Move OAuth integration to third_party.

ejona86 · ejona86 · commit 7a2d8df75345 · 2015-01-08T14:42:38.000-08:00
It should have been in third_party to begin with. ------------- Created by MOE: http://code.google.com/p/moe-java MOE_MIGRATED_REVID=73826831
diff --git a/auth/src/main/java/com/google/net/stubby/auth/OAuth2AccessTokenProvider.java b/auth/src/main/java/com/google/net/stubby/auth/OAuth2AccessTokenProvider.java
@@ -0,0 +1,105 @@
+package com.google.net.stubby.auth;
+
+import com.google.api.client.auth.oauth2.Credential;
+import com.google.common.base.Preconditions;
+
+import java.io.IOException;
+import java.util.concurrent.Executor;
+
+import javax.inject.Provider;
+
+/**
+ * A {@link Provider} that produces valid OAuth2 access tokens given a {@link Credential}.
+ */
+class OAuth2AccessTokenProvider implements Provider<String> {
+  private static final int LOWER_BOUND_ON_EXPIRATION_SECS = 5;
+  private static final int LOWER_BOUND_ON_ASYNC_REFRESH_SECS = 60;
+
+  /**
+   * Note that any call to Credential may block for long periods of time, due to shared lock with
+   * refreshToken().
+   */
+  private final Credential credential;
+  private final Executor executor;
+  private String accessToken;
+  private Long expiresInSeconds;
+  private boolean refreshing;
+
+  public OAuth2AccessTokenProvider(Credential credential, Executor executor) {
+    this.credential = Preconditions.checkNotNull(credential);
+    this.executor = Preconditions.checkNotNull(executor);
+    // Access expiration before token to gracefully deals with races.
+    expiresInSeconds = credential.getExpiresInSeconds();
+    accessToken = credential.getAccessToken();
+  }
+
+  private synchronized boolean isAccessTokenEffectivelyExpired() {
+    return accessToken == null || expiresInSeconds == null
+        || expiresInSeconds <= LOWER_BOUND_ON_EXPIRATION_SECS;
+  }
+
+  private synchronized boolean isAccessTokenSoonToBeExpired() {
+    return accessToken == null || expiresInSeconds == null
+        || expiresInSeconds <= LOWER_BOUND_ON_ASYNC_REFRESH_SECS;
+  }
+
+  @Override
+  public synchronized String get() {
+    if (isAccessTokenEffectivelyExpired()) {
+      // Token is at best going to expire momentarily, so we must refresh before proceeding.
+      makeSureTokenIsRefreshing();
+      waitForTokenRefresh();
+      if (isAccessTokenEffectivelyExpired()) {
+        throw new RuntimeException("Could not obtain access token");
+      }
+    } else if (isAccessTokenSoonToBeExpired()) {
+      makeSureTokenIsRefreshing();
+    }
+    return accessToken;
+  }
+
+  private synchronized void makeSureTokenIsRefreshing() {
+    if (refreshing) {
+      return;
+    }
+    refreshing = true;
+    executor.execute(new Runnable() {
+      @Override
+      public void run() {
+        // Check if some other user of credential has already refreshed the access token.
+        synchronized (OAuth2AccessTokenProvider.this) {
+          expiresInSeconds = credential.getExpiresInSeconds();
+          accessToken = credential.getAccessToken();
+          if (!isAccessTokenSoonToBeExpired()) {
+            refreshing = false;
+            OAuth2AccessTokenProvider.this.notifyAll();
+            return;
+          }
+        }
+        try {
+          credential.refreshToken();
+        } catch (IOException ioe) {
+          throw new RuntimeException(ioe);
+        } finally {
+          synchronized (OAuth2AccessTokenProvider.this) {
+            refreshing = false;
+            expiresInSeconds = credential.getExpiresInSeconds();
+            accessToken = credential.getAccessToken();
+            OAuth2AccessTokenProvider.this.notifyAll();
+          }
+        }
+      }
+    });
+  }
+
+  private synchronized void waitForTokenRefresh() {
+    while (refreshing) {
+      try {
+        wait();
+      } catch (InterruptedException ex) {
+        Thread.currentThread().interrupt();
+        throw new RuntimeException(ex);
+      }
+    }
+  }
+}
diff --git a/auth/src/main/java/com/google/net/stubby/auth/OAuth2ChannelInterceptor.java b/auth/src/main/java/com/google/net/stubby/auth/OAuth2ChannelInterceptor.java
@@ -0,0 +1,36 @@
+package com.google.net.stubby.auth;
+
+import com.google.api.client.auth.oauth2.Credential;
+import com.google.common.base.Preconditions;
+import com.google.net.stubby.Call;
+import com.google.net.stubby.Channel;
+import com.google.net.stubby.MethodDescriptor;
+
+import java.util.concurrent.Executor;
+
+import javax.inject.Provider;
+
+/** Channel wrapper that authenticates all calls with OAuth2. */
+public class OAuth2ChannelInterceptor implements Channel {
+  private final Channel delegate;
+  private final OAuth2AccessTokenProvider accessTokenProvider;
+  private final Provider<String> authorizationHeaderProvider
+      = new Provider<String>() {
+        @Override
+        public String get() {
+          return "Bearer " + accessTokenProvider.get();
+        }
+      };
+
+  public OAuth2ChannelInterceptor(Channel delegate, Credential credential, Executor executor) {
+    this.delegate = Preconditions.checkNotNull(delegate);
+    this.accessTokenProvider = new OAuth2AccessTokenProvider(credential, executor);
+  }
+
+  @Override
+  public <ReqT, RespT> Call<ReqT, RespT> newCall(MethodDescriptor<ReqT, RespT> method) {
+    // TODO(user): If the call fails for Auth reasons, this does not properly propagate info that
+    // would be in WWW-Authenticate, because it does not yet have access to the header.
+    return delegate.newCall(method.withHeader("Authorization", authorizationHeaderProvider));
+  }
+}
