backend: auth: Extract ParseClusterAndToken from headlamp.go

[skoeva]

This change extracts the ParseClusterAndToken from headlamp.go into the new auth package.

Part of:

• backend: Add auth package from headlamp.go OIDC functions #3482

Updates

• Handles case-insensitive Bearer and trims spaces
• Reuses the compiled regex
• Validates cluster contexts and tokens
• Rejects multiple tokens and handles paths with no cluster

Testing

cd backend
go test -v -p 1 ./... -run TestParseClusterAndToken

[illume]

I like how you moved the regex compilation out of the function.

Looking at how shouldBypassOIDCRefresh uses the return values of this, I noticed above there was a check that the URL is a /clusters/ URL or not, but it's good to check in this function and a regex is being used anyway.

I found the spec for the "Authorization: Bearer" token is here: https://datatracker.ietf.org/doc/html/rfc6750#section-2.1 (Probably worth adding this link into the function documentation).

I wonder if we should add validation of the token characters in here? (see valid ones in the spec above). I feel like they should be validated... but is here the right spot?

Technically this is a cluster context we are taking in from the URL. Although there is ambiguity in the frontend UI between cluster names and context names, I think we should be specific in the backend and mention that we are returning a cluster context.

The other thing I was wondering if we should validate is the cluster context name? We do validate that in other parts of our code, so maybe here too?

[illume]

Note: we should check all the different formats manually. #3494 (comment)

Also, makeDNSFriendly doesn't handle @ characters, and it should? Plus some other things ($ signs etc). These work in the URL, so we should let these characters validate.

In kubeconfig.go it loads all of kubeconfigs and replaces the context names with dns friendly ones. So we assume the cluster from the URL is dns friendly. (That is, the / and ' ' are converted to something that works in URLs).

[illume]

🎉 thanks!

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: illume, skoeva

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [illume]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment