spiffe / java-spiffe / 80

pending completion

Build # 80

Build Type

Pull #22

travis-ci

Committed by

web-flow

Commit Message

<a href="https://github.com/spiffe/java-spiffe/commit/<a class=hub.com/spiffe/java-spiffe/commit/<a class="double-link" href="https://git"><a class=hub.com/spiffe/java-spiffe/commit/<a class="double-link" href="https://git"><a class=hub.com/spiffe/java-spiffe/commit/<a class="double-link" href="https://git"><a class=hub.com/spiffe/java-spiffe/commit/80a3958806d96f4e28a60c6790a29237f133d7ab">80a395880">&lt;a href=&quot;https://github.com/spiffe/java-spiffe/commit/</a><a class="double-link" href="https://github.com/spiffe/java-spiffe/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/spiffe/java-spiffe/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/spiffe/java-spiffe/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/spiffe/java-spiffe/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/spiffe/java-spiffe/commit/80a3958806d96f4e28a60c6790a29237f133d7ab">80a395880</a><a href="https://github.com/spiffe/java-spiffe/commit/80a3958806d96f4e28a60c6790a29237f133d7ab">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/spiffe/java-spiffe/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/spiffe/java-spiffe/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/spiffe/java-spiffe/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/spiffe/java-spiffe/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/spiffe/java-spiffe/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/spiffe/java-spiffe/commit/80a3958806d96f4e28a60c6790a29237f133d7ab&quot;&gt;80a395880&lt;/a&gt;&lt;a href=&quot;https://github.com/spiffe/java-spiffe/commit/80a3958806d96f4e28a60c6790a29237f133d7ab&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/spiffe/java-spiffe/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/spiffe/java-spiffe/comm... (continued)

Pull Request Pull Request #22: Define and implement v2 interface.

Run Details

1402 of 1402 new or added lines in 38 files covered. (100.0%)

1378 of 1402 relevant lines covered (98.29%)

2.95 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

98.59

/java-spiffe-core/src/main/java/io/spiffe/workloadapi/DefaultJwtSource.java

package io.spiffe.workloadapi;

import io.spiffe.bundle.jwtbundle.JwtBundle;
import io.spiffe.bundle.jwtbundle.JwtBundleSet;
import io.spiffe.bundle.x509bundle.X509Bundle;
import io.spiffe.exception.BundleNotFoundException;
import io.spiffe.exception.JwtSourceException;
import io.spiffe.exception.JwtSvidException;
import io.spiffe.exception.SocketEndpointAddressException;
import io.spiffe.exception.WatcherException;
import io.spiffe.spiffeid.SpiffeId;
import io.spiffe.spiffeid.TrustDomain;
import io.spiffe.svid.jwtsvid.JwtSvid;
import lombok.AccessLevel;
import lombok.Builder;
import lombok.Data;
import lombok.NonNull;
import lombok.Setter;
import lombok.SneakyThrows;
import lombok.extern.java.Log;
import lombok.val;

import java.io.Closeable;
import java.time.Duration;
import java.util.concurrent.CountDownLatch;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.TimeoutException;
import java.util.logging.Level;

import static io.spiffe.workloadapi.internal.ThreadUtils.await;

/**
 * Represents a source of SPIFFE JWT SVIDs and JWT bundles maintained via the Workload API.
 */
@Log
public class DefaultJwtSource implements JwtSource {

    static final String TIMEOUT_SYSTEM_PROPERTY = "spiffe.newJwtSource.timeout";

    static final Duration DEFAULT_TIMEOUT =
            Duration.parse(System.getProperty(TIMEOUT_SYSTEM_PROPERTY, "PT0S"));

    private JwtBundleSet bundles;

    private final WorkloadApiClient workloadApiClient;
    private volatile boolean closed;

    // private constructor
    private DefaultJwtSource(final WorkloadApiClient workloadApiClient) {
        this.workloadApiClient = workloadApiClient;
    }

