Auth expire handling for govcd.VCDClient

[lelvisl]

As long as you using *govcd.VCDClient for a long time, its auth expires in accordance with auth timeout settings in vcd.

State now: handle 401 error and reauth, after this repeat request. And you need have this logic near of every govcd call.

Example of solution with http transport:

package vcdreauth

import (
	"fmt"
	"net/http"
	"strings"

	"github.com/vmware/go-vcloud-director/v2/govcd"
)

type Transport struct {
	cli         *govcd.VCDClient
	user        string
	password    string
	org         string
	next        http.RoundTripper
	maxAttempts uint
}

func NewReAuthTransport(cli *govcd.VCDClient, user, password, org string, maxAttempts uint) *Transport {
	if maxAttempts < 1 {
		maxAttempts = DefaultReAuthMaxAttempts
	}
	return &Transport{
		cli:         cli,
		user:        user,
		password:    password,
		org:         org,
		next:        cli.Client.Http.Transport,
		maxAttempts: maxAttempts,
	}
}

const DefaultReAuthMaxAttempts = 1

func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
	for count := 0; count < DefaultReAuthMaxAttempts+1; count++ {
		// Perform request
		resp, err := t.next.RoundTrip(req)

		// don't try to retry auth enpoints
		if req.URL.Path == "/api/sessions" || strings.Contains(req.URL.Path, "/cloudapi/1.0.0/sessions/provider") {
			return resp, err
		}

		// if status not 401 - don't try to retry
		if resp.StatusCode != http.StatusUnauthorized {
			return resp, err
		}

		// close the response body when we wont use it anymore
		if resp != nil {
			_ = resp.Body.Close()
		}
		authResp, err := t.cli.GetAuthResponse(t.user, t.password, t.org)
		if err != nil {
			return nil, fmt.Errorf("unable to authenticate: %w", err)
		}

		// re-setup auth headers
		if t.cli.Client.VCDAuthHeader != "" && t.cli.Client.VCDToken != "" {
			// Add the authorization header
			req.Header.Set(t.cli.Client.VCDAuthHeader, t.cli.Client.VCDToken)
		}
		if len(t.cli.Client.VCDToken) > 32 {
			req.Header.Set("X-Vmware-Vcloud-Token-Type", "Bearer")
			req.Header.Set("Authorization", "bearer "+t.cli.Client.VCDToken)
		}

		if authResp != nil {
			_ = authResp.Body.Close()
		}
	}
	return nil, fmt.Errorf("unauthorized - max attempts (%d)", t.maxAttempts)
}

Example of usage:

	vcdclient := govcd.NewVCDClient(*u, Insecure, govcd.WithHttpUserAgent(userAgent))
	vcdclient.Client.Http.Transport = vcdreauth.NewReAuthTransport(vcdclient, User, Password, systemOrg, 1)
	_, err := vcdclient.GetAuthResponse(User, Password, systemOrg)

if you ok with this solution, i can add it as PR.

P.S. I'm already using this code in my project and its working well.

[lelvisl]

@dataclouder is it correct flow for reauth?