// AuthToken returns an unexpired auth token, blocking if necessary until
// authenticated
519406
func AuthToken(cancel <-chan interface{}) <-chan string {
	ch := make(chan string)
	go func() {
		defer close(ch)
		for expired() {
			select {
			case <-cond.Wait():
			case <-cancel:
				return
			}
		}
		ch <- currentToken
	}()
	return ch
}
1194639
func (b BlockServerMeasured) RefreshAuthToken(ctx context.Context) {
	b.delegate.RefreshAuthToken(ctx)
}
406344
func (s *CreateCustomMetadataInput) SetAuthenticationToken(v string) *CreateCustomMetadataInput {
	s.AuthenticationToken = &v
	return s
}
1111856
func (s *CreateCommentInput) SetAuthenticationToken(v string) *CreateCommentInput {
	s.AuthenticationToken = &v
	return s
}
157341
func (t *TokenRefresher) RefreshAuthToken() (string, error) {
	tokens, err := t.uaaClient.RefreshAccessToken(t.cache.RefreshToken())
	if err != nil {
		return "", err
	}

	t.cache.SetAccessToken(tokens.AuthorizationToken())
	t.cache.SetRefreshToken(tokens.RefreshToken)
	return tokens.AuthorizationToken(), nil
}
242467
func SignToken(c context.Context, signer signing.Signer, subtok *messages.Subtoken) (string, error) {
	s := tokensigning.Signer{
		Signer:         signer,
		SigningContext: tokenSigningContext,
		Wrap: func(w *tokensigning.Unwrapped) proto.Message {
			return &messages.DelegationToken{
				SerializedSubtoken: w.Body,
				Pkcs1Sha256Sig:     w.RsaSHA256Sig,
				SignerId:           "user:" + w.SignerID,
				SigningKeyId:       w.KeyID,
			}
		},
	}
	return s.SignToken(c, subtok)
}
1179401
func getAuthToken(u *dt.User) (header *Header, authToken string, err error) {
	scopes := []string{}
	if u.Admin {
		scopes = append(scopes, "admin")
	}
	header = &Header{
		ID:       u.ID,
		Email:    u.Email,
		Scopes:   scopes,
		IssuedAt: time.Now().Unix(),
	}
	byt, err := json.Marshal(header)
	if err != nil {
		return nil, "", err
	}
	hash := hmac.New(sha512.New, []byte(os.Getenv("ABOT_SECRET")))
	_, err = hash.Write(byt)
	if err != nil {
		return nil, "", err
	}
	authToken = base64.StdEncoding.EncodeToString(hash.Sum(nil))
	return header, authToken, nil
}
1371667
func (refreshTokenResponse RefreshedTokens) AuthorizationToken() string {
	return fmt.Sprintf("%s %s", refreshTokenResponse.Type, refreshTokenResponse.AccessToken)
}
753055
func (w *WebhookTokenAuthenticator) AuthenticateToken(ctx context.Context, token string) (*authenticator.Response, bool, error) {
	// We take implicit audiences of the API server at WebhookTokenAuthenticator
	// construction time. The outline of how we validate audience here is:
	//
	// * if the ctx is not audience limited, don't do any audience validation.
	// * if ctx is audience-limited, add the audiences to the tokenreview spec
	//   * if the tokenreview returns with audiences in the status that intersect
	//     with the audiences in the ctx, copy into the response and return success
	//   * if the tokenreview returns without an audience in the status, ensure
	//     the ctx audiences intersect with the implicit audiences, and set the
	//     intersection in the response.
	//   * otherwise return unauthenticated.
	wantAuds, checkAuds := authenticator.AudiencesFrom(ctx)
	r := &authentication.TokenReview{
		Spec: authentication.TokenReviewSpec{
			Token:     token,
			Audiences: wantAuds,
		},
	}
	var (
		result *authentication.TokenReview
		err    error
		auds   authenticator.Audiences
	)
	webhook.WithExponentialBackoff(w.initialBackoff, func() error {
		result, err = w.tokenReview.Create(r)
		return err
	})
	if err != nil {
		// An error here indicates bad configuration or an outage. Log for debugging.
		klog.Errorf("Failed to make webhook authenticator request: %v", err)
		return nil, false, err
	}

	if checkAuds {
		gotAuds := w.implicitAuds
		if len(result.Status.Audiences) > 0 {
			gotAuds = result.Status.Audiences
		}
		auds = wantAuds.Intersect(gotAuds)
		if len(auds) == 0 {
			return nil, false, nil
		}
	}

	r.Status = result.Status
	if !r.Status.Authenticated {
		var err error
		if len(r.Status.Error) != 0 {
			err = errors.New(r.Status.Error)
		}
		return nil, false, err
	}

	var extra map[string][]string
	if r.Status.User.Extra != nil {
		extra = map[string][]string{}
		for k, v := range r.Status.User.Extra {
			extra[k] = v
		}
	}

	return &authenticator.Response{
		User: &user.DefaultInfo{
			Name:   r.Status.User.Username,
			UID:    r.Status.User.UID,
			Groups: r.Status.User.Groups,
			Extra:  extra,
		},
		Audiences: auds,
	}, true, nil
}
867784
func (s *UpdateDocumentInput) SetAuthenticationToken(v string) *UpdateDocumentInput {
	s.AuthenticationToken = &v
	return s
}
102669
func (t *UAAAuthentication) refreshToken() error {
	var expiresIn time.Duration

	tokenStr := strings.TrimPrefix(t.cache.AccessToken(), "bearer ")
	token, err := jws.ParseJWT([]byte(tokenStr))
	if err != nil {
		// if the JWT could not be parsed, force a refresh
		expiresIn = 0
	} else {
		expiration, _ := token.Claims().Expiration()
		expiresIn = time.Until(expiration)
	}

	if expiresIn < accessTokenExpirationMargin {
		tokens, err := t.client.RefreshAccessToken(t.cache.RefreshToken())
		if err != nil {
			return err
		}
		t.cache.SetAccessToken(tokens.AuthorizationToken())
		t.cache.SetRefreshToken(tokens.RefreshToken)
	}
	return nil
}
1197003
func Token(ctx context.Context) *AuthorizationToken {
	v := ctx.Value(tokenIndex)
	if v == nil {
		return nil
	}
	return v.(*AuthorizationToken)
}
298595
func (r *Reference) Auth(token string) *Reference {
	r.token = token

	return r
}
1300132
func (t *TokenProvider) GetToken(audience string) (*auth.Token, error) {
	token := t.tokenProvider.Token()
	expireTicks, err := strconv.ParseInt(string(token.ExpiresOn), 10, 64)
	if err != nil {
		return nil, err
	}
	expires := time.Unix(expireTicks, 0)

	if expires.Before(time.Now()) {
		if err := t.tokenProvider.Refresh(); err != nil {
			return nil, err
		}
		token = t.tokenProvider.Token()
	}

	return auth.NewToken(auth.CBSTokenTypeJWT, token.AccessToken, string(token.ExpiresOn)), nil
}
495
func (s *CreateUserInput) SetAuthenticationToken(v string) *CreateUserInput {
	s.AuthenticationToken = &v
	return s
}
412520
func (c *Config) PasswordCredentialsToken(username, password string) (*oauth2.Token, error) {
	config := c.getConfig()
	token, err := config.PasswordCredentialsToken(c.getContext(), username, password)
	return token, fromError(err)
}
1278497
func (s *GetFolderPathInput) SetAuthenticationToken(v string) *GetFolderPathInput {
	s.AuthenticationToken = &v
	return s
}