stacks: add support for authenticating directly via token (#262)

* stacks: add support for authenticating directly via token

* add basic test and changelog entry

Author: Liam Cervante

.changelog/262.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+IdentityProviderConfig accepts a workload credential directly.
+```

auth/workload/provider.go

@@ -29,6 +29,9 @@ type IdentityProviderConfig struct {
 	// File sources the subject credential from a file.
 	File *FileCredentialSource `json:"file,omitempty"`
 
+	// Token sources the credentials from a directly supplied token.
+	Token *CredentialTokenSource `json:"token,omitempty"`
+
 	// EnvironmentVariable sources the subject credential from an environment
 	// variable.
 	EnvironmentVariable *EnvironmentVariableCredentialSource `json:"env,omitempty"`
@@ -59,6 +62,13 @@ func (c *IdentityProviderConfig) Validate() error {
 		}
 	}
 
+	if c.Token != nil {
+		set++
+		if err := c.Token.Validate(); err != nil {
+			return err
+		}
+	}
+
 	if c.EnvironmentVariable != nil {
 		set++
 		if err := c.EnvironmentVariable.Validate(); err != nil {
@@ -129,6 +139,8 @@ func New(c *IdentityProviderConfig) (*Provider, error) {
 		p.jwtProvider = c.File
 	} else if c.EnvironmentVariable != nil {
 		p.jwtProvider = c.EnvironmentVariable
+	} else if c.Token != nil {
+		p.jwtProvider = c.Token
 	}
 
 	return p, nil

auth/workload/token.go

@@ -0,0 +1,22 @@
+package workload
+
+import "fmt"
+
+// CredentialTokenSource sources credentials via a directly supplied token.
+type CredentialTokenSource struct {
+	Token string `json:"token,omitempty"`
+}
+
+// Validate validates the config.
+func (ct *CredentialTokenSource) Validate() error {
+	if ct.Token == "" {
+		return fmt.Errorf("token must be set")
+	}
+
+	return nil
+}
+
+// token returns the token.
+func (ct *CredentialTokenSource) token() (string, error) {
+	return ct.Token, nil
+}

auth/workload/token_test.go

@@ -0,0 +1,31 @@
+package workload
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCredentialTokenSource_Validate(t *testing.T) {
+	tests := []struct {
+		name   string
+		ct     *CredentialTokenSource
+		errStr string
+	}{
+		{
+			name:   "empty token",
+			ct:     &CredentialTokenSource{},
+			errStr: "token must be set",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := test.ct.Validate()
+			if test.errStr == "" {
+				require.NoError(t, err)
+			} else {
+				require.ErrorContains(t, err, test.errStr)
+			}
+		})
+	}
+}