oauth-token

// An OAuth2 token, by the client credentials grant: the client id and its secret go in Basic (user=,
// password=), and url.query writes the form body. The collector watches how long the tokens the server
// hands out live, read in the token itself: a JWT, whose middle part is JSON in base64 for addresses.
need('protocol:http');
$client = need('protocol:http:user');
$secret = need('protocol:http:password');

$url = variable('example:oauth:url', 'text', array(
    'label' => 'Address of the token',
    'help'  => 'For example https://login.example/oauth2/token.',
));

output('lifetime', 'number', array('label' => 'Lifetime of a token', 'unit' => 'min'));

watch.below('short-lived', 'Tokens too short-lived', 'lifetime', array('warning' => 10));

// url.query writes key=value pairs joined by &, each one encoded: "monitoring read" keeps its blank.
$body = url.query(array('grant_type' => 'client_credentials', 'scope' => 'monitoring read'));
$answer = http.post($url, $body, headers=array('Content-Type' => 'application/x-www-form-urlencoded'), user=$client, password=$secret);
if ($answer['status'] != 200) {
    fail('misconfigured', 'Token refused, code ' . $answer['status']);
}

// {"access_token": "eyJ...", "token_type": "Bearer", ...}. A JWT is three parts joined by points:
// header, claims, signature.
$session = json.read($answer['body']);
$parts = text.split($session['access_token'], '.');
if (list.count($parts) != 3) {
    fail('misconfigured', 'The token is not a JWT');
}
// base64.url_decode reads the claims; iat and exp say when the token was issued and when it expires.
$claims = json.read(base64.url_decode($parts[1]));
value('lifetime', number.round(($claims['exp'] - $claims['iat']) / 60));