[Feature]: CF API client can successfully request an oauth token

[acosta11]

Background

The CF CLI logs command makes multiple requests on behalf of the user to logging read endpoint until cancelled. To facilitate the continued streaming of logs, the cli spawns a separate goroutine to also update the oauth token used to authenticate those requests. But when configured for K8s, the log cache client does not authenticate using the oauth token, instead it uses the auth information stored in the user’s kubeconfig file. Ideally, this would also imply that the token refresh is skipped, but this does not appear to be the case. In the absence of that conditional logic, we can stub out a token response under the assumption that it won't be used.

As a CF CLI user
I want the CF CLI to be able to request an oauth token
So that I can use cf logs, which tries to keep an oauth token refreshed while streaming

Also in the future, perhaps we could enhance the auth capabilities of the cli and api to facilitate rotation of the user cert used for identity should the installation include something like pinniped for identity management.

Acceptance Criteria

GIVEN an installation of Korifi API
WHEN I I make an authenticated request of the form

POST /oauth/token HTTP/1.1
Accept: application/json
Authorization: [PRIVATE DATA HIDDEN]

THEN I get a successful response of the form

HTTP/1.1 200 OK
Content-Type: application/json
{
  "token_type": "Bearer",
  "access_token": "dXNlcm5hbWVfbG9va3VwX2NsaWVudF9uYW1lOnVzZXJuYW1lX2xvb2t1cF9zZWNyZXQ="
}

where the content of the token needs to be valid but is arbitrary.

WHEN I I am not authenticated and make a request of the form

POST /oauth/token HTTP/1.1
Accept: application/json
Authorization: [PRIVATE DATA HIDDEN]

THEN I get a 401 Unauthorized response (we should get this for free from our authn middleware)

Dev Notes

The token contents may need to be a valid jwt for the cli to parse the response, but should not be materially used beyond that point. It looks like the expiration time determines when the cli will next try to refresh if anything.

[julian-hj]

Note:
we created an unauthenticated endpoint for /oauth/token that just gives out tokens to anybody who wants one. The reason we did that was that the CLI doesn't think it is talking to the CF API, so it doesn't send the normal authentication headers, and instead sends some OAUTH thing. Rather than trying to parse the OAUTH headers, we decided to just skip authentication.

Since the token we return isn't secure in any way, and cannot be used to get anything from our API, we figured it doesn't make any difference if we authenticate or not.

We discussed this with @acosta11 and @davewalter during implementation.

[acosta11]

Acceptance:
Confirmed oauth/token response is successfully parsed by the unmodified tip of v8 branch cli for streaming logs on my korifi deployment.

$ git log
commit 3346dae7885f977f587911d908c4fbaaf2565b3f (HEAD -> v8, origin/v8)
...
$ cf version
cf version 8.4.0+3346dae78.2022-07-19
$ cf push node -p ~/workspace/cf-acceptance-tests/assets/node/
Pushing app node to org o / space s as cf-admin...
Packaging files to upload...
Uploading files...
 626 B / 626 B [=================================================================================================================================================================================================================================] 100.00% 1s

Waiting for API to complete processing files...

Staging app and tracing logs...

   Build reason(s): CONFIG
   CONFIG:
   	+ env:
...

LGTM, closing.