    /**
     * Creates a new JWT source. It blocks until the initial update with the JWT bundles
     * has been received from the Workload API or until the timeout configured
     * through the system property `spiffe.newJwtSource.timeout` expires.
     * If no timeout is configured, it blocks until it gets a JWT update from the Workload API.
     * <p>
     * It uses the default address socket endpoint from the environment variable to get the Workload API address.
     *
     * @return an instance of {@link DefaultJwtSource}, with the JWT bundles initialized
     * @throws SocketEndpointAddressException if the address to the Workload API is not valid
     * @throws JwtSourceException            if the source could not be initialized
     */
    public static JwtSource newSource() throws JwtSourceException, SocketEndpointAddressException {
        JwtSourceOptions options = JwtSourceOptions.builder().initTimeout(DEFAULT_TIMEOUT).build();
        return newSource(options);
    }

    /**
     * Creates a new JWT source. It blocks until the initial update with the JWT bundles
     * has been received from the Workload API, doing retries with a backoff exponential policy,
     * or until the initTimeout has expired.
     * <p>
     * If the timeout is not provided in the options, the default timeout is read from the
     * system property `spiffe.newJwtSource.timeout`. If none is configured, this method will
     * block until the JWT bundles can be retrieved from the Workload API.
     * <p>
     * The {@link WorkloadApiClient} can be provided in the options, if it is not,
     * a new client is created.
     *
     * @param options {@link JwtSourceOptions}
     * @return an instance of {@link DefaultJwtSource}, with the JWT bundles initialized
     * @throws SocketEndpointAddressException if the address to the Workload API is not valid
     * @throws JwtSourceException if the source could not be initialized
     */
    public static JwtSource newSource(@NonNull final JwtSourceOptions options)
            throws SocketEndpointAddressException, JwtSourceException {
        if (options.workloadApiClient == null) {
            options.workloadApiClient = createClient(options);
        }

        if (options.initTimeout == null) {
            options.initTimeout = DEFAULT_TIMEOUT;
        }

        DefaultJwtSource jwtSource = new DefaultJwtSource(options.workloadApiClient);

        try {
            jwtSource.init(options.initTimeout);
        } catch (Exception e) {
            jwtSource.close();
            throw new JwtSourceException("Error creating JWT source", e);
        }

        return jwtSource;
    }

    @Override
    public JwtSvid fetchJwtSvid(String audience, String... extraAudiences) throws JwtSvidException {
        if (isClosed()) {
            throw new IllegalStateException("JWT SVID source is closed");
        }
        return workloadApiClient.fetchJwtSvid(audience, extraAudiences);
    }

    /**
     * Fetches a new JWT SVID from the Workload API for the given subject SPIFFE ID and audiences.
     *
     * @return a {@link JwtSvid}
     * @throws IllegalStateException if the source is closed
     */
    @Override
    public JwtSvid fetchJwtSvid(final SpiffeId subject, final String audience, final String... extraAudiences)
            throws JwtSvidException {
        if (isClosed()) {
            throw new IllegalStateException("JWT SVID source is closed");
        }

        return workloadApiClient.fetchJwtSvid(subject, audience, extraAudiences);
    }

    /**
     * Returns the JWT bundle for a given trust domain.
     *
     * @return an instance of a {@link X509Bundle}
     *
     * @throws BundleNotFoundException is there is no bundle for the trust domain provided
     * @throws IllegalStateException if the source is closed
     */
    @Override
    public JwtBundle getBundleForTrustDomain(@NonNull final TrustDomain trustDomain) throws BundleNotFoundException {
        if (isClosed()) {
            throw new IllegalStateException("JWT bundle source is closed");
        }
        return bundles.getBundleForTrustDomain(trustDomain);
    }

    /**
     * Closes this source, dropping the connection to the Workload API.
     * Other source methods will return an error after close has been called.
     * <p>
     * It is marked with {@link SneakyThrows} because it is not expected to throw
     * the checked exception defined on the {@link Closeable} interface.
     */
    @SneakyThrows
    @Override
    public void close() {
        if (!closed) {
            synchronized (this) {
                if (!closed) {
                    workloadApiClient.close();
                    closed = true;
                }
            }
        }
    }

    private void init(final Duration timeout) throws TimeoutException {
        CountDownLatch done = new CountDownLatch(1);
        setJwtBundlesWatcher(done);

        boolean success;
        if (timeout.isZero()) {
            await(done);
            success = true;
        } else {
            success = await(done, timeout.getSeconds(), TimeUnit.SECONDS);
        }
        if (!success) {
            throw new TimeoutException("Timeout waiting for JWT bundles update");
        }
    }

    private void setJwtBundlesWatcher(final CountDownLatch done) {
        workloadApiClient.watchJwtBundles(new Watcher<JwtBundleSet>() {
            @Override
            public void onUpdate(final JwtBundleSet update) {
                log.log(Level.INFO, "Received JwtBundleSet update");
                setJwtBundleSet(update);
                done.countDown();
            }

