Auth Token feature #1952

barreiro · 2024-08-26T13:43:49Z

as discussed in #1922

barreiro · 2024-09-10T03:20:45Z

This feature is now ready for review

lampajr · 2024-09-19T13:52:55Z

Hey Luis, sorry for delay! I am planning to review this one by today/tomorrow.. I'll come back to you asap 🚀

lampajr

Hey again,

Here a first round of review, overall looks good and looks working. I tried the use case where I try to upload a new run and it looks working using the generated API key.

curl -s --url-query "test=optaplanner-jmh-benchmarks-8x" -X POST -H "content-type: application/json" -H 'X-Horreum-API-Key: <MY_KEY>' 'http://localhost:8080/api/run/data' -d @/tmp/op-run.json

There are still a couple of comments:

@barreiro could you please rebase this on top of master? those changes shouldn't affect this feature but just to be sure.
Return error msg when the API Key validation failed, I tried to run the same upload command with either a fake key or a revoked one and in both cases no error is returned to the user even if the request failed.

Here an example:
If don't send any auth token, the rest will return a generic error msg:

$ curl -s --url-query "test=optaplanner-jmh-benchmarks-8x" --url-query "owner=optaplanner-team" --url-query "start=2024-07-09T09:45:38" --url-query "stop=2024-07-09T09:45:38" -X POST -H "content-type: application/json"  'http://localhost:8080/api/run/data' -d @/tmp/op-run.json

Cannot upload to test optaplanner-jmh-benchmarks-8x%

and in the logs I see (in DEBUG)

DEBUG [io.hyp.too.hor.svc.TestServiceImpl] (executor-thread-1) Failed to retrieve test optaplanner-jmh-benchmarks-8x as this user ( = []) is not uploader for optaplanner-team and token null does not match

If I send, instead, a revoked token:

$ curl -s --url-query "test=optaplanner-jmh-benchmarks-8x" --url-query "owner=optaplanner-team" --url-query "start=2024-07-09T09:45:38" --url-query "stop=2024-07-09T09:45:38" -X POST -H "content-type: application/json" -H 'X-Horreum-API-Key: HUSR_0A1CE383_38D9_4AFB_B094_99B0D6D6BE73' 'http://localhost:8080/api/run/data' -d @/tmp/op-run.json

there is no response at all and no logs as well, I think it could be very useful to return at least an error msg, even a generic "cannot upload to test ..."

In the UI, when there is no API keys set the webview still shows the table columns:

I would suggest to show just the button when there is no API keys set similarly to what we are doing in other places - or showing a message like "No API keys set" and below the button (that's actually just a minor).

johnaohara

@barreiro this looks great!

For this PR, we need user docs adding

For future PR's i think we need to open issues to;

add global management of keys at admin level
remove "tokens" and "machine accounts" features

johnaohara · 2024-09-20T10:45:35Z

horreum-api/src/main/java/io/hyperfoil/tools/horreum/api/internal/services/UserService.java

+        public LocalDate creation;
+        public LocalDate access;


For all other timestamps in the API, we have returned an Instant object, and configured the object mapper to use the jackson JSR310 datatype. We have validated to work across all the supported clients.
IDK how LocalDate serializes / deserializes to json and if it is portable across the different clients.

I think we should stick to returning Instant in the REST API unless there is a compelling reason not to

johnaohara · 2024-09-20T11:08:12Z

horreum-backend/src/main/java/io/hyperfoil/tools/horreum/entity/user/UserApiKey.java

+    @Transient
+    private final UUID randomnessSource;
+
+    private final String hash;


Do we need a unique constraint on user & hash? If there is a hash collision of API keys, what happens?

If in the future, we create 2 keys with different authorization levels, could we have 2 keys in the db with the same hash? in that case could we distinguish between the keys?

johnaohara · 2024-09-20T11:09:21Z

horreum-backend/src/main/java/io/hyperfoil/tools/horreum/entity/user/UserApiKey.java

+    @Enumerated
+    public final UserService.KeyType type;
+
+    public LocalDate creation, access;


Similar comment as in API about Instant we probably want to standarize unless compelling reason not to.

johnaohara · 2024-09-20T11:56:05Z

horreum-backend/src/main/java/io/hyperfoil/tools/horreum/entity/user/UserApiKey.java

+    public int compareTo(UserApiKey other) {
+        return Comparator.<UserApiKey, LocalDate> comparing(a -> a.creation).thenComparing(a -> a.id).compare(this, other);
+    }


just out of curiosity, when do we need to sort the API Keys?

