package auth import ( "fmt" "os" "path/filepath" "forge.cadoles.com/Cadoles/emissary/internal/auth/thirdparty" "forge.cadoles.com/Cadoles/emissary/internal/command/api/flag" "forge.cadoles.com/Cadoles/emissary/internal/command/common" "forge.cadoles.com/Cadoles/emissary/internal/datastore" "forge.cadoles.com/Cadoles/emissary/internal/jwk" "github.com/lithammer/shortuuid/v4" "github.com/pkg/errors" "github.com/urfave/cli/v2" ) func CreateTokenCommand() *cli.Command { return &cli.Command{ Name: "create-token", Usage: "Create a new authentication token", Flags: []cli.Flag{ &cli.StringFlag{ Name: "role", Usage: fmt.Sprintf("associate `ROLE` to the token (available: %v)", []thirdparty.Role{thirdparty.RoleReader, thirdparty.RoleWriter}), Value: string(thirdparty.RoleReader), }, &cli.StringFlag{ Name: "subject", Usage: "associate `SUBJECT` to the token", Value: fmt.Sprintf("user-%s", shortuuid.New()), }, &cli.StringFlag{ Name: "tenant", Usage: "associate `TENANT` to the token", Required: true, }, &cli.StringFlag{ Name: "output", Aliases: []string{"o"}, TakesFile: true, Usage: "output token to `OUTPUT` (or '-' to print to stdout)", Value: flag.AuthTokenDefaultHomePath, }, }, Action: func(ctx *cli.Context) error { conf, err := common.LoadConfig(ctx) if err != nil { return errors.Wrap(err, "Could not load configuration") } subject := ctx.String("subject") tenant := ctx.String("tenant") role := ctx.String("role") output := ctx.String("output") localAuth := conf.Server.Auth.Local if localAuth == nil { return errors.New("local auth is disabled") } key, err := jwk.LoadOrGenerate(string(localAuth.PrivateKeyPath), jwk.DefaultKeySize) if err != nil { return errors.WithStack(err) } token, err := thirdparty.GenerateToken(ctx.Context, key, datastore.TenantID(tenant), subject, thirdparty.Role(role)) if err != nil { return errors.WithStack(err) } output = os.ExpandEnv(output) if output == "-" { fmt.Println(token) } else { outputDirectory := filepath.Dir(output) if err := os.MkdirAll(outputDirectory, os.FileMode(0o700)); err != nil { return errors.WithStack(err) } if err := os.WriteFile(output, []byte(token), os.FileMode(0o600)); err != nil { return errors.WithStack(err) } fmt.Printf("Token written to '%s'.\n", output) } return nil }, } }