            @Override
            public void onError(final Throwable error) {
                log.log(Level.SEVERE, "Error in JwtBundleSet watcher", error);
                done.countDown();
                throw new WatcherException("Error fetching JwtBundleSet", error);
            }
        });
    }

    private void setJwtBundleSet(final JwtBundleSet update) {
        synchronized (this) {
            this.bundles = update;
        }
    }

    private boolean isClosed() {
        synchronized (this) {
            return closed;
        }
    }

    private static WorkloadApiClient createClient(final JwtSourceOptions options)
            throws SocketEndpointAddressException {
        val clientOptions = DefaultWorkloadApiClient.ClientOptions
                .builder()
                .spiffeSocketPath(options.spiffeSocketPath)
                .build();
        return DefaultWorkloadApiClient.newClient(clientOptions);
    }

    /**
     * Options to configure a {@link DefaultJwtSource}.
     * <p>
     * <code>spiffeSocketPath</code> Address to the Workload API, if it is not set, the default address will be used.
     * <p>
     * <code>initTimeout</code> Timeout for initializing the instance. If it is not defined, the timeout is read
     * from the System property `spiffe.newJwtSource.timeout'. If this is also not defined, no default timeout is applied.
     * <p>
     * <code>workloadApiClient</code> A custom instance of a {@link WorkloadApiClient}, if it is not set,
     * a new client will be created.
     */
    @Data
    public static class JwtSourceOptions {

        @Setter(AccessLevel.NONE)
        private String spiffeSocketPath;

        @Setter(AccessLevel.NONE)
        private Duration initTimeout;

        @Setter(AccessLevel.NONE)
        private WorkloadApiClient workloadApiClient;

        @Builder
        public JwtSourceOptions(
                final String spiffeSocketPath,
                final WorkloadApiClient workloadApiClient,
                final Duration initTimeout) {
            this.spiffeSocketPath = spiffeSocketPath;
            this.workloadApiClient = workloadApiClient;
            this.initTimeout = initTimeout;
        }
    }
}

