703818db8b
The VM runtime token is a JWT token used for authenticating virtual machines with our runtime API, and it remains valid while the VM is running. We utilize the runner assigned to the VM and the repository associated with this runner in the "/runtime/github" endpoints. Subsequent commits introduce these new endpoints. We pass the runtime token and URL to the runner as environment variables during the setup process.
40 lines
933 B
Ruby
40 lines
933 B
Ruby
# frozen_string_literal: true
|
|
|
|
require "jwt"
|
|
|
|
class CloverRuntime < Roda
|
|
include CloverBase
|
|
|
|
plugin :default_headers, "Content-Type" => "application/json"
|
|
|
|
plugin :hash_branches
|
|
plugin :json
|
|
plugin :all_verbs
|
|
plugin :json_parser
|
|
|
|
autoload_routes("runtime")
|
|
|
|
plugin :error_handler do |e|
|
|
error = parse_error(e)
|
|
|
|
{error: error}.to_json unless error[:code] == 204
|
|
end
|
|
|
|
def get_jwt_payload(request)
|
|
return unless (v = request.env["HTTP_AUTHORIZATION"])
|
|
jwt_token = v.sub(%r{\ABearer:?\s+}, "")
|
|
begin
|
|
JWT.decode(jwt_token, Config.clover_runtime_token_secret, true, {algorithm: "HS256"})[0]
|
|
rescue JWT::DecodeError
|
|
end
|
|
end
|
|
|
|
route do |r|
|
|
if (jwt_payload = get_jwt_payload(r)).nil? || (@vm = Vm.from_ubid(jwt_payload["sub"])).nil?
|
|
fail CloverError.new(400, "InvalidRequest", "invalid JWT format or claim in Authorization header")
|
|
end
|
|
|
|
r.hash_branches("")
|
|
end
|
|
end
|