prep admin to support multiple keys, per aud (siteID)

backend/_example/memory_store/accessor/admin.go

@@ -35,7 +35,7 @@ func NewMemAdminStore(key string) *MemAdmin {
 }
 
 // Key executes find by siteID and returns substructure with secret key
-func (m *MemAdmin) Key() (key string, err error) {
+func (m *MemAdmin) Key(_ string) (key string, err error) {
 	return m.key, nil
 }
 

backend/_example/memory_store/accessor/admin_test.go

@@ -31,7 +31,7 @@ func TestMemAdmin_Get(t *testing.T) {
 	email, err := ms.Email("site1")
 	assert.NoError(t, err)
 	assert.Equal(t, "e1", email)
-	key, err := ms.Key()
+	key, err := ms.Key("any")
 	assert.NoError(t, err)
 	assert.Equal(t, "secret", key)
 
@@ -41,7 +41,7 @@ func TestMemAdmin_Get(t *testing.T) {
 	email, err = ms.Email("site2")
 	assert.NoError(t, err)
 	assert.Equal(t, "e2", email)
-	key, err = ms.Key()
+	key, err = ms.Key("any")
 	assert.NoError(t, err)
 	assert.Equal(t, "secret", key)
 

backend/_example/memory_store/server/admin.go

@@ -15,8 +15,13 @@ import (
 )
 
 // get admin key
-func (s *RPC) admKeyHndl(id uint64, _ json.RawMessage) (rr jrpc.Response) {
-	key, err := s.adm.Key()
+func (s *RPC) admKeyHndl(id uint64, params json.RawMessage) (rr jrpc.Response) {
+	var siteID string
+	if err := json.Unmarshal(params, &siteID); err != nil {
+		return jrpc.Response{Error: err.Error()}
+	}
+
+	key, err := s.adm.Key(siteID)
 	if err != nil {
 		return jrpc.Response{Error: err.Error()}
 	}

backend/_example/memory_store/server/admin_test.go

@@ -24,7 +24,7 @@ func TestRPC_admKeyHndl(t *testing.T) {
 	api := fmt.Sprintf("http://localhost:%d/test", port)
 
 	ra := admin.RPC{Client: jrpc.Client{API: api, Client: http.Client{Timeout: 1 * time.Second}}}
-	key, err := ra.Key()
+	key, err := ra.Key("any")
 	assert.NoError(t, err)
 	assert.Equal(t, "secret", key)
 }

backend/app/cmd/server.go

@@ -908,7 +908,7 @@ func (s *ServerCommand) makeAuthenticator(ds *service.DataStore, avas avatar.Sto
 		SameSiteCookie: s.parseSameSite(s.Auth.SameSite),
 		SecureCookies:  strings.HasPrefix(s.RemarkURL, "https://"),
 		SecretReader: token.SecretFunc(func(aud string) (string, error) { // get secret per site
-			return admns.Key()
+			return admns.Key("")
 		}),
 		ClaimsUpd: token.ClaimsUpdFunc(func(c token.Claims) token.Claims { // set attributes, on new token or refresh
 			if c.User == nil {

backend/app/rest/api/migrator.go

@@ -37,7 +37,7 @@ type Migrator struct {
 
 // KeyStore defines sub-interface for consumers needed just a key
 type KeyStore interface {
-	Key() (key string, err error)
+	Key(siteID string) (key string, err error)
 }
 
 // POST /import?secret=key&site=site-id&provider=disqus|remark|wordpress

backend/app/store/admin/admin.go

@@ -10,7 +10,7 @@ import (
 
 // Store defines interface returning admins info for given site
 type Store interface {
-	Key() (key string, err error)
+	Key(siteID string) (key string, err error)
 	Admins(siteID string) (ids []string, err error)
 	Email(siteID string) (email string, err error)
 	Enabled(siteID string) (ok bool, err error)
@@ -48,7 +48,7 @@ func NewStaticKeyStore(key string) *StaticStore {
 }
 
 // Key returns static key, same for all sites
-func (s *StaticStore) Key() (key string, err error) {
+func (s *StaticStore) Key(_ string) (key string, err error) {
 	if s.key == "" {
 		return "", errors.New("empty key for static key store")
 	}

backend/app/store/admin/admin_test.go

@@ -10,7 +10,7 @@ func TestStaticStore_Get(t *testing.T) {
 	var ks Store = NewStaticStore("key123", []string{"s1", "s2", "s3"},
 		[]string{"123", "xyz"}, "aa@example.com")
 
-	k, err := ks.Key()
+	k, err := ks.Key("any")
 	assert.NoError(t, err, "valid store")
 	assert.Equal(t, "key123", k, "valid site")
 

backend/app/store/admin/remote.go

@@ -18,8 +18,8 @@ type RPC struct {
 }
 
 // Key returns the key, same for all sites
-func (r *RPC) Key() (key string, err error) {
-	resp, err := r.Call("admin.key")
+func (r *RPC) Key(siteID string) (key string, err error) {
+	resp, err := r.Call("admin.key", siteID)
 	if err != nil {
 		return "", err
 	}

backend/app/store/admin/remote_test.go

@@ -19,15 +19,15 @@ import (
 )
 
 func TestRemote_Key(t *testing.T) {
-	ts := testServer(t, `{"method":"admin.key","id":1}`,
-		`{"result":"12345","id":1}`)
+	ts := testServer(t, `{"method":"admin.key","params":"any","id":1}`,
+		`{"result":"12345","params":"any","id":1}`)
 	defer ts.Close()
 	c := RPC{Client: jrpc.Client{API: ts.URL, Client: http.Client{}}}
 
 	var a Store = &c
 	_ = a
 
-	res, err := c.Key()
+	res, err := c.Key("any")
 	assert.NoError(t, err)
 	assert.Equal(t, "12345", res)
 	t.Logf("%v %T", res, res)

backend/app/store/service/service.go

@@ -949,7 +949,7 @@ func (s *DataStore) prepVotes(c store.Comment, user store.User) store.Comment {
 // Note: secret shared across sites, but some sites can be disabled.
 func (s *DataStore) getSecret(siteID string) (secret string, err error) {
 
-	if secret, err = s.AdminStore.Key(); err != nil {
+	if secret, err = s.AdminStore.Key("any"); err != nil {
 		return "", errors.Wrapf(err, "can't get secret for site %s", siteID)
 	}