feat!: Vela OIDC provider

api/admin/rotate_keys.go

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package admin
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/sirupsen/logrus"
+
+	"github.com/go-vela/server/database"
+	"github.com/go-vela/server/util"
+)
+
+// swagger:operation POST /api/v1/admin/rotate_oidc_keys admin AdminRotateOIDCKeys
+//
+// Rotate RSA Keys
+//
+// ---
+// produces:
+// - application/json
+// parameters:
+// security:
+//   - ApiKeyAuth: []
+// responses:
+//   '200':
+//     description: Successfully rotated OIDC provider keys
+//     schema:
+//     type: string
+//   '500':
+//     description: Error unable to rotate OIDC provider keys
+//     schema:
+//       "$ref": "#/definitions/Error"
+
+// RotateOIDCKeys represents the API handler to
+// rotate RSA keys in OIDC provider service.
+func RotateOIDCKeys(c *gin.Context) {
+	logrus.Info("Admin: rotating keys for OIDC provider")
+
+	// capture middleware values
+	ctx := c.Request.Context()
+
+	err := database.FromContext(c).RotateKeys(ctx)
+	if err != nil {
+		retErr := fmt.Errorf("unable to rotate keys: %w", err)
+		util.HandleError(c, http.StatusInternalServerError, retErr)
+
+		return
+	}
+
+	c.JSON(http.StatusOK, "keys rotated successfully")
+}

api/build/id_request_token.go

@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package build
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/sirupsen/logrus"
+
+	"github.com/go-vela/server/constants"
+	"github.com/go-vela/server/internal/token"
+	"github.com/go-vela/server/router/middleware/build"
+	"github.com/go-vela/server/router/middleware/claims"
+	"github.com/go-vela/server/router/middleware/org"
+	"github.com/go-vela/server/router/middleware/repo"
+	"github.com/go-vela/server/util"
+	"github.com/go-vela/types/library"
+)
+
+// swagger:operation GET /api/v1/repos/{org}/{repo}/builds/{build}/id_request_token builds GetIDRequestToken
+//
+// Get a Vela OIDC request token associated with a build
+//
+// ---
+// produces:
+// - application/json
+// parameters:
+// - in: path
+//   name: repo
+//   description: Name of the repo
+//   required: true
+//   type: string
+// - in: path
+//   name: org
+//   description: Name of the org
+//   required: true
+//   type: string
+// - in: path
+//   name: build
+//   description: Build number
+//   required: true
+//   type: integer
+// - in: query
+//   name: image
+//   description: Add image to token claims
+//   type: string
+// - in: query
+//   name: request
+//   description: Add request input to token claims
+//   type: string
+// security:
+//   - ApiKeyAuth: []
+// responses:
+//   '200':
+//     description: Successfully retrieved ID Request token
+//     schema:
+//       "$ref": "#/definitions/Token"
+//   '400':
+//     description: Bad request
+//     schema:
+//       "$ref": "#/definitions/Error"
+//   '500':
+//     description: Unable to generate ID request token
+//     schema:
+//       "$ref": "#/definitions/Error"
+
+// GetIDRequestToken represents the API handler to generate and return an ID request token.
+func GetIDRequestToken(c *gin.Context) {
+	// capture middleware values
+	b := build.Retrieve(c)
+	o := org.Retrieve(c)
+	r := repo.Retrieve(c)
+	cl := claims.Retrieve(c)
+
+	// update engine logger with API metadata
+	//
+	// https://pkg.go.dev/github.com/sirupsen/logrus?tab=doc#Entry.WithFields
+	logrus.WithFields(logrus.Fields{
+		"build": b.GetNumber(),
+		"org":   o,
+		"repo":  r.GetName(),
+		"user":  cl.Subject,
+	}).Infof("generating ID request token for build %s/%d", r.GetFullName(), b.GetNumber())
+
+	image := c.Query("image")
+	request := c.Query("request")
+	commands, _ := strconv.ParseBool(c.Query("commands"))
+
+	// retrieve token manager from context
+	tm := c.MustGet("token-manager").(*token.Manager)
+
+	exp := (time.Duration(r.GetTimeout()) * time.Minute) + tm.BuildTokenBufferDuration
+
+	// set mint token options
+	idmto := &token.MintTokenOpts{
+		Build:         b,
+		Repo:          r.GetFullName(),
+		TokenType:     constants.IDRequestTokenType,
+		TokenDuration: exp,
+		Image:         image,
+		Request:       request,
+		Commands:      commands,
+	}
+
+	// mint token
+	bt, err := tm.MintToken(idmto)
+	if err != nil {
+		retErr := fmt.Errorf("unable to generate ID request token: %w", err)
+		util.HandleError(c, http.StatusInternalServerError, retErr)
+
+		return
+	}
+
+	c.JSON(http.StatusOK, library.Token{Token: &bt})
+}