1	package io.spiffe.workloadapi;
2
3	import io.spiffe.bundle.jwtbundle.JwtBundle;
4	import io.spiffe.bundle.jwtbundle.JwtBundleSet;
5	import io.spiffe.bundle.x509bundle.X509Bundle;
6	import io.spiffe.exception.BundleNotFoundException;
7	import io.spiffe.exception.JwtSourceException;
8	import io.spiffe.exception.JwtSvidException;
9	import io.spiffe.exception.SocketEndpointAddressException;
10	import io.spiffe.exception.WatcherException;
11	import io.spiffe.spiffeid.SpiffeId;
12	import io.spiffe.spiffeid.TrustDomain;
13	import io.spiffe.svid.jwtsvid.JwtSvid;
14	import lombok.AccessLevel;
15	import lombok.Builder;
16	import lombok.Data;
17	import lombok.NonNull;
18	import lombok.Setter;
19	import lombok.SneakyThrows;
20	import lombok.extern.java.Log;
21	import lombok.val;
22
23	import java.io.Closeable;
24	import java.time.Duration;
25	import java.util.concurrent.CountDownLatch;
26	import java.util.concurrent.TimeUnit;
27	import java.util.concurrent.TimeoutException;
28	import java.util.logging.Level;
29
30	import static io.spiffe.workloadapi.internal.ThreadUtils.await;
31
32	/**
33	* Represents a source of SPIFFE JWT SVIDs and JWT bundles maintained via the Workload API.
34	*/
35	@Log	3✔
36	public class DefaultJwtSource implements JwtSource {
37
38	static final String TIMEOUT_SYSTEM_PROPERTY = "spiffe.newJwtSource.timeout";
39
40	static final Duration DEFAULT_TIMEOUT =	3✔
41	Duration.parse(System.getProperty(TIMEOUT_SYSTEM_PROPERTY, "PT0S"));	3✔
42
43	private JwtBundleSet bundles;
44
45	private final WorkloadApiClient workloadApiClient;
46	private volatile boolean closed;
47
48	// private constructor
49	private DefaultJwtSource(final WorkloadApiClient workloadApiClient) {	3✔
50	this.workloadApiClient = workloadApiClient;	3✔
51	}	3✔
52
53	/**
54	* Creates a new JWT source. It blocks until the initial update with the JWT bundles
55	* has been received from the Workload API or until the timeout configured
56	* through the system property `spiffe.newJwtSource.timeout` expires.
57	* If no timeout is configured, it blocks until it gets a JWT update from the Workload API.
58	* <p>
59	* It uses the default address socket endpoint from the environment variable to get the Workload API address.
60	*
61	* @return an instance of {@link DefaultJwtSource}, with the JWT bundles initialized
62	* @throws SocketEndpointAddressException if the address to the Workload API is not valid
63	* @throws JwtSourceException if the source could not be initialized
64	*/
65	public static JwtSource newSource() throws JwtSourceException, SocketEndpointAddressException {
66	JwtSourceOptions options = JwtSourceOptions.builder().initTimeout(DEFAULT_TIMEOUT).build();	3✔
67	return newSource(options);	×
68	}
69
70	/**
71	* Creates a new JWT source. It blocks until the initial update with the JWT bundles
72	* has been received from the Workload API, doing retries with a backoff exponential policy,
73	* or until the initTimeout has expired.
74	* <p>
75	* If the timeout is not provided in the options, the default timeout is read from the
76	* system property `spiffe.newJwtSource.timeout`. If none is configured, this method will
77	* block until the JWT bundles can be retrieved from the Workload API.
78	* <p>
79	* The {@link WorkloadApiClient} can be provided in the options, if it is not,
80	* a new client is created.
81	*
82	* @param options {@link JwtSourceOptions}
83	* @return an instance of {@link DefaultJwtSource}, with the JWT bundles initialized
84	* @throws SocketEndpointAddressException if the address to the Workload API is not valid
85	* @throws JwtSourceException if the source could not be initialized
86	*/
87	public static JwtSource newSource(@NonNull final JwtSourceOptions options)	3✔
88	throws SocketEndpointAddressException, JwtSourceException {
89	if (options.workloadApiClient == null) {	3✔
90	options.workloadApiClient = createClient(options);	3✔
91	}
92
93	if (options.initTimeout == null) {	3✔
94	options.initTimeout = DEFAULT_TIMEOUT;	3✔
95	}
96
97	DefaultJwtSource jwtSource = new DefaultJwtSource(options.workloadApiClient);	3✔
98
99	try {
100	jwtSource.init(options.initTimeout);	3✔
101	} catch (Exception e) {	3✔
102	jwtSource.close();	3✔
103	throw new JwtSourceException("Error creating JWT source", e);	3✔
104	}	3✔
105
106	return jwtSource;	3✔
107	}
108
109	@Override
110	public JwtSvid fetchJwtSvid(String audience, String... extraAudiences) throws JwtSvidException {
111	if (isClosed()) {	3✔
112	throw new IllegalStateException("JWT SVID source is closed");	3✔
113	}
114	return workloadApiClient.fetchJwtSvid(audience, extraAudiences);	3✔
115	}
116
117	/**
