Skip to content

Introduce Credentials.forRun to contextualize secrets #293

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jglick merged 5 commits into from
Mar 26, 2022
Merged

Introduce Credentials.forRun to contextualize secrets #293

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
346b4fe
Introduce `Credentials.forRun` to comtextualize secrets
jglick Mar 23, 2022
80afc6a
Handle null result
jglick Mar 23, 2022
c1818e6
Call `track` on the original, not the clone
jglick Mar 23, 2022
4e37935
Warn if `getRun` returns an incompatible implementation class
jglick Mar 23, 2022
4b0eba2
Calling `forRun` from the other return path of `findCredentialById`
jglick Mar 23, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions src/main/java/com/cloudbees/plugins/credentials/Credentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
import edu.umd.cs.findbugs.annotations.NonNull;
import hudson.ExtensionPoint;
import hudson.model.Describable;
import hudson.model.Run;
import java.io.Serializable;

/**
Expand Down Expand Up @@ -54,4 +55,16 @@ public interface Credentials extends Describable<Credentials>, Serializable, Ext
@NonNull
@SuppressWarnings("unchecked")
CredentialsDescriptor getDescriptor();

/**
* Optionally produce a special value when used in the context of a particular build.
* @param context a build wishing to consume these credentials
* @return contextualized credentials, preferably implementing the same interfaces (if not of the same concrete type); by default, {@code this}
* @see CredentialsProvider#findCredentialById(java.lang.String, java.lang.Class, hudson.model.Run, com.cloudbees.plugins.credentials.domains.DomainRequirement...)
*/
@NonNull
default Credentials forRun(@NonNull Run<?, ?> context) {
return this;
}

}
21 changes: 19 additions & 2 deletions src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -916,7 +916,8 @@ public static <C extends IdCredentials> C findCredentialById(@NonNull String id,
CredentialsProvider.lookupCredentials(type, run.getParent(), ACL.SYSTEM, domainRequirements)
);
}
return CredentialsMatchers.firstOrNull(candidates, CredentialsMatchers.withId(id));
// TODO should this be calling track?
return contextualize(type, CredentialsMatchers.firstOrNull(candidates, CredentialsMatchers.withId(id)), run);
}
// this is a parameter and not the default value, we need to determine who triggered the build
final Map.Entry<User, Run<?, ?>> triggeredBy = triggeredBy(run);
Expand Down Expand Up @@ -957,7 +958,23 @@ public static <C extends IdCredentials> C findCredentialById(@NonNull String id,
C result = CredentialsMatchers.firstOrNull(candidates, CredentialsMatchers.withId(id));
// if the run has not completed yet then we can safely assume that the credential is being used for this run
// so we will track it's usage. We use isLogUpdated() as it could be used during post production
return run.isLogUpdated() ? track(run, result) : result;
if (run.isLogUpdated()) {
track(run, result);
}
return contextualize(type, result, run);
}

@CheckForNull
private static <C extends Credentials> C contextualize(@NonNull Class<C> type, @CheckForNull C credentials, @NonNull Run<?, ?> run) {
if (credentials != null) {
Credentials contextualized = credentials.forRun(run);
if (type.isInstance(contextualized)) {
return type.cast(contextualized);
} else {
LOGGER.warning(() -> "Ignoring " + contextualized.getClass().getName() + " return value of " + credentials.getClass().getName() + ".forRun since it is not assignable to " + type.getName());
}
}
return credentials;
}

/**
Expand Down