Support function authentication with OpenFaaS IAM

commands/faas.go

@@ -15,6 +15,7 @@ import (
 	"syscall"
 
 	"github.com/moby/term"
+	"github.com/openfaas/faas-cli/stack"
 	"github.com/openfaas/faas-cli/version"
 	"github.com/spf13/cobra"
 )
@@ -47,6 +48,9 @@ var (
 	tlsInsecure  bool
 )
 
+// Services parsed from stack file
+var services *stack.Services
+
 var stat = func(filename string) (os.FileInfo, error) {
 	return os.Stat(filename)
 }

commands/general.go

@@ -2,13 +2,14 @@ package commands
 
 import (
 	"crypto/tls"
+	"fmt"
 	"net"
 	"net/http"
 	"net/url"
 	"os"
 	"time"
 
-	"github.com/openfaas/faas-cli/proxy"
+	"github.com/openfaas/faas-cli/config"
 	"github.com/openfaas/go-sdk"
 )
 
@@ -43,27 +44,78 @@ func GetDefaultCLITransport(tlsInsecure bool, timeout *time.Duration) *http.Tran
 }
 
 func GetDefaultSDKClient() (*sdk.Client, error) {
-	gatewayAddress := getGatewayURL(gateway, defaultGateway, "", os.Getenv(openFaaSURLEnvironment))
+	var yamlUrl string
+	if services != nil {
+		yamlUrl = services.Provider.GatewayURL
+	}
+
+	gatewayAddress := getGatewayURL(gateway, defaultGateway, yamlUrl, os.Getenv(openFaaSURLEnvironment))
 	gatewayURL, err := url.Parse(gatewayAddress)
 	if err != nil {
 		return nil, err
 	}
 
-	transport := GetDefaultCLITransport(tlsInsecure, &commandTimeout)
+	authConfig, err := config.LookupAuthConfig(gatewayURL.String())
+	if err != nil {
+		fmt.Printf("Failed to lookup auth config: %s\n", err)
+	}
+
+	var clientAuth sdk.ClientAuth
+	var functionTokenSource sdk.TokenSource
+	if authConfig.Auth == config.BasicAuthType {
+		username, password, err := config.DecodeAuth(authConfig.Token)
+		if err != nil {
+			return nil, err
+		}
+
+		clientAuth = &sdk.BasicAuth{
+			Username: username,
+			Password: password,
+		}
+	}
+
+	if authConfig.Auth == config.Oauth2AuthType {
+		tokenAuth := &StaticTokenAuth{
+			token: authConfig.Token,
+		}
+
+		clientAuth = tokenAuth
+		functionTokenSource = tokenAuth
+	}
+
+	// User specified token gets priority
+	if len(token) > 0 {
+		tokenAuth := &StaticTokenAuth{
+			token: token,
+		}
+
+		clientAuth = tokenAuth
+		functionTokenSource = tokenAuth
+	}
 
 	httpClient := &http.Client{}
 	httpClient.Timeout = commandTimeout
 
+	transport := GetDefaultCLITransport(tlsInsecure, &commandTimeout)
 	if transport != nil {
 		httpClient.Transport = transport
 	}
 
-	clientAuth, err := proxy.NewCLIAuth(token, gatewayAddress)
-	if err != nil {
-		return nil, err
-	}
+	return sdk.NewClientWithOpts(gatewayURL, httpClient,
+		sdk.WithAuthentication(clientAuth),
+		sdk.WithFunctionTokenSource(functionTokenSource),
+	), nil
+}
+
+type StaticTokenAuth struct {
+	token string
+}
 
-	client := sdk.NewClient(gatewayURL, clientAuth, http.DefaultClient)
+func (a *StaticTokenAuth) Set(req *http.Request) error {
+	req.Header.Add("Authorization", "Bearer "+a.token)
+	return nil
+}
 
-	return client, nil
+func (ts *StaticTokenAuth) Token() (string, error) {
+	return ts.token, nil
 }