feat(grpc): allow files to be read by jmespath expressions

This allows allow jmespath expressions to refer to the contents of
certain pre-declared files which are reloaded on a user-specified
schedule. For example, if you want to use k8s bound service
account tokens you could add the following to your Pod:

  volumes:
  - name: token-vol
    projected:
      sources:
      - serviceAccountToken:
          audience: my-buildbarn-instance
          expirationSeconds: 3600
          path: buildbarn

Assuming this is mounted at '/tokens', you could then specify in your
buildbarn config:

  addMetadataJmespathExpression: {
    expression: |||
      {
        "authorization": [std.format('bearer %s', files.token)]
      }
    |||,
    files: [
      {
        key: "token",
        path: "/tokens/buildbarn",
        refreshInterval: "1800s",
      }
    ]
  },

This is quite useful for k8s service account tokens, as the maximum
validity is often capped. Likewise this can also be used for Google
service account id tokens, which also have a relatively short maximum
validity.

Author: tomgr

pkg/auth/BUILD.bazel

@@ -18,10 +18,10 @@ go_library(
         "//pkg/clock",
         "//pkg/digest",
         "//pkg/eviction",
+        "//pkg/jmespath",
         "//pkg/otel",
         "//pkg/proto/auth",
         "//pkg/util",
-        "@com_github_jmespath_go_jmespath//:go-jmespath",
         "@io_opentelemetry_go_otel//attribute",
         "@org_golang_google_grpc//:grpc",
         "@org_golang_google_grpc//codes",
@@ -47,10 +47,10 @@ go_test(
         "//internal/mock",
         "//pkg/digest",
         "//pkg/eviction",
+        "//pkg/jmespath",
         "//pkg/proto/auth",
         "//pkg/testutil",
         "//pkg/util",
-        "@com_github_jmespath_go_jmespath//:go-jmespath",
         "@com_github_stretchr_testify//require",
         "@io_opentelemetry_go_otel//attribute",
         "@io_opentelemetry_go_proto_otlp//common/v1:common",

pkg/auth/configuration/BUILD.bazel

@@ -11,9 +11,9 @@ go_library(
         "//pkg/digest",
         "//pkg/eviction",
         "//pkg/grpc",
+        "//pkg/jmespath",
         "//pkg/proto/configuration/auth",
         "//pkg/util",
-        "@com_github_jmespath_go_jmespath//:go-jmespath",
         "@org_golang_google_grpc//codes",
         "@org_golang_google_grpc//status",
         "@org_golang_google_protobuf//encoding/protojson",

pkg/auth/configuration/authorizer_factory.go

@@ -6,9 +6,9 @@ import (
 	"github.com/buildbarn/bb-storage/pkg/digest"
 	"github.com/buildbarn/bb-storage/pkg/eviction"
 	"github.com/buildbarn/bb-storage/pkg/grpc"
+	"github.com/buildbarn/bb-storage/pkg/jmespath"
 	pb "github.com/buildbarn/bb-storage/pkg/proto/configuration/auth"
 	"github.com/buildbarn/bb-storage/pkg/util"
-	"github.com/jmespath/go-jmespath"
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -53,7 +53,7 @@ func (f BaseAuthorizerFactory) NewAuthorizerFromConfiguration(config *pb.Authori
 		}
 		return auth.NewStaticAuthorizer(trie.ContainsPrefix), nil
 	case *pb.AuthorizerConfiguration_JmespathExpression:
-		expression, err := jmespath.Compile(policy.JmespathExpression)
+		expression, err := jmespath.NewExpressionFromConfiguration(policy.JmespathExpression, nil)
 		if err != nil {
 			return nil, util.StatusWrapWithCode(err, codes.InvalidArgument, "Failed to compile JMESPath expression")
 		}

pkg/auth/jmespath_expression_authorizer.go

@@ -4,18 +4,18 @@ import (
 	"context"
 
 	"github.com/buildbarn/bb-storage/pkg/digest"
-	"github.com/jmespath/go-jmespath"
+	"github.com/buildbarn/bb-storage/pkg/jmespath"
 )
 
 type jmespathExpressionAuthorizer struct {
-	expression *jmespath.JMESPath
+	expression *jmespath.Expression
 }
 
