DevFW-CICD/forgejo-runner-optimiser
20
0
Fork 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions

Separate HMAC key from read token
Some checks failed
ci / build (push) Has been cancelled
Details

Browse source
This commit is contained in:
Martin McCaffery 2026-02-11 15:17:46 +01:00
parent aa3e8cddf9
commit 6e3242bbd8
Signed by: martin.mccaffery
GPG key ID: 7C4D0F375BCEE533
6 changed files with 91 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

22
internal/receiver/handler.go
View file

@ -14,13 +14,15 @@ import (
type Handler struct {
store *Store
logger *slog.Logger
readToken string // Pre-shared token for authentication (required)
readToken string // Pre-shared token for read endpoint authentication
hmacKey string // Separate key for HMAC-based push token generation/validation
}
// NewHandler creates a new HTTP handler with the given store.
// readToken is required for authenticating all metrics endpoints.
func NewHandler(store *Store, logger *slog.Logger, readToken string) *Handler {
return &Handler{store: store, logger: logger, readToken: readToken}
// readToken authenticates read endpoints and the token generation endpoint.
// hmacKey is the secret used to derive scoped push tokens.
func NewHandler(store *Store, logger *slog.Logger, readToken, hmacKey string) *Handler {
return &Handler{store: store, logger: logger, readToken: readToken, hmacKey: hmacKey}
}
// RegisterRoutes registers all HTTP routes on the given mux
@ -64,8 +66,8 @@ func (h *Handler) validateReadToken(w http.ResponseWriter, r *http.Request) bool
}
func (h *Handler) handleGenerateToken(w http.ResponseWriter, r *http.Request) {
if h.readToken == "" {
http.Error(w, "token generation requires a configured read-token", http.StatusBadRequest)
if h.hmacKey == "" {
http.Error(w, "token generation requires a configured HMAC key", http.StatusBadRequest)
return
}
@ -84,7 +86,7 @@ func (h *Handler) handleGenerateToken(w http.ResponseWriter, r *http.Request) {
return
}
token := GenerateScopedToken(h.readToken, req.Organization, req.Repository, req.Workflow, req.Job)
token := GenerateScopedToken(h.hmacKey, req.Organization, req.Repository, req.Workflow, req.Job)
w.Header().Set("Content-Type", "application/json")
_ = json.NewEncoder(w).Encode(TokenResponse{Token: token})
@ -92,8 +94,8 @@ func (h *Handler) handleGenerateToken(w http.ResponseWriter, r *http.Request) {
// validatePushToken checks push authentication via scoped HMAC token.
func (h *Handler) validatePushToken(w http.ResponseWriter, r *http.Request, exec ExecutionContext) bool {
if h.readToken == "" {
h.logger.Warn("no read-token configured, rejecting push", slog.String("path", r.URL.Path))
if h.hmacKey == "" {
h.logger.Warn("no HMAC key configured, rejecting push", slog.String("path", r.URL.Path))
http.Error(w, "authorization required", http.StatusUnauthorized)
return false
}
@ -113,7 +115,7 @@ func (h *Handler) validatePushToken(w http.ResponseWriter, r *http.Request, exec
}
token := strings.TrimPrefix(authHeader, bearerPrefix)
if !ValidateScopedToken(h.readToken, token, exec.Organization, exec.Repository, exec.Workflow, exec.Job) {
if !ValidateScopedToken(h.hmacKey, token, exec.Organization, exec.Repository, exec.Workflow, exec.Job) {
h.logger.Warn("invalid push token", slog.String("path", r.URL.Path))
http.Error(w, "invalid token", http.StatusUnauthorized)
return false