refactor: use tailscale api for user checking instead of tsnet (#978)

internal/service/oauth_extractors.go

@@ -1,10 +1,8 @@
 package service
 
 import (
-	"encoding/json"
+	"context"
 	"errors"
-	"fmt"
-	"io"
 	"net/http"
 	"strconv"
 
@@ -23,21 +21,21 @@ type GithubUserinfoResponse struct {
 	ID    int    `json:"id"`
 }
 
-func defaultExtractor(client *http.Client, url string) (*model.Claims, error) {
-	return simpleReq[model.Claims](client, url, nil)
+func defaultExtractor(client *http.Client, ctx context.Context, url string) (*model.Claims, error) {
+	return simpleReq[model.Claims](client, ctx, url, nil)
 }
 
-func githubExtractor(client *http.Client, _ string) (*model.Claims, error) {
+func githubExtractor(client *http.Client, ctx context.Context, _ string) (*model.Claims, error) {
 	var user model.Claims
 
-	userInfo, err := simpleReq[GithubUserinfoResponse](client, "https://api.github.com/user", map[string]string{
+	userInfo, err := simpleReq[GithubUserinfoResponse](client, ctx, "https://api.github.com/user", map[string]string{
 		"accept": "application/vnd.github+json",
 	})
 	if err != nil {
 		return nil, err
 	}
 
-	userEmails, err := simpleReq[GithubEmailResponse](client, "https://api.github.com/user/emails", map[string]string{
+	userEmails, err := simpleReq[GithubEmailResponse](client, ctx, "https://api.github.com/user/emails", map[string]string{
 		"accept": "application/vnd.github+json",
 	})
 	if err != nil {
@@ -75,38 +73,3 @@ func githubExtractor(client *http.Client, _ string) (*model.Claims, error) {
 
 	return &user, nil
 }
-
-func simpleReq[T any](client *http.Client, url string, headers map[string]string) (*T, error) {
-	var decodedRes T
-
-	req, err := http.NewRequest("GET", url, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	for key, value := range headers {
-		req.Header.Add(key, value)
-	}
-
-	res, err := client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer res.Body.Close()
-
-	if res.StatusCode < 200 || res.StatusCode >= 300 {
-		return nil, fmt.Errorf("request failed with status: %s", res.Status)
-	}
-
-	body, err := io.ReadAll(res.Body)
-	if err != nil {
-		return nil, err
-	}
-
-	err = json.Unmarshal(body, &decodedRes)
-	if err != nil {
-		return nil, err
-	}
-
-	return &decodedRes, nil
-}

internal/service/oauth_service.go

@@ -10,7 +10,7 @@ import (
 	"golang.org/x/oauth2"
 )
 
-type OAuthUserinfoExtractor func(client *http.Client, url string) (*model.Claims, error)
+type OAuthUserinfoExtractor func(client *http.Client, ctx context.Context, url string) (*model.Claims, error)
 
 type OAuthService struct {
 	serviceCfg        model.OAuthServiceConfig
@@ -80,7 +80,7 @@ func (s *OAuthService) GetToken(code string, verifier string) (*oauth2.Token, er
 
 func (s *OAuthService) GetUserinfo(token *oauth2.Token) (*model.Claims, error) {
 	client := oauth2.NewClient(s.ctx, oauth2.StaticTokenSource(token))
-	return s.userinfoExtractor(client, s.serviceCfg.UserinfoURL)
+	return s.userinfoExtractor(client, s.ctx, s.serviceCfg.UserinfoURL)
 }
 
 func (s *OAuthService) GetConfig() model.OAuthServiceConfig {

internal/service/simple_req.go

@@ -0,0 +1,48 @@
+package service
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+)
+
+func simpleReq[T any](client *http.Client, ctx context.Context, url string, headers map[string]string) (*T, error) {
+	var decodedRes T
+
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	for key, value := range headers {
+		req.Header.Add(key, value)
+	}
+
+	res, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode < 200 || res.StatusCode >= 300 {
+		body, err := io.ReadAll(res.Body)
+		if err != nil {
+			return nil, fmt.Errorf("request failed with status: %s", res.Status)
+		}
+		return nil, fmt.Errorf("request failed with status: %s and body: %s", res.Status, body)
+	}
+
+	body, err := io.ReadAll(res.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	err = json.Unmarshal(body, &decodedRes)
+	if err != nil {
+		return nil, err
+	}
+
+	return &decodedRes, nil
+}

internal/service/tailscale_service.go

@@ -2,197 +2,243 @@ package service
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"net"
-	"strings"
-	"sync"
+	"net/http"
 	"time"
 