 // NewJMESPathExpressionAuthorizer creates an Authorizer that evaluates
 // a JMESPath expression to make an authorization decision. The JMESpath
 // expression is called with a JSON object that includes both the REv2
 // instance name and authentication metadata.
-func NewJMESPathExpressionAuthorizer(expression *jmespath.JMESPath) Authorizer {
+func NewJMESPathExpressionAuthorizer(expression *jmespath.Expression) Authorizer {
 	return &jmespathExpressionAuthorizer{
 		expression: expression,
 	}

pkg/auth/jmespath_expression_authorizer_test.go

@@ -6,10 +6,10 @@ import (
 
 	"github.com/buildbarn/bb-storage/pkg/auth"
 	"github.com/buildbarn/bb-storage/pkg/digest"
+	"github.com/buildbarn/bb-storage/pkg/jmespath"
 	auth_pb "github.com/buildbarn/bb-storage/pkg/proto/auth"
 	"github.com/buildbarn/bb-storage/pkg/testutil"
 	"github.com/buildbarn/bb-storage/pkg/util"
-	"github.com/jmespath/go-jmespath"
 	"github.com/stretchr/testify/require"
 
 	"google.golang.org/grpc/codes"

pkg/grpc/BUILD.bazel

@@ -37,6 +37,7 @@ go_library(
         "//pkg/auth",
         "//pkg/clock",
         "//pkg/eviction",
+        "//pkg/jmespath",
         "//pkg/jwt",
         "//pkg/program",
         "//pkg/proto/auth",
@@ -45,7 +46,6 @@ go_library(
         "@bazel_remote_apis//build/bazel/remote/execution/v2:remote_execution_go_proto",
         "@com_github_grpc_ecosystem_go_grpc_middleware//:go-grpc-middleware",
         "@com_github_grpc_ecosystem_go_grpc_prometheus//:go-grpc-prometheus",
-        "@com_github_jmespath_go_jmespath//:go-jmespath",
         "@io_opentelemetry_go_contrib_instrumentation_google_golang_org_grpc_otelgrpc//:otelgrpc",
         "@io_opentelemetry_go_otel//attribute",
         "@io_opentelemetry_go_otel_trace//:trace",
@@ -126,12 +126,14 @@ go_test(
         ":grpc",
         "//internal/mock",
         "//pkg/auth",
+        "//pkg/jmespath",
+        "//pkg/program",
         "//pkg/proto/auth",
         "//pkg/proto/configuration/grpc",
+        "//pkg/proto/jmespath",
         "//pkg/testutil",
         "//pkg/util",
         "@bazel_remote_apis//build/bazel/remote/execution/v2:remote_execution_go_proto",
-        "@com_github_jmespath_go_jmespath//:go-jmespath",
         "@com_github_stretchr_testify//require",
         "@io_opentelemetry_go_otel//attribute",
         "@io_opentelemetry_go_otel_trace//:trace",
@@ -143,6 +145,7 @@ go_test(
         "@org_golang_google_grpc//peer",
         "@org_golang_google_grpc//status",
         "@org_golang_google_protobuf//proto",
+        "@org_golang_google_protobuf//types/known/durationpb",
         "@org_golang_google_protobuf//types/known/emptypb",
         "@org_golang_google_protobuf//types/known/structpb",
         "@org_uber_go_mock//gomock",

