Method IssueUserAuthToken

admin/server/users.go:256–308

(ctx context.Context, req *adminv1.IssueUserAuthTokenRequest)

}

func (s *Server) IssueUserAuthToken(ctx context.Context, req *adminv1.IssueUserAuthTokenRequest) (*adminv1.IssueUserAuthTokenResponse, error) {
	observability.AddRequestAttributes(ctx,
		attribute.String("args.user_id", req.UserId),
		attribute.String("args.client_id", req.ClientId),
		attribute.String("args.display_name", req.DisplayName),
		attribute.Int64("args.ttl_minutes", req.TtlMinutes),
		attribute.Bool("args.has_represent_email", req.RepresentEmail != ""),
	)

	claims := auth.GetClaims(ctx)
	forceAccess := claims.Superuser(ctx) && req.SuperuserForceAccess

	userID := req.UserId
	if userID == "current" { // Special alias for the current user
		if claims.OwnerType() != auth.OwnerTypeUser {
			return nil, status.Error(codes.Unauthenticated, "not authenticated as a user")
		}
		userID = claims.OwnerID()
	}
	if userID != claims.OwnerID() && !forceAccess {
		return nil, status.Error(codes.PermissionDenied, "not authorized to issue auth tokens for other users")
	}

	var ttl *time.Duration
	if req.TtlMinutes > 0 {
		ttl = new(time.Duration)
		*ttl = time.Duration(req.TtlMinutes) * time.Minute
	}

	var representingUserID *string
	if req.RepresentEmail != "" {
		if !forceAccess {
			return nil, status.Error(codes.PermissionDenied, "not authorized to represent other users")
		}
		u, err := s.admin.DB.FindUserByEmail(ctx, req.RepresentEmail)
		if err != nil {
			return nil, err
		}
		if u.ID == userID {
			return nil, status.Error(codes.InvalidArgument, "cannot represent yourself")
		}
		representingUserID = &u.ID
	}

	authToken, err := s.admin.IssueUserAuthToken(ctx, userID, req.ClientId, req.DisplayName, representingUserID, ttl, false)
	if err != nil {
		return nil, err
	}

	return &adminv1.IssueUserAuthTokenResponse{
		Token: authToken.Token().String(),
	}, nil
}

func (s *Server) RevokeUserAuthToken(ctx context.Context, req *adminv1.RevokeUserAuthTokenRequest) (*adminv1.RevokeUserAuthTokenResponse, error) {
	observability.AddRequestAttributes(ctx,