 	"github.com/steveiliop56/ding"
 	"github.com/tinyauthapp/tinyauth/internal/model"
+	"github.com/tinyauthapp/tinyauth/internal/utils"
 	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 	"go.uber.org/dig"
-	"tailscale.com/client/local"
-	"tailscale.com/tsnet"
 )
 
+const tailscaleAPIBaseURL = "https://api.tailscale.com/api/v2"
+
+var (
+	tailscaleAPIDeviceList = func(tailnet string) string {
+		return tailscaleAPIBaseURL + "/tailnet/" + tailnet + "/devices"
+	}
+	tailscaleAPIUserList = func(tailnet string) string {
+		return tailscaleAPIBaseURL + "/tailnet/" + tailnet + "/users"
+	}
+)
+
+type tailscaleDevice struct {
+	Addresses []string `json:"addresses"`
+	User      string   `json:"user"`
+	Name      string   `json:"name"`
+	Tags      []string `json:"tags"`
+}
+
+type tailscaleAPIDevices struct {
+	Devices []tailscaleDevice `json:"devices"`
+}
+
+type tailscaleUser struct {
+	DisplayName string `json:"displayName"`
+	LoginName   string `json:"loginName"`
+}
+
+type tailscaleAPIUsers struct {
+	Users []tailscaleUser `json:"users"`
+}
+
 type TailscaleWhoisResponse struct {
-	UserID      string
-	LoginName   string
 	DisplayName string
+	LoginName   string
 	NodeName    string
 }
 
 type TailscaleService struct {
-	log    *logger.Logger
 	config *model.Config
+	log    *logger.Logger
+	client *http.Client
 	ctx    context.Context
 
-	srv *tsnet.Server
-	lc  *local.Client
-	ln  *net.Listener
-	mu  sync.Mutex
+	apiToken string
+
+	caches struct {
+		devices *CacheStore[tailscaleAPIDevices]
+		users   *CacheStore[tailscaleAPIUsers]
+	}
+
+	urls struct {
+		devices string
+		users   string
+	}
 }
 
 type TailscaleServiceInput struct {
 	dig.In
 
-	Log    *logger.Logger
-	Config *model.Config
-	Ctx    context.Context
 	Ding   *ding.Ding
+	Config *model.Config
+	Log    *logger.Logger
+	Ctx    context.Context
 }
 
 func NewTailscaleService(i TailscaleServiceInput) (*TailscaleService, error) {
-	if !i.Config.Experimental.Tailscale.Enabled {
+	if !i.Config.Tailscale.Enabled {
 		return nil, nil
 	}
 
-	srv := new(tsnet.Server)
-
-	// node options
-	srv.Dir = i.Config.Experimental.Tailscale.Dir
-	srv.Hostname = i.Config.Experimental.Tailscale.Hostname
-	srv.AuthKey = i.Config.Experimental.Tailscale.AuthKey
-	srv.Ephemeral = i.Config.Experimental.Tailscale.Ephemeral
-
-	// redirect logs to zerolog
-	srv.Logf = i.Log.App.Printf
-	srv.UserLogf = i.Log.App.Printf
-
-	err := srv.Start()
-
-	if err != nil {
-		return nil, fmt.Errorf("failed to start tailscale server: %w", err)
+	if i.Config.Tailscale.Tailnet == "" {
+		return nil, fmt.Errorf("tailscale tailnet not set")
 	}
 
-	lc, err := srv.LocalClient()
+	apiToken := utils.GetSecret(i.Config.Tailscale.APIToken, i.Config.Tailscale.APITokenFile)
 
