApiClient.watchJwtBundles(new Watcher<JwtBundleSet>() {
            @Override
            public void onUpdate(final JwtBundleSet update) {
                log.log(Level.INFO, "Received JwtBundleSet update");
                setJwtBundleSet(update);
                done.countDown();
            }

            @Override
            public void onError(final Throwable error) {
                log.log(Level.SEVERE, "Error in JwtBundleSet watcher", error);
                done.countDown();
                throw new WatcherException("Error fetching JwtBundleSet", error);
            }
        });
    }

    private void setJwtBundleSet(final JwtBundleSet update) {
        synchronized (this) {
            this.bundles = update;
        }
    }

    private boolean isClosed() {
        synchronized (this) {
            return closed;
        }
    }

    private static WorkloadApiClient createClient(final JwtSourceOptions options)
            throws SocketEndpointAddressException {
        val clientOptions = DefaultWorkloadApiClient.ClientOptions
                .builder()
                .spiffeSocketPath(options.spiffeSocketPath)
                .build();
        return DefaultWorkloadApiClient.newClient(clientOptions);
    }

    /**
     * Options to configure a {@link JwtSource}.
     * <p>
     * <code>spiffeSocketPath</code> Address to the Workload API, if it is not set, the default address will be used.
     * <p>
     * <code>initTimeout</code> Timeout for initializing the instance. If it is not defined, the timeout is read
     * from the System property `spiffe.newJwtSource.timeout'. If this is also not defined, no default timeout is applied.
     * <p>
     * <code>workloadApiClient</code> A custom instance of a {@link WorkloadApiClient}, if it is not set,
     * a new client will be created.
     */
    @Data
    public static class JwtSourceOptions {

        @Setter(AccessLevel.NONE)
        private String spiffeSocketPath;

        @Setter(AccessLevel.NONE)
        private Duration initTimeout;

        @Setter(AccessLevel.NONE)
        private WorkloadApiClient workloadApiClient;

        @Builder
        public JwtSourceOptions(
                final String spiffeSocketPath,
                final WorkloadApiClient workloadApiClient,
                final Duration initTimeout) {
            this.spiffeSocketPath = spiffeSocketPath;
            this.workloadApiClient = workloadApiClient;
            this.initTimeout = initTimeout;
        }
    }
}