pkg/grpc/authenticator.go

@@ -7,11 +7,11 @@ import (
 	"github.com/buildbarn/bb-storage/pkg/auth"
 	"github.com/buildbarn/bb-storage/pkg/clock"
 	"github.com/buildbarn/bb-storage/pkg/eviction"
+	"github.com/buildbarn/bb-storage/pkg/jmespath"
 	"github.com/buildbarn/bb-storage/pkg/jwt"
 	"github.com/buildbarn/bb-storage/pkg/program"
 	configuration "github.com/buildbarn/bb-storage/pkg/proto/configuration/grpc"
 	"github.com/buildbarn/bb-storage/pkg/util"
-	"github.com/jmespath/go-jmespath"
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -72,11 +72,11 @@ func NewAuthenticatorFromConfiguration(policy *configuration.AuthenticationPolic
 		if !clientCAs.AppendCertsFromPEM([]byte(policyKind.TlsClientCertificate.ClientCertificateAuthorities)) {
 			return nil, false, false, status.Error(codes.InvalidArgument, "Failed to parse client certificate authorities")
 		}
-		validator, err := jmespath.Compile(policyKind.TlsClientCertificate.ValidationJmespathExpression)
+		validator, err := jmespath.NewExpressionFromConfiguration(policyKind.TlsClientCertificate.ValidationJmespathExpression, group)
 		if err != nil {
 			return nil, false, false, util.StatusWrap(err, "Failed to compile validation JMESPath expression")
 		}
-		metadataExtractor, err := jmespath.Compile(policyKind.TlsClientCertificate.MetadataExtractionJmespathExpression)
+		metadataExtractor, err := jmespath.NewExpressionFromConfiguration(policyKind.TlsClientCertificate.MetadataExtractionJmespathExpression, group)
 		if err != nil {
 			return nil, false, false, util.StatusWrap(err, "Failed to compile metadata extraction JMESPath expression")
 		}
@@ -93,7 +93,7 @@ func NewAuthenticatorFromConfiguration(policy *configuration.AuthenticationPolic
 		}
 		return NewRequestHeadersAuthenticator(authorizationHeaderParser, []string{jwt.AuthorizationHeaderName}), false, false, nil
 	case *configuration.AuthenticationPolicy_PeerCredentialsJmespathExpression:
-		metadataExtractor, err := jmespath.Compile(policyKind.PeerCredentialsJmespathExpression)
+		metadataExtractor, err := jmespath.NewExpressionFromConfiguration(policyKind.PeerCredentialsJmespathExpression, group)
 		if err != nil {
 			return nil, false, false, util.StatusWrap(err, "Failed to compile peer credentials metadata extraction JMESPath expression")
 		}

pkg/grpc/base_client_factory.go

@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"net/url"
 
+	"github.com/buildbarn/bb-storage/pkg/jmespath"
 	configuration "github.com/buildbarn/bb-storage/pkg/proto/configuration/grpc"
 	"github.com/buildbarn/bb-storage/pkg/util"
-	"github.com/jmespath/go-jmespath"
 
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -178,8 +178,8 @@ func (cf baseClientFactory) NewClientFromConfiguration(config *configuration.Cli
 	}
 
 	// Optional: metadata extraction.
-	if jmesExpression := config.AddMetadataJmespathExpression; jmesExpression != "" {
-		expr, err := jmespath.Compile(jmesExpression)
+	if jmesExpression := config.AddMetadataJmespathExpression; jmesExpression != nil {
+		expr, err := jmespath.NewExpressionFromConfiguration(jmesExpression, nil)
 		if err != nil {
 			return nil, util.StatusWrap(err, "Failed to compile JMESPath expression")
 		}

pkg/grpc/jmespath_extractor.go

@@ -4,8 +4,8 @@ import (
 	"context"
 
 	"github.com/buildbarn/bb-storage/pkg/auth"
+	"github.com/buildbarn/bb-storage/pkg/jmespath"
 	"github.com/buildbarn/bb-storage/pkg/util"
-	"github.com/jmespath/go-jmespath"
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
@@ -21,22 +21,23 @@ import (
 // structure:
 //
 //	{
-//	    "authenticationMetadata": value,
-//	    "incomingGRPCMetadata": map<string, repeated string>
+//	  "authenticationMetadata": value,
+//	  "files": map<string, any>,
+//	  "incomingGRPCMetadata": map<string, repeated string>
 //	}
-func NewJMESPathMetadataExtractor(expression *jmespath.JMESPath) (MetadataExtractor, error) {
+func NewJMESPathMetadataExtractor(expression *jmespath.Expression) (MetadataExtractor, error) {
 	return func(ctx context.Context) (MetadataHeaderValues, error) {
-		searchContext := make(map[string]interface{}, 2)
+		searchContext := make(map[string]interface{}, 3)
 		if authenticationMetadata := auth.AuthenticationMetadataFromContext(ctx); authenticationMetadata != nil {
 			searchContext["authenticationMetadata"] = authenticationMetadata.GetRaw()
 		}
 
 		if md, ok := metadata.FromIncomingContext(ctx); ok {
 			// JMESPath only treats map[string]interface{}, struct, or *struct as map types,
 			// so we need to copy from the map[string][]string.
-			incomingGRPCMetadata := make(map[string]interface{}, len(md))
+			incomingGRPCMetadata := make(map[string]any, len(md))
 			for k, rawVs := range md {
-				vs := make([]interface{}, 0, len(rawVs))
+				vs := make([]any, 0, len(rawVs))
 				for _, rawV := range rawVs {
 					vs = append(vs, rawV)
 				}

pkg/grpc/jmespath_extractor_test.go

@@ -2,19 +2,25 @@ package grpc_test
 
 import (
 	"context"
+	"os"
+	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/buildbarn/bb-storage/pkg/auth"
 	"github.com/buildbarn/bb-storage/pkg/grpc"
+	"github.com/buildbarn/bb-storage/pkg/jmespath"
+	"github.com/buildbarn/bb-storage/pkg/program"
 	auth_pb "github.com/buildbarn/bb-storage/pkg/proto/auth"
+	jmespath_pb "github.com/buildbarn/bb-storage/pkg/proto/jmespath"
 	"github.com/buildbarn/bb-storage/pkg/testutil"
 	"github.com/buildbarn/bb-storage/pkg/util"
-	"github.com/jmespath/go-jmespath"
 	"github.com/stretchr/testify/require"
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/structpb"
 )
 
@@ -83,3 +89,71 @@ func TestJMESPathMetadataExtractorAuthMatchToHeterogenousSlice(t *testing.T) {
 	_, err = extractor(ctx)
 	testutil.RequireEqualStatus(t, status.Errorf(codes.InvalidArgument, "Failed to extract JMESPath result: Non-string metadata value"), err)
 }
+
+func TestNewJMESPathMetadataFileProvider(t *testing.T) {
+	// Build the extractor.
+	ctx, cancel := context.WithCancel(context.Background())
+	program.RunLocal(ctx, func(ctx context.Context, siblingsGroup, dependenciesGroup program.Group) error {
+		// Create a temporary file with test content.
+		tempDir := t.TempDir()
+		filePath := filepath.Join(tempDir, "test-token")
+		err := os.WriteFile(filePath, []byte("token-value1"), 0o644)
+		require.NoError(t, err)
+
+		expr, err := jmespath.NewExpressionFromConfiguration(
+			&jmespath_pb.Expression{
+				Expression: `{"authorization": [files.token]}`,
+				Files: []*jmespath_pb.File{
+					{
+						Key:             "token",
+						Path:            filePath,
+						RefreshInterval: durationpb.New(time.Millisecond),
+					},
+				},
+				TestVectors: []*jmespath_pb.TestVector{
+					{
+						Input: util.Must(structpb.NewStruct(map[string]any{
+							"files": map[string]any{
+								"token": "tv-token-value",
+							},
+						})),
+						ExpectedOutput: util.Must(structpb.NewValue(map[string]any{
+							"authorization": []any{"tv-token-value"},
+						})),
+					},
+				},
+			},
+			siblingsGroup,
+		)
+		require.NoError(t, err)
+		extractor, err := grpc.NewJMESPathMetadataExtractor(expr)
+		require.NoError(t, err)
+
+		// Validate the initial contents are correct.
+		headers, err := extractor(ctx)
+		require.NoError(t, err)
+		want := grpc.MetadataHeaderValues([]string{
+			"authorization", "token-value1",
+		})
+		require.Equal(t, want, headers)
+
+		// Modify the file.
+		err = os.WriteFile(filePath, []byte("token-value2"), 0o644)
+		require.NoError(t, err)
+
+		// Wait for the file to be reloaded. This is potentially fragile.
+		time.Sleep(time.Second)
+
+		// Validate the updated contents are correct.
+		headers, err = extractor(ctx)
+		require.NoError(t, err)
+		want = grpc.MetadataHeaderValues([]string{
+			"authorization", "token-value2",
+		})
+		require.Equal(t, want, headers)
+
+		// Cancel the context to stop the file reloading.
+		cancel()
+		return nil
+	})
+}