johnaohara · 2024-09-20T12:00:49Z

horreum-backend/src/main/java/io/hyperfoil/tools/horreum/entity/user/UserApiKey.java

+    public UserService.ApiKeyResponse toResponse() {
+        UserService.ApiKeyResponse response = new UserService.ApiKeyResponse();
+        response.id = id;
+        response.name = name;
+        response.type = type;
+        response.creation = creation;
+        response.access = access;
+        response.isRevoked = revoked;
+        response.toExpiration = toExpiration(LocalDate.now());
+        return response;
+    }


For all other entities, mapping has been decoupled from the API via Mappers defined in the io.hyperfoil.tools.horreum.mapper package

johnaohara · 2024-09-20T12:08:37Z

horreum-backend/src/main/java/io/hyperfoil/tools/horreum/server/ApiKeyIdentityProvider.java

+                    // update last access
+                    userKey.access = timeService.today();
+
+                    // create identity with just the principal, roles will be populated in RolesAugmentor


Is there strict ordering between ApiKeyIdentityProvider and RolesAugmentor?

johnaohara · 2024-09-20T12:21:58Z

horreum-backend/src/main/java/io/hyperfoil/tools/horreum/svc/UserServiceImpl.java

+        newKey.persist();
+        userInfo.persist();
+
+        Log.infov("{0} created API key \"{1}\"", getUsername(), request.name == null ? "" : request.name);


I think this should be debug level

johnaohara · 2024-09-20T12:23:53Z

horreum-backend/src/main/java/io/hyperfoil/tools/horreum/svc/UserServiceImpl.java

+        }
+        String oldName = key.name;
+        key.name = newName == null ? "" : newName;
+        Log.infov("{0} renamed API key \"{1}\" to \"{2}\"", getUsername(), oldName, newName == null ? "" : newName);


I think this should be debug level

johnaohara · 2024-09-20T12:23:57Z

horreum-backend/src/main/java/io/hyperfoil/tools/horreum/svc/UserServiceImpl.java

+        UserApiKey key = UserApiKey.<UserApiKey> findByIdOptional(keyId)
+                .orElseThrow(() -> ServiceException.notFound(format("Key with id {0} not found", keyId)));
+        key.revoked = true;
+        Log.infov("{0} revoked API key \"{1}\"", getUsername(), key.name);


I think this should be debug level

johnaohara · 2024-09-20T12:24:02Z

horreum-backend/src/main/java/io/hyperfoil/tools/horreum/svc/UserServiceImpl.java

+        }
+        // revoke expired keys -- could be done directly in the DB but iterate instead to be able to log
+        UserApiKey.<UserApiKey> stream("#UserApiKey.pastExpiration", timeService.today()).forEach(key -> {
+            Log.infov("Revoked idle API key \"{0}\"", key.name);


I think this should be debug level

barreiro force-pushed the auth-tokens branch 6 times, most recently from dd6925e to 636d6ac Compare August 30, 2024 04:54

API keys feature

b0ed068

barreiro force-pushed the auth-tokens branch from 636d6ac to b0ed068 Compare September 10, 2024 03:17

barreiro requested review from johnaohara, willr3 and lampajr September 10, 2024 03:19

barreiro marked this pull request as ready for review September 10, 2024 03:19

johnaohara assigned barreiro Sep 14, 2024

lampajr reviewed Sep 20, 2024

View reviewed changes

johnaohara requested changes Sep 20, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Auth Token feature #1952

Auth Token feature #1952

barreiro commented Aug 26, 2024

barreiro commented Sep 10, 2024

lampajr commented Sep 19, 2024

lampajr left a comment

johnaohara left a comment

johnaohara Sep 20, 2024

johnaohara Sep 20, 2024

johnaohara Sep 20, 2024

johnaohara Sep 20, 2024

johnaohara Sep 20, 2024

johnaohara Sep 20, 2024

johnaohara Sep 20, 2024

johnaohara Sep 20, 2024

johnaohara Sep 20, 2024

johnaohara Sep 20, 2024

Auth Token feature #1952

Are you sure you want to change the base?

Auth Token feature #1952

Conversation

barreiro commented Aug 26, 2024

barreiro commented Sep 10, 2024

lampajr commented Sep 19, 2024

lampajr left a comment

Choose a reason for hiding this comment

johnaohara left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment