m-lab / ndt7-client-go / 21152091587

71%

Build Type

push

github

Committed by web-flow

Commit Message

feat(cmd/ndt7-client): add client-integration token support (#107)

This commit implements client-integration registration support in
the ndt7 Go client command, completing the Go-side component of the
client-integration registration system.

The following design is being implemented (from token-exchange
https://github.com/m-lab/token-exchange/pull/7):

1. Organizations maintaining client integrations register with the system
and obtain API keys

2. The organization provisions a backend that stores its API keys

3. The backend receives queries from clients when they initiate a test

4. The backend queries m-lab/token-exchange to exchange an API key for
a short-lived JWT

5. The backend returns the JWT to the client

6. The client queries m-lab/locate, including the JWT via the Authorization
header

7. m-lab/locate uses the JWT to route the client and perform accounting/access
control

8. The JWT is included in URLs to m-lab/ndt-server for access control

This commit implements step 6, adding a new optional flag `-locate.token
<token>` that enables registered integrators to provide a JWT obtained
from their backend.

**BYOT (Bring Your Own Token) Design**

The library follows a "bring your own token" model where integrators
are responsible for token acquisition (steps 3-5) and ndt7-client-go
is responsible only for token usage (step 6). This maintains separation
of concerns: integrators control their own authentication and security
posture, while the measurement library focuses on network testing.

When `-locate.token <token>` is provided:

- The client uses the priority endpoint `/v2/priority/nearest` instead
of `/v2/nearest`, enabling registered integrations to receive higher
rate limits and priority server selection. If `-locate.url <url>` was
explicitly provided, the URL path is not modified (on the assumption
that the user wants full control -- see discussion below)

- The token is included as an `Authorization: Bearer <token>` header in
requests ... (continued)

Coverage Stats

42 of 0 new or added lines in 0 files covered. (NaN%)

8 existing lines in 1 file now uncovered.

701 of 982 relevant lines covered (71.38%)

16548.65 hits per line