| 63 | } |
| 64 | |
| 65 | func (i *instanceToken) NewInstanceJWTToken(instance params.Instance, entity params.ForgeEntity, ttlMinutes uint) (string, error) { |
| 66 | // Token expiration is equal to the bootstrap timeout set on the pool plus the polling |
| 67 | // interval garm uses to check for timed out runners. Runners that have not sent their info |
| 68 | // by the end of this interval are most likely failed and will be reaped by garm anyway. |
| 69 | var ttl int |
| 70 | if ttlMinutes > math.MaxInt { |
| 71 | ttl = math.MaxInt |
| 72 | } else { |
| 73 | ttl = int(ttlMinutes) |
| 74 | } |
| 75 | expireToken := time.Now().Add(time.Duration(ttl)*time.Minute + common.PoolReapTimeoutInterval) |
| 76 | expires := &jwt.NumericDate{ |
| 77 | Time: expireToken, |
| 78 | } |
| 79 | claims := InstanceJWTClaims{ |
| 80 | RegisteredClaims: jwt.RegisteredClaims{ |
| 81 | ExpiresAt: expires, |
| 82 | Issuer: "garm", |
| 83 | }, |
| 84 | ID: instance.ID, |
| 85 | Name: instance.Name, |
| 86 | PoolID: instance.PoolID, |
| 87 | Scope: entity.EntityType, |
| 88 | Entity: entity.String(), |
| 89 | ForgeType: string(entity.Credentials.ForgeType), |
| 90 | IsAgent: false, |
| 91 | CreateAttempt: instance.CreateAttempt, |
| 92 | } |
| 93 | token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims) |
| 94 | tokenString, err := token.SignedString([]byte(i.jwtSecret)) |
| 95 | if err != nil { |
| 96 | return "", fmt.Errorf("error signing token: %w", err) |
| 97 | } |
| 98 | |
| 99 | return tokenString, nil |
| 100 | } |
| 101 | |
| 102 | // instanceMiddleware is the authentication middleware |
| 103 | // used with gorilla |