6 files changed, 259 insertions, 0 deletions

diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/cache.go b/vendor/github.com/hashicorp/terraform/svchost/auth/cache.go
new file mode 100644
index 0000000..4f0d168
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/cache.go
@@ -0,0 +1,45 @@
+package auth
+
+import (
+        "github.com/hashicorp/terraform/svchost"
+)
+
+// CachingCredentialsSource creates a new credentials source that wraps another
+// and caches its results in memory, on a per-hostname basis.
+//
+// No means is provided for expiration of cached credentials, so a caching
+// credentials source should have a limited lifetime (one Terraform operation,
+// for example) to ensure that time-limited credentials don't expire before
+// their cache entries do.
+func CachingCredentialsSource(source CredentialsSource) CredentialsSource {
+        return &cachingCredentialsSource{
+                source: source,
+                cache:  map[svchost.Hostname]HostCredentials{},
+        }
+}
+
+type cachingCredentialsSource struct {
+        source CredentialsSource
+        cache  map[svchost.Hostname]HostCredentials
+}
+
+// ForHost passes the given hostname on to the wrapped credentials source and
+// caches the result to return for future requests with the same hostname.
+//
+// Both credentials and non-credentials (nil) responses are cached.
+//
+// No cache entry is created if the wrapped source returns an error, to allow
+// the caller to retry the failing operation.
+func (s *cachingCredentialsSource) ForHost(host svchost.Hostname) (HostCredentials, error) {
+        if cache, cached := s.cache[host]; cached {
+                return cache, nil
+        }
+
+        result, err := s.source.ForHost(host)
+        if err != nil {
+                return result, err
+        }
+
+        s.cache[host] = result
+        return result, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/credentials.go b/vendor/github.com/hashicorp/terraform/svchost/auth/credentials.go
new file mode 100644
index 0000000..0372c16
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/credentials.go
@@ -0,0 +1,63 @@
+// Package auth contains types and functions to manage authentication
+// credentials for service hosts.
+package auth
+
+import (
+        "net/http"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+// Credentials is a list of CredentialsSource objects that can be tried in
+// turn until one returns credentials for a host, or one returns an error.
+//
+// A Credentials is itself a CredentialsSource, wrapping its members.
+// In principle one CredentialsSource can be nested inside another, though
+// there is no good reason to do so.
+type Credentials []CredentialsSource
+
+// NoCredentials is an empty CredentialsSource that always returns nil
+// when asked for credentials.
+var NoCredentials CredentialsSource = Credentials{}
+
+// A CredentialsSource is an object that may be able to provide credentials
+// for a given host.
+//
+// Credentials lookups are not guaranteed to be concurrency-safe. Callers
+// using these facilities in concurrent code must use external concurrency
+// primitives to prevent race conditions.
+type CredentialsSource interface {
+        // ForHost returns a non-nil HostCredentials if the source has credentials
+        // available for the host, and a nil HostCredentials if it does not.
+        //
+        // If an error is returned, progress through a list of CredentialsSources
+        // is halted and the error is returned to the user.
+        ForHost(host svchost.Hostname) (HostCredentials, error)
+}
+
+// HostCredentials represents a single set of credentials for a particular
+// host.
+type HostCredentials interface {
+        // PrepareRequest modifies the given request in-place to apply the
+        // receiving credentials. The usual behavior of this method is to
+        // add some sort of Authorization header to the request.
+        PrepareRequest(req *http.Request)
+
+        // Token returns the authentication token.
+        Token() string
+}
+
+// ForHost iterates over the contained CredentialsSource objects and
+// tries to obtain credentials for the given host from each one in turn.
+//
+// If any source returns either a non-nil HostCredentials or a non-nil error
+// then this result is returned. Otherwise, the result is nil, nil.
+func (c Credentials) ForHost(host svchost.Hostname) (HostCredentials, error) {
+        for _, source := range c {
+                creds, err := source.ForHost(host)
+                if creds != nil || err != nil {
+                        return creds, err
+                }
+        }
+        return nil, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/from_map.go b/vendor/github.com/hashicorp/terraform/svchost/auth/from_map.go
new file mode 100644
index 0000000..f91006a
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/from_map.go
@@ -0,0 +1,18 @@
+package auth
+
+// HostCredentialsFromMap converts a map of key-value pairs from a credentials
+// definition provided by the user (e.g. in a config file, or via a credentials
+// helper) into a HostCredentials object if possible, or returns nil if
+// no credentials could be extracted from the map.
+//
+// This function ignores map keys it is unfamiliar with, to allow for future
+// expansion of the credentials map format for new credential types.
