feat: allow audiences for justification (#123)

Co-authored-by: Seth Vargo <seth@sethvargo.com>
abcxyz · Sep 23, 2022 · d8ace26 · d8ace26
1 parent df4a6ee
commit d8ace26
Show file tree

Hide file tree

Showing 7 changed files with 79 additions and 28 deletions.
diff --git a/apis/v0/jvs_request.pb.go b/apis/v0/jvs_request.pb.go
diff --git a/pkg/cli/token.go b/pkg/cli/token.go
@@ -32,6 +32,7 @@ import (
 
 	jvspb "github.com/abcxyz/jvs/apis/v0"
 	"github.com/abcxyz/jvs/pkg/idtoken"
+	"github.com/abcxyz/jvs/pkg/justification"
 )
 
 const (
@@ -152,7 +153,7 @@ func breakglassToken(ctx context.Context, nowUnix int64) (string, error) {
 	exp := now.Add(flagTTL)
 
 	token, err := jwt.NewBuilder().
-		Audience([]string{"TODO #22"}).
+		Audience([]string{justification.DefaultAudience}).
 		Expiration(exp).
 		IssuedAt(now).
 		Issuer(Issuer).

diff --git a/pkg/cli/token_test.go b/pkg/cli/token_test.go
@@ -28,6 +28,7 @@ import (
 
 	jvspb "github.com/abcxyz/jvs/apis/v0"
 	"github.com/abcxyz/jvs/pkg/config"
+	"github.com/abcxyz/jvs/pkg/justification"
 	"github.com/abcxyz/pkg/testutil"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
@@ -157,7 +158,7 @@ func TestRunTokenCmd_Breakglass(t *testing.T) {
 	}
 
 	// Validate standard claims.
-	if got, want := token.Audience(), []string{"TODO #22"}; !reflect.DeepEqual(got, want) {
+	if got, want := token.Audience(), []string{justification.DefaultAudience}; !reflect.DeepEqual(got, want) {
 		t.Errorf("aud: expected %q to be %q", got, want)
 	}
 	if got := token.Expiration(); !got.After(now) {

diff --git a/pkg/justification/processor.go b/pkg/justification/processor.go
@@ -64,6 +64,10 @@ func NewProcessor(kms *kms.KeyManagementClient, config *config.JustificationConf
 
 const (
 	cacheKey = "signer"
+
+	// DefaultAudience is the default audience used in justification tokens.
+	// It can be overriden with the audiences in the justification request.
+	DefaultAudience = "dev.abcxyz.jvs"
 )
 
 // CreateToken implements the create token API which creates and signs a JWT
@@ -163,8 +167,14 @@ func (p *Processor) createToken(ctx context.Context, now time.Time, req *jvspb.C
 	exp := now.Add(req.Ttl.AsDuration())
 	justs := req.Justifications
 
+	// Use audiences in the request if provided.
+	aud := req.Audiences
+	if len(aud) == 0 {
+		aud = []string{DefaultAudience}
+	}
+
 	token, err := jwt.NewBuilder().
-		Audience([]string{"TODO #22"}).
+		Audience(aud).
 		Expiration(exp).
 		IssuedAt(now).
 		Issuer(p.config.Issuer).

diff --git a/pkg/justification/processor_test.go b/pkg/justification/processor_test.go
@@ -57,10 +57,11 @@ func TestCreateToken(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		name      string
-		request   *jvspb.CreateJustificationRequest
-		wantErr   string
-		serverErr error
+		name          string
+		request       *jvspb.CreateJustificationRequest
+		wantAudiences []string
+		wantErr       string
+		serverErr     error
 	}{
 		{
 			name: "happy_path",
@@ -73,6 +74,21 @@ func TestCreateToken(t *testing.T) {
 				},
 				Ttl: durationpb.New(3600 * time.Second),
 			},
+			wantAudiences: []string{DefaultAudience},
+		},
+		{
+			name: "override_aud",
+			request: &jvspb.CreateJustificationRequest{
+				Justifications: []*jvspb.Justification{
+					{
+						Category: "explanation",
+						Value:    "test",
+					},
+				},
+				Ttl:       durationpb.New(3600 * time.Second),
+				Audiences: []string{"aud1", "aud2"},
+			},
+			wantAudiences: []string{"aud1", "aud2"},
 		},
 		{
 			name: "no_justification",
@@ -216,7 +232,7 @@ func TestCreateToken(t *testing.T) {
 			}
 
 			// Validate standard claims.
-			if got, want := token.Audience(), []string{"TODO #22"}; !reflect.DeepEqual(got, want) {
+			if got, want := token.Audience(), tc.wantAudiences; !reflect.DeepEqual(got, want) {
 				t.Errorf("aud: expected %q to be %q", got, want)
 			}
 			if got := token.Expiration(); !got.After(now) {

diff --git a/protos/v0/jvs_request.proto b/protos/v0/jvs_request.proto
@@ -25,6 +25,9 @@ option go_package = "github.com/abcxyz/jvs/apis/v0";
 message CreateJustificationRequest {
   repeated Justification justifications = 1;
   google.protobuf.Duration ttl = 2;
+
+  // Optional audiences for the justifications.
+  repeated string audiences = 3;
 }
 
 // Justification is intended to be used to provide reasons that data access is

diff --git a/test/integ/main_test.go b/test/integ/main_test.go
@@ -128,10 +128,10 @@ func TestJVS(t *testing.T) {
 	jvsAgent := justification.NewJVSAgent(p)
 
 	tests := []struct {
-		name     string
-		request  *jvspb.CreateJustificationRequest
-		wantErr  string
-		wantResp map[string]interface{}
+		name          string
+		request       *jvspb.CreateJustificationRequest
+		wantAudiences []string
+		wantErr       string
 	}{
 		{
 			name: "happy_path",
@@ -146,14 +146,23 @@ func TestJVS(t *testing.T) {
 					Seconds: 3600,
 				},
 			},
-			wantResp: map[string]interface{}{
-				"aud": []string{"TODO #22"},
-				"iss": "ci-test",
-				"justs": []any{
-					map[string]any{"category": "explanation", "value": "This is a test."},
+			wantAudiences: []string{justification.DefaultAudience},
+		},
+		{
+			name: "override_audiences",
+			request: &jvspb.CreateJustificationRequest{
+				Justifications: []*jvspb.Justification{
+					{
+						Category: "explanation",
+						Value:    "This is a test.",
+					},
+				},
+				Ttl: &durationpb.Duration{
+					Seconds: 3600,
 				},
-				"sub": "user@example.com",
+				Audiences: []string{"aud1", "aud2"},
 			},
+			wantAudiences: []string{"aud1", "aud2"},
 		},
 		{
 			name: "unknown_justification",
@@ -260,7 +269,7 @@ func TestJVS(t *testing.T) {
 			}
 
 			// Validate standard claims.
-			if got, want := token.Audience(), []string{"TODO #22"}; !reflect.DeepEqual(got, want) {
+			if got, want := token.Audience(), tc.wantAudiences; !reflect.DeepEqual(got, want) {
 				t.Errorf("aud: expected %q to be %q", got, want)
 			}
 			if got := token.Expiration(); !got.After(now) {