github.com/google/osv-scalibr@v0.4.1/veles/secrets/stripeapikeys/validator.go (about)

     1  // Copyright 2025 Google LLC
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //      http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  // Copyright 2025 Google LLC
    16  //
    17  // Licensed under the Apache License, Version 2.0 (the "License");
    18  // you may not use this file except in compliance with the License.
    19  // You may obtain a copy of the License at
    20  //
    21  // http://www.apache.org/licenses/LICENSE-2.0
    22  //
    23  // Unless required by applicable law or agreed to in writing, software
    24  // distributed under the License is distributed on an "AS IS" BASIS,
    25  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    26  // See the License for the specific language governing permissions and
    27  // limitations under the License.
    28  
    29  package stripeapikeys
    30  
    31  import (
    32  	"encoding/base64"
    33  	"io"
    34  	"net/http"
    35  	"time"
    36  
    37  	"github.com/google/osv-scalibr/veles"
    38  	"github.com/google/osv-scalibr/veles/secrets/common/simplevalidate"
    39  )
    40  
    41  const (
    42  	httpClientTimeout = 10 * time.Second
    43  	stripeAPIEndpoint = "https://api.stripe.com/v1/accounts"
    44  )
    45  
    46  func authHeader(key string) map[string]string {
    47  	return map[string]string{
    48  		"Authorization": "Basic " + base64.StdEncoding.EncodeToString([]byte(key+":")),
    49  	}
    50  }
    51  
    52  func alwaysInvalidStatus(body io.Reader) (veles.ValidationStatus, error) {
    53  	return veles.ValidationInvalid, nil
    54  }
    55  
    56  // NewSecretKeyValidator validates Stripe Secret Keys (sk_live_...) using /v1/accounts.
    57  //
    58  // It calls GET https://api.stripe.com/v1/accounts with Basic Auth. If the response
    59  // is 200 OK, the key is considered valid. Otherwise, it is considered invalid.
    60  func NewSecretKeyValidator() *simplevalidate.Validator[StripeSecretKey] {
    61  	return &simplevalidate.Validator[StripeSecretKey]{
    62  		Endpoint:   stripeAPIEndpoint,
    63  		HTTPMethod: http.MethodGet,
    64  		HTTPHeaders: func(k StripeSecretKey) map[string]string {
    65  			return authHeader(k.Key)
    66  		},
    67  		ValidResponseCodes:     []int{http.StatusOK},
    68  		StatusFromResponseBody: alwaysInvalidStatus,
    69  		HTTPC:                  &http.Client{Timeout: httpClientTimeout},
    70  	}
    71  }
    72  
    73  // NewRestrictedKeyValidator creates a validator for Stripe Restricted Keys.
    74  //
    75  // It calls GET https://api.stripe.com/v1/accounts with Basic Auth.
    76  // Restricted Keys are scoped to specific endpoints and permissions, so a 403
    77  // from /v1/accounts does not necessarily mean the key is invalid.
    78  // Possible outcomes:
    79  //   - 200 OK       -> key has access to this endpoint and is valid.
    80  //   - 403 Forbidden -> key is valid but lacks permission for this endpoint;
    81  //     it may still work for other allowed endpoints.
    82  //   - other         -> key is invalid.
    83  func NewRestrictedKeyValidator() *simplevalidate.Validator[StripeRestrictedKey] {
    84  	return &simplevalidate.Validator[StripeRestrictedKey]{
    85  		Endpoint:   stripeAPIEndpoint,
    86  		HTTPMethod: http.MethodGet,
    87  		HTTPHeaders: func(k StripeRestrictedKey) map[string]string {
    88  			return authHeader(k.Key)
    89  		},
    90  		ValidResponseCodes:     []int{http.StatusOK, http.StatusForbidden},
    91  		StatusFromResponseBody: alwaysInvalidStatus,
    92  		HTTPC:                  &http.Client{Timeout: httpClientTimeout},
    93  	}
    94  }