Skip to content

feat: upstream authentication improvements #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jrepp merged 10 commits into from
Nov 10, 2025
Merged

feat: upstream authentication improvements #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
b68cba0
Use token type
mdehoog Dec 23, 2021
a826bb2
Pass upstream URL to token generation
mdehoog Dec 24, 2021
8dbd2a9
merge: integrate PR #11 - pass upstream URL to token generation
jrepp Nov 7, 2025
8435933
merge: integrate PR #10 - use token type for authentication
jrepp Nov 7, 2025
2b7e66b
docs: add RFC-002 on GitHub OAuth and multi-tenancy architecture
jrepp Nov 7, 2025
3039400
docs: update repository references to goblet
jrepp Nov 7, 2025
e45256a
fix: format code and update test for TokenSource signature
jrepp Nov 8, 2025
680fab9
Merge remote-tracking branch 'origin/main' into feature/upstream-auth…
jrepp Nov 9, 2025
13d8183
Add comprehensive tests for pluggable upstream authentication
jrepp Nov 9, 2025
acdf19a
fix: resolve linter issues in test files
jrepp Nov 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/architecture/rfc-002-github-oauth-multi-tenancy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1112,7 +1112,7 @@ However, PR #7 alone is **not sufficient** for secure multi-tenant operation. Co
2. [GitHub OAuth2 Token Types](https://docs.github.com/en/authentication)
3. [GitHub Enterprise Authentication](https://docs.github.com/en/enterprise-server/authentication)
4. [RFC-001: Secure Multi-Tenant Cache](secure-multi-tenant-rfc.md)
5. [PR #7: Upstream Authentication Improvements](https://github.com/jrepp/github-cache-daemon/pull/7)
5. [PR #7: Upstream Authentication Improvements](https://github.com/jrepp/goblet/pull/7)
6. [Isolation Strategies](../security/isolation-strategies.md)

---
Expand Down
10 changes: 6 additions & 4 deletions goblet-server/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -331,10 +331,12 @@ func main() {
}

config := &goblet.ServerConfig{
LocalDiskCacheRoot: *cacheRoot,
URLCanonializer: urlCanonicalizer,
RequestAuthorizer: authorizer,
TokenSource: ts,
LocalDiskCacheRoot: *cacheRoot,
URLCanonializer: urlCanonicalizer,
RequestAuthorizer: authorizer,
TokenSource: func(upstreamURL *url.URL) (*oauth2.Token, error) {
return ts.Token()
},
ErrorReporter: er,
RequestLogger: rl,
LongRunningOperationLogger: lrol,
Expand Down
2 changes: 1 addition & 1 deletion goblet.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ type ServerConfig struct {

RequestAuthorizer func(*http.Request) error

TokenSource oauth2.TokenSource
TokenSource func(upstreamURL *url.URL) (*oauth2.Token, error)

ErrorReporter func(*http.Request, error)

Expand Down
6 changes: 3 additions & 3 deletions managed_repository.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@ func (r *managedRepository) lsRefsUpstream(command []*gitprotocolio.ProtocolV2Re
if err != nil {
return nil, status.Errorf(codes.Internal, "cannot construct a request object: %v", err)
}
t, err := r.config.TokenSource.Token()
t, err := r.config.TokenSource(r.upstreamURL)
if err != nil {
return nil, status.Errorf(codes.Internal, "cannot obtain an OAuth2 access token for the server: %v", err)
}
Expand Down Expand Up @@ -325,7 +325,7 @@ func (r *managedRepository) fetchUpstream() (err error) {
defer r.mu.Unlock()
if splitGitFetch {
// Fetch heads and changes first.
t, err = r.config.TokenSource.Token()
t, err = r.config.TokenSource(r.upstreamURL)
if err != nil {
err = status.Errorf(codes.Internal, "cannot obtain an OAuth2 access token for the server: %v", err)
return err
Expand All @@ -337,7 +337,7 @@ func (r *managedRepository) fetchUpstream() (err error) {
}
}
if err == nil {
t, err = r.config.TokenSource.Token()
t, err = r.config.TokenSource(r.upstreamURL)
if err != nil {
err = status.Errorf(codes.Internal, "cannot obtain an OAuth2 access token for the server: %v", err)
return err
Expand Down
Loading