-	if err != nil {
-		_ = srv.Close()
-		return nil, fmt.Errorf("failed to get tailscale local client: %w", err)
+	if apiToken == "" {
+		return nil, fmt.Errorf("tailscale api token not set")
 	}
 
-	service := &TailscaleService{
-		log:    i.Log,
-		config: i.Config,
-		ctx:    i.Ctx,
-		srv:    srv,
-		lc:     lc,
+	s := &TailscaleService{
+		config:   i.Config,
+		log:      i.Log,
+		ctx:      i.Ctx,
+		apiToken: apiToken,
 	}
 
-	connectCtx, cancel := context.WithTimeout(i.Ctx, 2*time.Minute) // large enough timeout to allow for user to manually authenticate with link if needed
-	defer cancel()
+	devicesCache := NewCacheStore[tailscaleAPIDevices](0)
+	usersCache := NewCacheStore[tailscaleAPIUsers](0)
 
-	err = service.waitForConn(connectCtx)
+	s.caches.devices = devicesCache
+	s.caches.users = usersCache
 
-	if err != nil {
-		_ = srv.Close()
-		return nil, fmt.Errorf("failed to connect to tailscale network: %w", err)
-	}
+	i.Ding.Go(func(ctx context.Context) {
+		ticker := time.NewTicker(1 * time.Minute)
+		defer ticker.Stop()
 
-	i.Ding.Go(service.watchAndClose, ding.RingMajor)
-
-	if i.Config.Experimental.Tailscale.Funnel && !i.Config.Experimental.Tailscale.Listen {
-		service.log.App.Warn().Msg("Tailscale Funnel is enabled but listen is disabled. Funnel will not work without listen enabled.")
-	}
-
-	return service, nil
-}
-
-func (ts *TailscaleService) watchAndClose(ctx context.Context) {
-	<-ctx.Done()
-	ts.log.App.Debug().Msg("Shutting down Tailscale service")
-	ts.mu.Lock()
-	srv := ts.srv
-	ln := ts.ln
-	ts.ln = nil
-	ts.srv = nil
-	ts.mu.Unlock()
-	if ln != nil {
-		(*ln).Close()
-	}
-	if srv != nil {
-		srv.Close()
-	}
-}
-
-func (ts *TailscaleService) Whois(ctx context.Context, addr string) (*TailscaleWhoisResponse, error) {
-	who, err := ts.lc.WhoIs(ctx, addr)
-
-	if err != nil {
-		if errors.Is(err, local.ErrPeerNotFound) {
-			return nil, nil
-		}
-		return nil, fmt.Errorf("failed to get client whois: %w", err)
-	}
-
-	if who.Node.IsTagged() {
-		ts.log.App.Debug().Msgf("Skipping whois for tagged node %s", who.Node.Name)
-		return nil, nil
-	}
-
-	uid := strings.TrimPrefix(who.UserProfile.ID.String(), "userid:")
-
-	res := TailscaleWhoisResponse{
-		UserID:      uid,
-		LoginName:   who.UserProfile.LoginName,
-		DisplayName: who.UserProfile.DisplayName,
-		NodeName:    strings.TrimSuffix(who.Node.Name, "."),
-	}
-
-	return &res, nil
-}
-
-func (ts *TailscaleService) CreateListener() (net.Listener, error) {
-	ts.mu.Lock()
-	defer ts.mu.Unlock()
-
-	if ts.ln != nil {
-		return *ts.ln, nil
-	}
-
-	if ts.config.Experimental.Tailscale.Funnel {
-		ln, err := ts.srv.ListenFunnel("tcp", ":443")
-		if err != nil {
-			return nil, err
-		}
-		ts.ln = &ln
-		return ln, nil
-	}
-
-	ln, err := ts.srv.ListenTLS("tcp", ":443")
-	if err != nil {
-		return nil, err
-	}
-	ts.ln = &ln
-	return ln, nil
-}
-
-func (ts *TailscaleService) GetHostname() string {
-	status, err := ts.lc.Status(ts.ctx)
-
-	if err != nil {
-		ts.log.App.Error().Err(err).Msg("Failed to get Tailscale status")
-		return ""
-	}
-
-	return strings.TrimSuffix(status.Self.DNSName, ".")
-}
-
-func (ts *TailscaleService) waitForConn(ctx context.Context) error {
-	for {
-		select {
-		case <-ctx.Done():
-			return fmt.Errorf("timed out waiting for tailscale connection")
-		default:
-			ip4, _ := ts.srv.TailscaleIPs()
-			if !ip4.IsValid() {
-				time.Sleep(1 * time.Second)
-				continue
+		for {
+			select {
+			case <-ticker.C:
+				s.caches.devices.Sweep()
+				s.caches.users.Sweep()
+			case <-ctx.Done():
+				return
+			}
+		}
+	}, ding.RingMinor)
+
+	s.urls.devices = tailscaleAPIDeviceList(i.Config.Tailscale.Tailnet)
+	s.urls.users = tailscaleAPIUserList(i.Config.Tailscale.Tailnet)
+	s.client = &http.Client{
+		Timeout: 10 * time.Second,
+	}
+
+	_, _, err := s.getDeviceList()
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to get device list: %w", err)
+	}
+
+	_, _, err = s.getUsersList()
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to get user list: %w", err)
+	}
+
+	s.log.App.Info().Msg("Tailscale service initialized")
+
+	return s, nil
+}
+
+func (s *TailscaleService) buildAuthorizationHeader() string {
+	return "Bearer " + s.apiToken
+}
+
+func (s *TailscaleService) getDeviceList() (*tailscaleAPIDevices, bool, error) {
+	cached, ok := s.caches.devices.Get("devices")
+
+	if ok {
+		return &cached, true, nil
+	}
+
+	devices, err := simpleReq[tailscaleAPIDevices](s.client, s.ctx, s.urls.devices, map[string]string{
+		"Authorization": s.buildAuthorizationHeader(),
+	})
+
+	if err != nil {
+		return nil, false, fmt.Errorf("failed to get device list: %w", err)
+	}
+
+	s.caches.devices.Set("devices", *devices, time.Duration(s.config.Tailscale.CacheDuration)*time.Second)
+
+	return devices, false, nil
+}
+
+func (s *TailscaleService) getUsersList() (*tailscaleAPIUsers, bool, error) {
+	cached, ok := s.caches.users.Get("users")
+
+	if ok {
+		return &cached, true, nil
+	}
+
+	users, err := simpleReq[tailscaleAPIUsers](s.client, s.ctx, s.urls.users, map[string]string{
+		"Authorization": s.buildAuthorizationHeader(),
+	})
+
+	if err != nil {
+		return nil, false, fmt.Errorf("failed to get user list: %w", err)
+	}
+
+	s.caches.users.Set("users", *users, time.Duration(s.config.Tailscale.CacheDuration)*time.Second)
+
+	return users, false, nil
+}
+
+func (s *TailscaleService) Whois(addr string) (*TailscaleWhoisResponse, error) {
+	var device *tailscaleDevice
+
+	devices, dCacheHit, err := s.getDeviceList()
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to get device list: %w", err)
+	}
+
+	for _, d := range devices.Devices {
+		if len(d.Tags) != 0 {
+			continue
+		}
+		for _, a := range d.Addresses {
+			if a == addr {
+				device = &d
+				break
 			}
-			return nil
 		}
 	}
+
+	if device == nil {
+		return nil, nil
+	}
+
+	s.log.App.Debug().Str("device", device.Name).Bool("cache_hit", dCacheHit).Msg("Tailscale device found")
+
+	var user *tailscaleUser
+
+	users, uCacheHit, err := s.getUsersList()
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to get user list: %w", err)
+	}
+
+	for _, u := range users.Users {
+		if u.LoginName == device.User {
+			user = &u
+			break
+		}
+	}
+
+	if user == nil {
+		return nil, nil
+	}
+
+	s.log.App.Debug().Str("user", user.LoginName).Bool("cache_hit", uCacheHit).Msg("Tailscale user found")
+
+	return &TailscaleWhoisResponse{
+		LoginName:   user.LoginName,
+		DisplayName: user.DisplayName,
+		NodeName:    device.Name,
+	}, nil
 }