diff --git a/app_dart/lib/src/request_handling/presubmit_authentication.dart b/app_dart/lib/src/request_handling/presubmit_authentication.dart index f41452bbc..d197bbcc5 100644 --- a/app_dart/lib/src/request_handling/presubmit_authentication.dart +++ b/app_dart/lib/src/request_handling/presubmit_authentication.dart @@ -48,7 +48,6 @@ class GithubAuthentication implements AuthenticationProvider { try { if (request.header('X-Flutter-IdToken') case final idTokenFromHeader?) { final token = await _validator.decodeAndVerify(idTokenFromHeader); - log.info('authing with github.com'); return await authenticateGithub( token, clientContext: _clientContextProvider(), @@ -65,17 +64,21 @@ class GithubAuthentication implements AuthenticationProvider { TokenInfo token, { required ClientContext clientContext, }) async { - final githubLogin = await _getGithubLoginCached( - token.firebase?.identities?['github.com']?.first, - ); - if (await _isGithubAllowedCached( - token.firebase?.identities?['github.com']?.first, - githubLogin, - )) { + final accountId = token.firebase?.identities?['github.com']?.first; + if (accountId == null) { + throw const Unauthenticated('Could not find github identity'); + } + log.info('authing with github.com accountId: $accountId'); + final login = await _getGithubLoginCached(accountId); + if (login == null) { + throw const Unauthenticated('Could not find github account'); + } + log.info('authing with github.com login: $login'); + if (await _isGithubLoginAllowedCached(login)) { return AuthenticatedContext( clientContext: clientContext, email: token.email!, - githubLogin: githubLogin, + githubLogin: login, ); } throw Unauthenticated( @@ -83,10 +86,7 @@ class GithubAuthentication implements AuthenticationProvider { ); } - Future _getGithubLogin(String? accountId) async { - if (accountId == null) { - return null; - } + Future _getGithubLogin(String accountId) async { final ghService = _config.createGithubServiceWithToken( await _config.githubOAuthToken, ); @@ -94,10 +94,10 @@ class GithubAuthentication implements AuthenticationProvider { return user.login; } - Future _getGithubLoginCached(String? accountId) async { + Future _getGithubLoginCached(String accountId) async { final bytes = await _cache.getOrCreate( 'github_account_login', - accountId ?? 'null_accountId', + accountId, createFn: () async => Uint8List.fromList( (await _getGithubLogin(accountId))?.codeUnits ?? [], ), @@ -106,11 +106,7 @@ class GithubAuthentication implements AuthenticationProvider { return login.isEmpty ? null : login; } - Future _isGithubAllowed(String? accountId, String? githubLogin) async { - final login = githubLogin ?? await _getGithubLogin(accountId); - if (login == null) { - return false; - } + Future _isGithubLoginAllowed(String login) async { final ghService = _config.createGithubServiceWithToken( await _config.githubOAuthToken, ); @@ -120,15 +116,11 @@ class GithubAuthentication implements AuthenticationProvider { ); } - Future _isGithubAllowedCached( - String? accountId, - String? githubLogin, - ) async { + Future _isGithubLoginAllowedCached(String login) async { final bytes = await _cache.getOrCreate( - 'github_account_allowed', - accountId ?? 'null_accountId', - createFn: () async => - (await _isGithubAllowed(accountId, githubLogin)).toUint8List(), + 'github_login_allowed', + login, + createFn: () async => (await _isGithubLoginAllowed(login)).toUint8List(), ); return bytes?.toBool() ?? false; }