Method validateAuthTokenUncached

admin/auth_token.go:314–397

(ctx context.Context, token string)

}

func (s *Service) validateAuthTokenUncached(ctx context.Context, token string) (AuthToken, error) {
	parsed, err := authtoken.FromString(token)
	if err != nil {
		return nil, err
	}

	switch parsed.Type {
	case authtoken.TypeUser:
		uat, err := s.DB.FindUserAuthToken(ctx, parsed.ID.String())
		if err != nil {
			return nil, err
		}

		if uat.ExpiresOn != nil && uat.ExpiresOn.Before(time.Now()) {
			return nil, fmt.Errorf("auth token is expired")
		}

		if !bytes.Equal(uat.SecretHash, parsed.SecretHash()) {
			return nil, fmt.Errorf("invalid auth token")
		}

		s.Used.UserToken(uat.ID)
		s.Used.User(uat.UserID)
		if uat.AuthClientID != nil {
			s.Used.Client(*uat.AuthClientID)
		}

		return &userAuthToken{model: uat, token: parsed}, nil
	case authtoken.TypeService:
		sat, err := s.DB.FindServiceAuthToken(ctx, parsed.ID.String())
		if err != nil {
			return nil, err
		}

		if sat.ExpiresOn != nil && sat.ExpiresOn.Before(time.Now()) {
			return nil, fmt.Errorf("auth token is expired")
		}

		if !bytes.Equal(sat.SecretHash, parsed.SecretHash()) {
			return nil, fmt.Errorf("invalid auth token")
		}

		s.Used.ServiceToken(sat.ID)
		s.Used.Service(sat.ServiceID)

		return &serviceAuthToken{model: sat, token: parsed}, nil
	case authtoken.TypeDeployment:
		dat, err := s.DB.FindDeploymentAuthToken(ctx, parsed.ID.String())
		if err != nil {
			return nil, err
		}

		if dat.ExpiresOn != nil && dat.ExpiresOn.Before(time.Now()) {
			return nil, fmt.Errorf("auth token is expired")
		}

		if !bytes.Equal(dat.SecretHash, parsed.SecretHash()) {
			return nil, fmt.Errorf("invalid auth token")