+func HostCredentialsFromMap(m map[string]interface{}) HostCredentials {
+        if m == nil {
+                return nil
+        }
+        if token, ok := m["token"].(string); ok {
+                return HostCredentialsToken(token)
+        }
+        return nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/helper_program.go b/vendor/github.com/hashicorp/terraform/svchost/auth/helper_program.go
new file mode 100644
index 0000000..d72ffe3
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/helper_program.go
@@ -0,0 +1,80 @@
+package auth
+
+import (
+        "bytes"
+        "encoding/json"
+        "fmt"
+        "os/exec"
+        "path/filepath"
+
+        "github.com/hashicorp/terraform/svchost"
+)
+
+type helperProgramCredentialsSource struct {
+        executable string
+        args       []string
+}
+
+// HelperProgramCredentialsSource returns a CredentialsSource that runs the
+// given program with the given arguments in order to obtain credentials.
+//
+// The given executable path must be an absolute path; it is the caller's
+// responsibility to validate and process a relative path or other input
+// provided by an end-user. If the given path is not absolute, this
+// function will panic.
+//
+// When credentials are requested, the program will be run in a child process
+// with the given arguments along with two additional arguments added to the
+// end of the list: the literal string "get", followed by the requested
+// hostname in ASCII compatibility form (punycode form).
+func HelperProgramCredentialsSource(executable string, args ...string) CredentialsSource {
+        if !filepath.IsAbs(executable) {
+                panic("NewCredentialsSourceHelperProgram requires absolute path to executable")
+        }
+
+        fullArgs := make([]string, len(args)+1)
+        fullArgs[0] = executable
+        copy(fullArgs[1:], args)
+
+        return &helperProgramCredentialsSource{
+                executable: executable,
+                args:       fullArgs,
+        }
+}
+
+func (s *helperProgramCredentialsSource) ForHost(host svchost.Hostname) (HostCredentials, error) {
+        args := make([]string, len(s.args), len(s.args)+2)
+        copy(args, s.args)
+        args = append(args, "get")
+        args = append(args, string(host))
+
+        outBuf := bytes.Buffer{}
+        errBuf := bytes.Buffer{}
+
+        cmd := exec.Cmd{
+                Path:   s.executable,
+                Args:   args,
+                Stdin:  nil,
+                Stdout: &outBuf,
+                Stderr: &errBuf,
+        }
+        err := cmd.Run()
+        if _, isExitErr := err.(*exec.ExitError); isExitErr {
+                errText := errBuf.String()
+                if errText == "" {
+                        // Shouldn't happen for a well-behaved helper program
+                        return nil, fmt.Errorf("error in %s, but it produced no error message", s.executable)
+                }
+                return nil, fmt.Errorf("error in %s: %s", s.executable, errText)
+        } else if err != nil {
+                return nil, fmt.Errorf("failed to run %s: %s", s.executable, err)
+        }
+
+        var m map[string]interface{}
+        err = json.Unmarshal(outBuf.Bytes(), &m)
+        if err != nil {
+                return nil, fmt.Errorf("malformed output from %s: %s", s.executable, err)
+        }
+
+        return HostCredentialsFromMap(m), nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/static.go b/vendor/github.com/hashicorp/terraform/svchost/auth/static.go
new file mode 100644
index 0000000..5373fdd
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/static.go
@@ -0,0 +1,28 @@
+package auth
+
+import (
+        "github.com/hashicorp/terraform/svchost"
+)
+
+// StaticCredentialsSource is a credentials source that retrieves credentials
+// from the provided map. It returns nil if a requested hostname is not
+// present in the map.
+//
+// The caller should not modify the given map after passing it to this function.
+func StaticCredentialsSource(creds map[svchost.Hostname]map[string]interface{}) CredentialsSource {
+        return staticCredentialsSource(creds)
+}
+
+type staticCredentialsSource map[svchost.Hostname]map[string]interface{}
+
+func (s staticCredentialsSource) ForHost(host svchost.Hostname) (HostCredentials, error) {
+        if s == nil {
+                return nil, nil
+        }
+
+        if m, exists := s[host]; exists {
+                return HostCredentialsFromMap(m), nil
+        }
+
+        return nil, nil
+}
diff --git a/vendor/github.com/hashicorp/terraform/svchost/auth/token_credentials.go b/vendor/github.com/hashicorp/terraform/svchost/auth/token_credentials.go
new file mode 100644
index 0000000..9358bcb
--- /dev/null
+++ b/vendor/github.com/hashicorp/terraform/svchost/auth/token_credentials.go
@@ -0,0 +1,25 @@
+package auth
+
+import (
+        "net/http"
+)
+
+// HostCredentialsToken is a HostCredentials implementation that represents a
+// single "bearer token", to be sent to the server via an Authorization header
+// with the auth type set to "Bearer"
+type HostCredentialsToken string
+
+// PrepareRequest alters the given HTTP request by setting its Authorization
+// header to the string "Bearer " followed by the encapsulated authentication
+// token.
+func (tc HostCredentialsToken) PrepareRequest(req *http.Request) {
+        if req.Header == nil {
+                req.Header = http.Header{}
+        }
+        req.Header.Set("Authorization", "Bearer "+string(tc))
+}
+
+// Token returns the authentication token.
+func (tc HostCredentialsToken) Token() string {
+        return string(tc)
+}