api/build/id_token.go

@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package build
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/sirupsen/logrus"
+
+	"github.com/go-vela/server/constants"
+	"github.com/go-vela/server/database"
+	"github.com/go-vela/server/internal/token"
+	"github.com/go-vela/server/router/middleware/build"
+	"github.com/go-vela/server/router/middleware/claims"
+	"github.com/go-vela/server/router/middleware/org"
+	"github.com/go-vela/server/router/middleware/repo"
+	"github.com/go-vela/server/util"
+	"github.com/go-vela/types/library"
+)
+
+// swagger:operation GET /api/v1/repos/{org}/{repo}/builds/{build}/id_token builds GetIDToken
+//
+// Get a Vela OIDC token associated with a build
+//
+// ---
+// produces:
+// - application/json
+// parameters:
+// - in: path
+//   name: repo
+//   description: Name of the repo
+//   required: true
+//   type: string
+// - in: path
+//   name: org
+//   description: Name of the org
+//   required: true
+//   type: string
+// - in: path
+//   name: build
+//   description: Build number
+//   required: true
+//   type: integer
+// security:
+//   - ApiKeyAuth: []
+// responses:
+//   '200':
+//     description: Successfully retrieved ID token
+//     schema:
+//       "$ref": "#/definitions/Token"
+//   '400':
+//     description: Bad request
+//     schema:
+//       "$ref": "#/definitions/Error"
+//   '500':
+//     description: Unable to generate id token
+//     schema:
+//       "$ref": "#/definitions/Error"
+
+// GetIDToken represents the API handler to generate a id token.
+func GetIDToken(c *gin.Context) {
+	// capture middleware values
+	b := build.Retrieve(c)
+	o := org.Retrieve(c)
+	r := repo.Retrieve(c)
+	cl := claims.Retrieve(c)
+
+	// update engine logger with API metadata
+	//
+	// https://pkg.go.dev/github.com/sirupsen/logrus?tab=doc#Entry.WithFields
+	logrus.WithFields(logrus.Fields{
+		"build": b.GetNumber(),
+		"org":   o,
+		"repo":  r.GetName(),
+		"user":  cl.Subject,
+	}).Infof("generating ID token for build %s/%d", r.GetFullName(), b.GetNumber())
+
+	// retrieve token manager from context
+	tm := c.MustGet("token-manager").(*token.Manager)
+
+	// set mint token options
+	idmto := &token.MintTokenOpts{
+		Build:         b,
+		Repo:          r.GetFullName(),
+		TokenType:     constants.IDTokenType,
+		TokenDuration: tm.IDTokenDuration,
+		Image:         cl.Image,
+		Request:       cl.Request,
+		Commands:      cl.Commands,
+	}
+
+	// if audience is provided, include that in claims
+	if len(c.QueryArray("audience")) > 0 {
+		idmto.Audience = c.QueryArray("audience")
+	}
+
+	// mint token
+	bt, err := tm.MintIDToken(idmto, database.FromContext(c))
+	if err != nil {
+		retErr := fmt.Errorf("unable to generate build token: %w", err)
+		util.HandleError(c, http.StatusInternalServerError, retErr)
+
+		return
+	}
+
+	c.JSON(http.StatusOK, library.Token{Token: &bt})
+}

api/build/token.go

@@ -99,7 +99,7 @@ func GetBuildToken(c *gin.Context) {
 	// set mint token options
 	bmto := &token.MintTokenOpts{
 		Hostname:      cl.Subject,
-		BuildID:       b.GetID(),
+		Build:         b,
 		Repo:          r.GetFullName(),
 		TokenType:     constants.WorkerBuildTokenType,
 		TokenDuration: exp,

api/jwks.go

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package api
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/go-vela/server/database"
+	"github.com/go-vela/server/util"
+)
+
+// swagger:operation GET /_services/token/.well-known/jwks token GetJWKS
+//
+// Get the JWKS for the Vela OIDC service
+//
+// ---
+// produces:
+// - application/json
+// parameters:
+// security:
+//   - ApiKeyAuth: []
+// responses:
+//   '200':
+//     description: Successfully retrieved the Vela JWKS
+//     schema:
+//       "$ref": "#/definitions/JWKSet"
+
+// GetJWKS represents the API handler for requests to public keys in the Vela OpenID service.
+func GetJWKS(c *gin.Context) {
+	// retrieve JWKs from the database
+	keys, err := database.FromContext(c).ListJWKs(c)
+	if err != nil {
+		retErr := fmt.Errorf("unable to get key set: %w", err)
+		util.HandleError(c, http.StatusInternalServerError, retErr)
+
+		return
+	}
+
+	c.JSON(http.StatusOK, keys)
+}

api/oi_config.go

@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: Apache-2.0
+
+package api
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+
+	"github.com/go-vela/server/api/types"
+	"github.com/go-vela/server/internal"
+)
+
+// swagger:operation GET /_services/token/.well-known/openid-configuration token GetOpenIDConfig
+//
+// Get the OpenID configuration for the Vela OIDC service
+//
+// ---
+// produces:
+// - application/json
+// parameters:
+// security:
+//   - ApiKeyAuth: []
+// responses:
+//   '200':
+//     description: Successfully retrieved the Vela OpenID Configuration
+//     schema:
+//       "$ref": "#/definitions/OpenIDConfig"
+
+// GetOpenIDConfig represents the API handler for requests for configurations in the Vela OpenID service.
+func GetOpenIDConfig(c *gin.Context) {
+	m := c.MustGet("metadata").(*internal.Metadata)
+
+	config := types.OpenIDConfig{
+		Issuer:      fmt.Sprintf("%s/_services/token", m.Vela.Address),
+		JWKSAddress: fmt.Sprintf("%s/%s", m.Vela.Address, "_services/token/.well-known/jwks"),
+		SupportedClaims: []string{
+			"sub",
+			"exp",
+			"iat",
+			"iss",
+			"aud",
+			"build_number",
+			"repo",
+			"token_type",
+			"actor",
+			"commands",
+			"image",
+			"request",
+		},
+		Algorithms: []string{
+			jwt.SigningMethodRS256.Name,
+		},
+	}
+
+	c.JSON(http.StatusOK, config)
+}