feat: statistics for orphaned tokens #7568
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
1 Skipped Deployment
|
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Manifest Files |
Tymek
force-pushed
the
orphaned-tokens-stats
branch
from
37cef8f to
09f6f83
Compare
| @@ -82,7 +82,9 @@ beforeAll(async () => { | |||
| const config = createTestConfig({ | |||
| getLogger, | |||
| experimental: { | |||
| flags: {}, | |||
| flags: { | |||
| cleanApiTokenWhenOrphaned: true, | |||
There was a problem hiding this comment.
That's fun. Killswitch being disabled by default was masking that tests related to other flag don't pass.
Tymek
force-pushed
the
orphaned-tokens-stats
branch
from
a81c901 to
e1f61d5
Compare
| @@ -227,6 +227,40 @@ export const instanceAdminStatsSchema = { | |||
| example: | |||
| 'b023323477abb1eb145bebf3cdb30a1c2063e3edc1f7ae474ed8ed6c80de9a3b', | |||
| }, | |||
| deprecatedTokens: { | |||
There was a problem hiding this comment.
if we don't add this info to instance stats and only to metrics.ts then this part is not needed
There was a problem hiding this comment.
👍🏻 I'll get metrics from store, in collectStaticCounters, skipping instance stats
| name: 'test', | ||
| }); | ||
| await stores.apiTokenStore.insert({ | ||
| secret: '*:*.be44368985f7fb3237c584ef86f3d6bdada42ddbd63a019d26955178', |
There was a problem hiding this comment.
which of the fields in the token are important. can we emphasize the fields that matter and hide then one that don't? e.g. if only secret counts const orphanedToken = token('*:*.be44368985f7fb3237c584ef86f3d6bdada42ddbd63a019d26955178')
There was a problem hiding this comment.
Almost all fields can count - for example tokens of ADMIN type can't be orphaned, because it doesn't have projects. At the same time it can be in v1 or v2 format. I'm providing a variety of possible correct tokens.
About the changes
Token Validation Updates:
createTokenRowReducerto exclude tokens in v1 format from orphaned tokens. Those where created before the concept of project and environment and are always wildcard tokens.Metrics Monitoring:
countDeprecatedTokensto count:orphanedTokens- tokens that cause issues, because of wildcard accessactiveOrphanedTokens(within last 3 months)legacyTokens- tokens in v1 format - metric added in case we would like to deprecate or migrate it couple of major version in the futureactiveLegacyTokens(within last 3 months)New Prometheus fields are:
orphaned_api_tokens_total,orphaned_api_tokens_active,legacy_api_tokens_total,legacy_api_tokens_activeallowOrphanedWildcardTokenskill switch default totrue.