118	* Fetches a new JWT SVID from the Workload API for the given subject SPIFFE ID and audiences.
119	*
120	* @return a {@link JwtSvid}
121	* @throws IllegalStateException if the source is closed
122	*/
123	@Override
124	public JwtSvid fetchJwtSvid(final SpiffeId subject, final String audience, final String... extraAudiences)
125	throws JwtSvidException {
126	if (isClosed()) {	3✔
127	throw new IllegalStateException("JWT SVID source is closed");	3✔
128	}
129
130	return workloadApiClient.fetchJwtSvid(subject, audience, extraAudiences);	3✔
131	}
132
133	/**
134	* Returns the JWT bundle for a given trust domain.
135	*
136	* @return an instance of a {@link X509Bundle}
137	*
138	* @throws BundleNotFoundException is there is no bundle for the trust domain provided
139	* @throws IllegalStateException if the source is closed
140	*/
141	@Override
142	public JwtBundle getBundleForTrustDomain(@NonNull final TrustDomain trustDomain) throws BundleNotFoundException {	3✔
143	if (isClosed()) {	3✔
144	throw new IllegalStateException("JWT bundle source is closed");	3✔
145	}
146	return bundles.getBundleForTrustDomain(trustDomain);	3✔
147	}
148
149	/**
150	* Closes this source, dropping the connection to the Workload API.
151	* Other source methods will return an error after close has been called.
152	* <p>
153	* It is marked with {@link SneakyThrows} because it is not expected to throw
154	* the checked exception defined on the {@link Closeable} interface.
155	*/
156	@SneakyThrows	3✔
157	@Override
158	public void close() {
159	if (!closed) {	3✔
160	synchronized (this) {	3✔
161	if (!closed) {	3✔
162	workloadApiClient.close();	3✔
163	closed = true;	3✔
164	}
165	}	3✔
166	}
167	}	3✔
168
169	private void init(final Duration timeout) throws TimeoutException {
170	CountDownLatch done = new CountDownLatch(1);	3✔
171	setJwtBundlesWatcher(done);	3✔
172
173	boolean success;
174	if (timeout.isZero()) {	3✔
175	await(done);	3✔
176	success = true;	3✔
177	} else {
178	success = await(done, timeout.getSeconds(), TimeUnit.SECONDS);	3✔
179	}
180	if (!success) {	3✔
181	throw new TimeoutException("Timeout waiting for JWT bundles update");	3✔
182	}
183	}	3✔
184
185	private void setJwtBundlesWatcher(final CountDownLatch done) {
186	workloadApiClient.watchJwtBundles(new Watcher<JwtBundleSet>() {	3✔
187	@Override
188	public void onUpdate(final JwtBundleSet update) {
189	log.log(Level.INFO, "Received JwtBundleSet update");	3✔
190	setJwtBundleSet(update);	3✔
191	done.countDown();	3✔
192	}	3✔
193
194	@Override
195	public void onError(final Throwable error) {
196	log.log(Level.SEVERE, "Error in JwtBundleSet watcher", error);	3✔
197	done.countDown();	3✔
198	throw new WatcherException("Error fetching JwtBundleSet", error);	3✔
199	}
200	});
201	}	3✔
202
203	private void setJwtBundleSet(final JwtBundleSet update) {
204	synchronized (this) {	3✔
205	this.bundles = update;	3✔
206	}	3✔
207	}	3✔
208
209	private boolean isClosed() {
210	synchronized (this) {	3✔
211	return closed;	3✔
212	}
213	}
214
215	private static WorkloadApiClient createClient(final JwtSourceOptions options)
216	throws SocketEndpointAddressException {
217	val clientOptions = DefaultWorkloadApiClient.ClientOptions
218	.builder()	3✔
219	.spiffeSocketPath(options.spiffeSocketPath)	3✔
220	.build();	3✔
221	return DefaultWorkloadApiClient.newClient(clientOptions);	3✔
222	}
223
224	/**
225	* Options to configure a {@link DefaultJwtSource}.
226	* <p>
227	* <code>spiffeSocketPath</code> Address to the Workload API, if it is not set, the default address will be used.
228	* <p>
229	* <code>initTimeout</code> Timeout for initializing the instance. If it is not defined, the timeout is read
230	* from the System property `spiffe.newJwtSource.timeout'. If this is also not defined, no default timeout is applied.
231	* <p>
232	* <code>workloadApiClient</code> A custom instance of a {@link WorkloadApiClient}, if it is not set,
233	* a new client will be created.
234	*/
235	@Data
236	public static class JwtSourceOptions {
237
238	@Setter(AccessLevel.NONE)
239	private String spiffeSocketPath;
240
241	@Setter(AccessLevel.NONE)
242	private Duration initTimeout;
243
244	@Setter(AccessLevel.NONE)
245	private WorkloadApiClient workloadApiClient;
246
247	@Builder
248	public JwtSourceOptions(
249	final String spiffeSocketPath,
250	final WorkloadApiClient workloadApiClient,
251	final Duration initTimeout) {	3✔
252	this.spiffeSocketPath = spiffeSocketPath;	3✔
253	this.workloadApiClient = workloadApiClient;	3✔
254	this.initTimeout = initTimeout;	3✔
255	}	3✔
256	}
257	}

spiffe / java-spiffe / 80

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous