Updated auth interface (#1384)

* Updated  auth interface

* Add Rule

* Remove Rule

* Return token from Renew

* Renew => Refresh

* Implement Tokens & Default Auth Implementation

* Change default auth to noop

* Change default auth to noop

* Move token.Token to auth.Token

* Remove Token from Account

* Auth service implementation

* Decode JWT locally

* Cookie for secret

* Move string to bottom of interface definition

* Depricate auth_exclude

* Update auth wrappers

* Update go.sum

Co-authored-by: Ben Toogood <ben@micro.mu>

auth/default.go

@@ -1,122 +1,70 @@
 package auth
 
 import (
-	"encoding/base32"
-	"sync"
-	"time"
+	"github.com/google/uuid"
 )
 
 var (
 	DefaultAuth = NewAuth()
 )
 
-func genAccount(id string) *Account {
-	// return a pseudo account
-	return &Account{
-		Id:       id,
-		Token:    base32.StdEncoding.EncodeToString([]byte(id)),
-		Created:  time.Now(),
-		Expiry:   time.Now().Add(time.Hour * 24),
-		Metadata: make(map[string]string),
-	}
-}
-
-// NewAuth returns a new default registry which is memory
 func NewAuth(opts ...Option) Auth {
-	var options Options
-	for _, o := range opts {
-		o(&options)
-	}
-
-	return &memory{
-		accounts: make(map[string]*Account),
-		opts:     options,
-	}
+	return &noop{}
 }
 
-// TODO: replace with https://github.com/nats-io/nkeys
-// We'll then register public key in registry to use
-type memory struct {
+type noop struct {
 	opts Options
-	// accounts
-	sync.RWMutex
-	accounts map[string]*Account
 }
 
-func (n *memory) Init(opts ...Option) error {
+// String returns the name of the implementation
+func (n *noop) String() string {
+	return "noop"
+}
+
+// Init the auth
+func (n *noop) Init(opts ...Option) {
 	for _, o := range opts {
 		o(&n.opts)
 	}
-	return nil
 }
 
-func (n *memory) Options() Options {
+// Options set for auth
+func (n *noop) Options() Options {
 	return n.opts
 }
 
-func (n *memory) Generate(id string, opts ...GenerateOption) (*Account, error) {
-	var options GenerateOptions
-	for _, o := range opts {
-		o(&options)
-	}
+// Generate a new account
+func (n *noop) Generate(id string, opts ...GenerateOption) (*Account, error) {
+	options := NewGenerateOptions(opts...)
 
-	// return a pseudo account
-	acc := genAccount(id)
-
-	// set opts
-	if len(options.Roles) > 0 {
-		acc.Roles = options.Roles
-	}
-	if options.Metadata != nil {
-		acc.Metadata = options.Metadata
-	}
-
-	// TODO: don't overwrite
-	n.Lock()
-	// maybe save by account id?
-	n.accounts[acc.Token] = acc
-	n.Unlock()
-
-	return acc, nil
-}
-
-func (n *memory) Revoke(token string) error {
-	n.Lock()
-	delete(n.accounts, token)
-	n.Unlock()
-	return nil
-}
-
-func (n *memory) Verify(token string) (*Account, error) {
-	n.RLock()
-	defer n.RUnlock()
-
-	if len(token) == 0 {
-		// pseudo account?
-		return genAccount(""), nil
-	}
-
-	// try get the local account if it exists
-	if acc, ok := n.accounts[token]; ok {
-		return acc, nil
-	}
-
-	// decode the token otherwise
-	b, err := base32.StdEncoding.DecodeString(token)
-	if err != nil {
-		return genAccount(""), nil
-	}
-
-	// return a pseudo account based on token/id
 	return &Account{
-		Id:       string(b),
-		Token:    token,
-		Created:  time.Now(),
-		Expiry:   time.Now().Add(time.Hour * 24),
-		Metadata: make(map[string]string),
+		ID:       id,
+		Roles:    options.Roles,
+		Metadata: options.Metadata,
 	}, nil
 }
 
-func (n *memory) String() string {
-	return "memory"
+// Grant access to a resource
+func (n *noop) Grant(role string, res *Resource) error {
+	return nil
+}
+
+// Revoke access to a resource
+func (n *noop) Revoke(role string, res *Resource) error {
+	return nil
+}
+
+// Verify an account has access to a resource
+func (n *noop) Verify(acc *Account, res *Resource) error {
+	return nil
+}
+
+// Inspect a token
+func (n *noop) Inspect(token string) (*Account, error) {
+	return &Account{ID: uuid.New().String()}, nil
+}
+
+// Refresh an account using a secret
+func (n *noop) Refresh(secret string, opts ...RefreshOption) (*Token, error) {
+	return &Token{}, nil
 }