danielcweeks commented on code in PR #15703: URL: https://github.com/apache/iceberg/pull/15703#discussion_r3632408364
########## core/src/main/java/org/apache/iceberg/rest/auth/oauth2/LegacyConfigAdaptor.java: ########## @@ -0,0 +1,459 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.iceberg.rest.auth.oauth2; + +import com.nimbusds.oauth2.sdk.GrantType; +import com.nimbusds.oauth2.sdk.id.Audience; +import com.nimbusds.oauth2.sdk.id.ClientID; +import com.nimbusds.oauth2.sdk.token.TokenTypeURI; +import com.nimbusds.oauth2.sdk.token.TypelessAccessToken; +import java.net.URI; +import java.time.Duration; +import java.util.List; +import java.util.Map; +import java.util.Map.Entry; +import java.util.Set; +import java.util.function.BiConsumer; +import java.util.stream.Collectors; +import org.apache.iceberg.relocated.com.google.common.annotations.VisibleForTesting; +import org.apache.iceberg.relocated.com.google.common.base.Preconditions; +import org.apache.iceberg.relocated.com.google.common.base.Splitter; +import org.apache.iceberg.relocated.com.google.common.collect.Lists; +import org.apache.iceberg.relocated.com.google.common.collect.Maps; +import org.apache.iceberg.rest.RESTUtil; +import org.apache.iceberg.rest.ResourcePaths; +import org.apache.iceberg.rest.auth.OAuth2Properties; +import org.apache.iceberg.util.PropertyUtil; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +/** + * A component for adapting from legacy OAuth2 properties (from {@link OAuth2Properties}) to the new + * OAuth2 properties (as declared in {@link OAuth2Config}). + */ +@SuppressWarnings("deprecation") +final class LegacyConfigAdaptor { + + /** + * The default client ID to use when no client ID is provided in the legacy {@link + * OAuth2Properties#CREDENTIAL} property. + */ + public static final ClientID DEFAULT_CLIENT_ID = new ClientID("iceberg"); + + private static final Logger LOGGER = LoggerFactory.getLogger(LegacyConfigAdaptor.class); + + private static final Splitter CREDENTIAL_SPLITTER = Splitter.on(":").limit(2).trimResults(); + + private static final Set<String> TABLE_CONFIG_ALLOW_LIST = + Set.of( + BasicConfig.TOKEN, + TokenExchangeConfig.SUBJECT_TOKEN, + TokenExchangeConfig.SUBJECT_TOKEN_TYPE, + TokenExchangeConfig.ACTOR_TOKEN, + TokenExchangeConfig.ACTOR_TOKEN_TYPE); + + @VisibleForTesting + static final String MESSAGE_TEMPLATE_LEGACY_OPTION = + "Detected legacy OAuth2 property '{}', please use option{} {} instead."; + + @VisibleForTesting + static final String MESSAGE_TEMPLATE_NO_CLIENT_ID = + "The legacy OAuth2 property 'credential' was provided, but it did not contain a client ID; assuming '{}'."; + + @VisibleForTesting + static final String MESSAGE_TEMPLATE_MISSING_TOKEN_ENDPOINT = + "The OAuth2 configuration does not specify a token endpoint nor an issuer URL: " + + "the token endpoint URL will default to {}. " + + "This automatic fallback will be removed in a future Iceberg release. " + + "Please configure OAuth2 endpoints using the following properties: '{}' or '{}'. " + + "This warning will disappear if OAuth2 endpoints are properly configured. " + + "See https://github.com/apache/iceberg/issues/10537";; + + @VisibleForTesting + static final String MESSAGE_TEMPLATE_RELATIVE_TOKEN_ENDPOINT = + "The OAuth2 token endpoint URL is a relative URL. " + + "It will be resolved against the catalog URI, resulting in the absolute URL: '{}'. " + + "This automatic fallback will be removed in a future Iceberg release. " + + "Please configure OAuth2 endpoints using absolute URLs."; + + @VisibleForTesting + static final String MESSAGE_TEMPLATE_MERGED_CONTEXTUAL_CONFIG = + "The OAuth2 configuration property '{}' was not found in the context session, " + + "and will be inherited from the parent session. " + + "This automatic fallback will be removed in a future Iceberg release."; + + @VisibleForTesting + static final String MESSAGE_TEMPLATE_VENDED_TOKEN = + "The OAuth2 configuration property '{}' was found in the table configuration " + + "and indicates that the catalog server vended an OAuth2 token. " + + "Vended OAuth2 tokens will be disallowed in a future Iceberg release."; + + @VisibleForTesting + static final String MESSAGE_TEMPLATE_TABLE_CONFIG_NOT_ALLOWED = + "The OAuth2 configuration property '{}' is not allowed to be vended by catalog servers."; + + private final BiConsumer<String, String[]> logConsumer; + + LegacyConfigAdaptor() { + this(LOGGER); + } + + LegacyConfigAdaptor(Logger logger) { + this(logger::warn); + } + + @VisibleForTesting + LegacyConfigAdaptor(BiConsumer<String, String[]> logConsumer) { + this.logConsumer = logConsumer; + } + + /** + * Migrates catalog-level properties. + * + * <p>Legacy Iceberg OAuth2 properties are migrated, and warnings are logged for each detected + * legacy property. + * + * <p>The migration will further check the token endpoint for the following legacy situations: + * + * <ol> + * <li>If no token endpoint is provided, a default one will be added to the migrated properties; + * its value is the catalog URI + {@link ResourcePaths#tokens()} – that is, it will point to + * the (deprecated) REST Catalog token endpoint. + * <li>If a token endpoint is provided, but is a relative path, it will be resolved against the + * catalog URI. + * </ol> + * + * In both cases, a warning will be logged. + * + * @param properties The properties to migrate + * @param catalogUri The catalog URI, for extended token endpoint checks + */ + public OAuth2Config migrateCatalogConfig(Map<String, String> properties, String catalogUri) { Review Comment: ```suggestion public OAuth2Config fromCatalogConfig(Map<String, String> properties, String catalogUri) { ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