1	package io.spiffe.workloadapi;
2
3	import io.spiffe.bundle.BundleSource;
4	import io.spiffe.bundle.jwtbundle.JwtBundle;
5	import io.spiffe.bundle.jwtbundle.JwtBundleSet;
6	import io.spiffe.bundle.x509bundle.X509Bundle;
7	import io.spiffe.exception.BundleNotFoundException;
8	import io.spiffe.exception.JwtSourceException;
9	import io.spiffe.exception.JwtSvidException;
10	import io.spiffe.exception.SocketEndpointAddressException;
11	import io.spiffe.exception.WatcherException;
12	import io.spiffe.spiffeid.SpiffeId;
13	import io.spiffe.spiffeid.TrustDomain;
14	import io.spiffe.svid.jwtsvid.JwtSvid;
15	import io.spiffe.svid.jwtsvid.JwtSvidSource;
16	import lombok.AccessLevel;
17	import lombok.Builder;
18	import lombok.Data;
19	import lombok.NonNull;
20	import lombok.Setter;
21	import lombok.SneakyThrows;
22	import lombok.extern.java.Log;
23	import lombok.val;
24
25	import java.io.Closeable;
26	import java.time.Duration;
27	import java.util.concurrent.CountDownLatch;
28	import java.util.concurrent.TimeUnit;
29	import java.util.concurrent.TimeoutException;
30	import java.util.logging.Level;
31
32	import static io.spiffe.workloadapi.internal.ThreadUtils.await;
33
34	/**
35	* Represents a source of SPIFFE JWT SVIDs and JWT bundles maintained via the Workload API.
36	*/
37	@Log	3✔
38	public class JwtSource implements JwtSvidSource, BundleSource<JwtBundle>, Closeable {
39
40	static final String TIMEOUT_SYSTEM_PROPERTY = "spiffe.newJwtSource.timeout";
41
42	static final Duration DEFAULT_TIMEOUT =	3✔
43	Duration.parse(System.getProperty(TIMEOUT_SYSTEM_PROPERTY, "PT0S"));	3✔
44
45	private JwtBundleSet bundles;
46
47	private final WorkloadApiClient workloadApiClient;
48	private volatile boolean closed;
49
50	// private constructor
51	private JwtSource(final WorkloadApiClient workloadApiClient) {	3✔
52	this.workloadApiClient = workloadApiClient;	3✔
53	}	3✔
54
55	/**
56	* Creates a new JWT source. It blocks until the initial update with the JWT bundles
57	* has been received from the Workload API or until the timeout configured
58	* through the system property `spiffe.newJwtSource.timeout` expires.
59	* If no timeout is configured, it blocks until it gets a JWT update from the Workload API.
60	* <p>
61	* It uses the default address socket endpoint from the environment variable to get the Workload API address.
62	*
63	* @return an instance of {@link JwtSource}, with the JWT bundles initialized
64	* @throws SocketEndpointAddressException if the address to the Workload API is not valid
65	* @throws JwtSourceException if the source could not be initialized
66	*/
67	public static JwtSource newSource() throws JwtSourceException, SocketEndpointAddressException {
68	JwtSourceOptions options = JwtSourceOptions.builder().initTimeout(DEFAULT_TIMEOUT).build();	3✔
69	return newSource(options);	×
70	}
71
72	/**
73	* Creates a new JWT source. It blocks until the initial update with the JWT bundles
74	* has been received from the Workload API, doing retries with a backoff exponential policy,
75	* or until the initTimeout has expired.
76	* <p>
77	* If the timeout is not provided in the options, the default timeout is read from the
78	* system property `spiffe.newJwtSource.timeout`. If none is configured, this method will
79	* block until the JWT bundles can be retrieved from the Workload API.
80	* <p>
81	* The {@link WorkloadApiClient} can be provided in the options, if it is not,
82	* a new client is created.
83	*
84	* @param options {@link JwtSourceOptions}
85	* @return an instance of {@link JwtSource}, with the JWT bundles initialized
86	* @throws SocketEndpointAddressException if the address to the Workload API is not valid
87	* @throws JwtSourceException if the source could not be initialized
88	*/
89	public static JwtSource newSource(@NonNull final JwtSourceOptions options)	3✔
90	throws SocketEndpointAddressException, JwtSourceException {
91	if (options.workloadApiClient == null) {	3✔
92	options.workloadApiClient = createClient(options);	3✔
93	}
94
95	if (options.initTimeout == null) {	3✔
96	options.initTimeout = DEFAULT_TIMEOUT;	3✔
97	}
98
99	JwtSource jwtSource = new JwtSource(options.workloadApiClient);	3✔
100
101	try {
102	jwtSource.init(options.initTimeout);	3✔
103	} catch (Exception e) {	3✔
104	jwtSource.close();	3✔
105	throw new JwtSourceException("Error creating JWT source", e);	3✔
106	}	3✔
107
108	return jwtSource;	3✔
109	}
110
111	@Override
112	public JwtSvid fetchJwtSvid(String audience, String... extraAudiences) throws JwtSvidException {
113	if (isClosed()) {	3✔
114	throw new IllegalStateException("JWT SVID source is closed");	3✔
115	}
116	return workloadApiClient.fetchJwtSvid(audience, extraAudiences);	3✔
