get client id and secret from parameter store

.github/workflows/deploy.yml

@@ -102,4 +102,6 @@ jobs:
             -backend-config="dynamodb_table=${{ secrets.TERRAFORM_LOCK_DYNAMODB_TABLE }}"
           terraform apply -auto-approve \
             -var="deployment_id=${{ steps.branch.outputs.branch }}" \
-            -var="restler_image_tag=${{ secrets.AWS_DEFAULT_ACCOUNT }}.dkr.ecr.${{ secrets.AWS_DEFAULT_REGION }}.amazonaws.com/${{ steps.branch.outputs.branch }}_dyno_image_repository:${{ github.sha }}";
+            -var="restler_image_tag=${{ secrets.AWS_DEFAULT_ACCOUNT }}.dkr.ecr.${{ secrets.AWS_DEFAULT_REGION }}.amazonaws.com/${{ steps.branch.outputs.branch }}_dyno_image_repository:${{ github.sha }}"; \
+            -var="client_id=${{ secrets.GIT_HUB_CLIENT_ID }}" \
+            -var="client_secret=${{ secrets.GIT_HUB_CLIENT_SECRET }}" 

internal/authentication/gettoken.go

@@ -1,6 +1,7 @@
 package authentication
 
 import (
+	"dyno/internal/logger"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -15,29 +16,29 @@ type GitHubUserInfo struct {
 	ID    float64
 }
 
-type Conf struct {
-	ClientID     string
-	ClientSecret string
-	RedirectURL  string
-}
-
-var conf = Conf{
-	ClientID:     "", // fill in with your id before test
-	ClientSecret: "", // fill in with your secret before test
-	RedirectURL:  "",
-}
-
 type Token struct {
 	AccessToken string `json:"access_token"`
 	TokenType   string `json:"token_type"`
 	Scope       string `json:"scope"`
 }
 
-func GetTokenAuthURL(code string) string {
+func GetTokenAuthURL(code string) (string, error) {
+	ClientID, err := getSSMParameterValue("client_id")
+	if err != nil {
+		logger.Error(err.Error())
+		return "", err
+	}
+
+	ClientSecret, err := getSSMParameterValue("client_secret")
+	if err != nil {
+		logger.Error(err.Error())
+		return "", err
+	}
+
 	return fmt.Sprintf(
 		"https://github.com/login/oauth/access_token?client_id=%s&client_secret=%s&code=%s",
-		conf.ClientID, conf.ClientSecret, code,
-	)
+		ClientID, ClientSecret, code,
+	), nil
 }
 
 func GetToken(url string) (*Token, error) {

internal/endpoints/auth.go

@@ -6,6 +6,7 @@ import (
 
 	"dyno/internal/authentication"
 	"dyno/internal/logger"
+
 	"github.com/swaggest/rest/web"
 	"github.com/swaggest/usecase"
 	"github.com/swaggest/usecase/status"
@@ -26,7 +27,13 @@ func Authentication(service *web.Service) {
 
 		var err error
 		var code = in.Code
-		var tokenAuthURL = authentication.GetTokenAuthURL(code)
+		var tokenAuthURL string
+
+		if tokenAuthURL, err = authentication.GetTokenAuthURL(code); err != nil {
+			logger.Error(err.Error())
+			return err
+		}
+
 		var token *authentication.Token
 		if token, err = authentication.GetToken(tokenAuthURL); err != nil {
 			logger.Error(err.Error())

terraform/main.tf

@@ -20,6 +20,8 @@ module "main" {
   source                 = "./main"
   deployment_id          = var.deployment_id
   restler_lambda_timeout = var.restler_lambda_timeout
+  client_id              = var.client_id
+  client_secret          = var.client_secret
 }
 
 module "ecr" {

terraform/main/rsakey.tf

@@ -8,4 +8,25 @@ resource "aws_ssm_parameter" "private_key" {
   type      = "String"
   value     = tls_private_key.rsa_prikey.private_key_pem
   overwrite = true
+}
+
+resource "aws_ssm_parameter" "public_key" {
+  name      = "${var.deployment_id}-pubkey"
+  type      = "String"
+  value     = tls_private_key.rsa_prikey.public_key_pem
+  overwrite = true
+}
+
+resource "aws_ssm_parameter" "client_id" {
+  name      = "${var.deployment_id}-client_id"
+  type      = "String"
+  value     = var.client_id
+  overwrite = true
+}
+
+resource "aws_ssm_parameter" "client_secret" {
+  name      = "${var.deployment_id}-client_secret"
+  type      = "String"
+  value     = var.client_secret
+  overwrite = true
 }

terraform/main/variables.tf

@@ -7,4 +7,16 @@ variable "restler_lambda_timeout" {
   type        = number
   description = "restler lambda timeout - also used by SQS"
   default     = 60
+}
+
+variable "client_id" {
+  type        = string
+  description = "GitHub OAuth client ID"
+
+}
+
+variable "client_secret" {
+  type        = string
+  description = "GitHub OAuth client secret"
+
 }

terraform/variables.tf

@@ -16,4 +16,16 @@ variable "restler_lambda_timeout" {
   type        = number
   description = "restler lambda timeout - also used by SQS"
   default     = 300
+}
+
+variable "client_id" {
+  type        = string
+  description = "GitHub OAuth client ID"
+
+}
+
+variable "client_secret" {
+  type        = string
+  description = "GitHub OAuth client secret"
+
 }