117	}
118
119	/**
120	* Fetches a new JWT SVID from the Workload API for the given subject SPIFFE ID and audiences.
121	*
122	* @return a {@link JwtSvid}
123	* @throws IllegalStateException if the source is closed
124	*/
125	@Override
126	public JwtSvid fetchJwtSvid(final SpiffeId subject, final String audience, final String... extraAudiences)
127	throws JwtSvidException {
128	if (isClosed()) {	3✔
129	throw new IllegalStateException("JWT SVID source is closed");	3✔
130	}
131
132	return workloadApiClient.fetchJwtSvid(subject, audience, extraAudiences);	3✔
133	}
134
135	/**
136	* Returns the JWT bundle for a given trust domain.
137	*
138	* @return an instance of a {@link X509Bundle}
139	*
140	* @throws BundleNotFoundException is there is no bundle for the trust domain provided
141	* @throws IllegalStateException if the source is closed
142	*/
143	@Override
144	public JwtBundle getBundleForTrustDomain(@NonNull final TrustDomain trustDomain) throws BundleNotFoundException {	3✔
145	if (isClosed()) {	3✔
146	throw new IllegalStateException("JWT bundle source is closed");	3✔
147	}
148	return bundles.getBundleForTrustDomain(trustDomain);	3✔
149	}
150
151	/**
152	* Closes this source, dropping the connection to the Workload API.
153	* Other source methods will return an error after close has been called.
154	* <p>
155	* It is marked with {@link SneakyThrows} because it is not expected to throw
156	* the checked exception defined on the {@link Closeable} interface.
157	*/
158	@SneakyThrows	3✔
159	@Override
160	public void close() {
161	if (!closed) {	3✔
162	synchronized (this) {	3✔
163	if (!closed) {	3✔
164	workloadApiClient.close();	3✔
165	closed = true;	3✔
166	}
167	}	3✔
168	}
169	}	3✔
170
171	private void init(final Duration timeout) throws TimeoutException {
172	CountDownLatch done = new CountDownLatch(1);	3✔
173	setJwtBundlesWatcher(done);	3✔
174
175	boolean success;
176	if (timeout.isZero()) {	3✔
177	await(done);	3✔
178	success = true;	3✔
179	} else {
180	success = await(done, timeout.getSeconds(), TimeUnit.SECONDS);	3✔
181	}
182	if (!success) {	3✔
183	throw new TimeoutException("Timeout waiting for JWT bundles update");	3✔
184	}
185	}	3✔
186
187	private void setJwtBundlesWatcher(final CountDownLatch done) {
188	workloadApiClient.watchJwtBundles(new Watcher<JwtBundleSet>() {	3✔
189	@Override
190	public void onUpdate(final JwtBundleSet update) {
191	log.log(Level.INFO, "Received JwtBundleSet update");	3✔
192	setJwtBundleSet(update);	3✔
193	done.countDown();	3✔
194	}	3✔
195
196	@Override
197	public void onError(final Throwable error) {
198	log.log(Level.SEVERE, "Error in JwtBundleSet watcher", error);	3✔
199	done.countDown();	3✔
200	throw new WatcherException("Error fetching JwtBundleSet", error);	3✔
201	}
202	});
203	}	3✔
204
205	private void setJwtBundleSet(final JwtBundleSet update) {
206	synchronized (this) {	3✔
207	this.bundles = update;	3✔
208	}	3✔
209	}	3✔
210
211	private boolean isClosed() {
212	synchronized (this) {	3✔
213	return closed;	3✔
214	}
215	}
216
217	private static WorkloadApiClient createClient(final JwtSourceOptions options)
218	throws SocketEndpointAddressException {
219	val clientOptions = DefaultWorkloadApiClient.ClientOptions
220	.builder()	3✔
221	.spiffeSocketPath(options.spiffeSocketPath)	3✔
222	.build();	3✔
223	return DefaultWorkloadApiClient.newClient(clientOptions);	3✔
224	}
225
226	/**
227	* Options to configure a {@link JwtSource}.
228	* <p>
229	* <code>spiffeSocketPath</code> Address to the Workload API, if it is not set, the default address will be used.
230	* <p>
231	* <code>initTimeout</code> Timeout for initializing the instance. If it is not defined, the timeout is read
232	* from the System property `spiffe.newJwtSource.timeout'. If this is also not defined, no default timeout is applied.
233	* <p>
234	* <code>workloadApiClient</code> A custom instance of a {@link WorkloadApiClient}, if it is not set,
235	* a new client will be created.
236	*/
237	@Data
238	public static class JwtSourceOptions {
239
240	@Setter(AccessLevel.NONE)
241	private String spiffeSocketPath;
242
243	@Setter(AccessLevel.NONE)
244	private Duration initTimeout;
245
246	@Setter(AccessLevel.NONE)
247	private WorkloadApiClient workloadApiClient;
248
249	@Builder
250	public JwtSourceOptions(
251	final String spiffeSocketPath,
252	final WorkloadApiClient workloadApiClient,
253	final Duration initTimeout) {	3✔
254	this.spiffeSocketPath = spiffeSocketPath;	3✔
255	this.workloadApiClient = workloadApiClient;	3✔
256	this.initTimeout = initTimeout;	3✔
257	}	3✔
258	}
259	}

spiffe / java-spiffe / 76

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous