Application passwords CLI commands

[gmgigi96]

Related to #1719

This PR add the commands token-list, token-remove and token-create to manage the application passwords.

>> token-create -share bvqoPVphGpchsDd:r -label share-home -expiration 2021-05-29
+------------------+-------------------------------------+------------+--------------------------------+--------------------------------+--------------------------------+
| TOKEN            | SCOPE                               | LABEL      | EXPIRATION                     | CREATION TIME                  | LAST USED TIME                 |
+------------------+-------------------------------------+------------+--------------------------------+--------------------------------+--------------------------------+
| 074136IMU2yRGnY5 | share:"bvqoPVphGpchsDd" ROLE_VIEWER | share-home | 2021-05-29 02:00:00 +0200 CEST | 2021-05-28 18:28:55 +0200 CEST | 2021-05-28 18:28:55 +0200 CEST |
+------------------+-------------------------------------+------------+--------------------------------+--------------------------------+--------------------------------+

Multiple share and path options are possible:

>> token-create -path /home:r -path /home/M:r -share CgAeSOEDmGeBrpc:w -label new
+------------------+-------------------------------------------------------------------------------------------+-------+------------+--------------------------------+--------------------------------+
| TOKEN            | SCOPE                                                                                     | LABEL | EXPIRATION | CREATION TIME                  | LAST USED TIME                 |
+------------------+-------------------------------------------------------------------------------------------+-------+------------+--------------------------------+--------------------------------+
| I9J0bU7geBK28351 | path:"/home" ROLE_VIEWER, path:"/home/M" ROLE_VIEWER, share:"CgAeSOEDmGeBrpc" ROLE_EDITOR | new   |            | 2021-05-28 19:24:12 +0200 CEST | 2021-05-28 19:24:12 +0200 CEST |
+------------------+-------------------------------------------------------------------------------------------+-------+------------+--------------------------------+--------------------------------+

>> token-list
+--------------------------------------------------------------+------------+-------------------------------------+--------------------------------+
| TOKEN                                                        | LABEL      | SCOPE                               | EXPIRATION                     |
+--------------------------------------------------------------+------------+-------------------------------------+--------------------------------+
| $2a$11$qidTRIgv7RQKqX3RAm/pXOdK7SSWm.LKYyK124Jmv1ROhbS5vXrGy | share-home | share:"bvqoPVphGpchsDd" ROLE_VIEWER | 2021-05-29 02:00:00 +0200 CEST |
+--------------------------------------------------------------+------------+-------------------------------------+--------------------------------+

(token-list also support some flags to filter the output list, like show only expired, show all, filter by label, as well as long and short print)

>> token-remove $2a$11$qidTRIgv7RQKqX3RAm/pXOdK7SSWm.LKYyK124Jmv1ROhbS5vXrGy
>> 

Example:

>> app-tokens-create -path /home/einstein:r
+------------------+-----------------------------------+-------+------------+--------------------------------+--------------------------------+
| TOKEN            | SCOPE                             | LABEL | EXPIRATION | CREATION TIME                  | LAST USED TIME                 |
+------------------+-----------------------------------+-------+------------+--------------------------------+--------------------------------+
| 4qS72Uv0a1J5r96O | path:"/home/einstein" ROLE_VIEWER |       |            | 2021-06-07 15:45:38 +0200 CEST | 2021-06-07 15:45:38 +0200 CEST |
+------------------+-----------------------------------+-------+------------+--------------------------------+--------------------------------+

>> login appauth
username: einstein
password: OK                          <--------- 4qS72Uv0a1J5r96O
>> stat /home
error: code=CODE_INTERNAL msg="gateway: stat ref: path:\"/home\" :gateway: error calling GetStorageProvider: rpc error: code = Unauthenticated desc = auth: core access token is invalid" support_trace="ba1b230c8de7db599a7b2ac080417039"
>> stat /home/einstein
type:RESOURCE_TYPE_CONTAINER id:<storage_id:"123e4567-e89b-12d3-a456-426655440000" opaque_id:"fileid-einstein%2Feinstein" > etag:"\"eb4168a24da50c8aec35b1a7795d50e2\"" mime_type:"httpd/unix-directory" mtime:<seconds:1623073363 > path:"/home/einstein" permission_set:<add_grant:true create_container:true delete:true get_path:true get_quota:true initiate_file_download:true initiate_file_upload:true list_grants:true list_container:true list_file_versions:true list_recycle:true move:true remove_grant:true purge_recycle:true restore_file_version:true restore_recycle_item:true stat:true update_grant:true > owner:<idp:"localhost:20080" opaque_id:"4c510ada-c86b-4815-8820-42cdf82c3d51" > arbitrary_metadata:<>

>> app-tokens-remove $2a$11$VZ5.0tMI9hTB8oSbOfovE.gRp35Q4y9wKkX8qJmE7d/sNBKs6eWYa
OK

>> login appauth
username: einstein
password: error: code=CODE_UNAUTHENTICATED msg="error authenticating user" support_trace="238db9418f10b5a4da632cd6b6c310a9"

[gmgigi96]

@ishank011

[ishank011]

Hi @gmgigi96. I added a few comments

[ishank011]

Can you also add the usage of these generated passwords in the description? You'll have to start the appauth auth driver and update the registry rules like this https://github.com/cs3org/reva/blob/master/examples/storage-references/gateway.toml#L18 https://github.com/cs3org/reva/blob/master/examples/storage-references/storage-public.toml#L11-L15

[gmgigi96]

Can you also add the usage of these generated passwords in the description? You'll have to start the appauth auth driver and update the registry rules like this https://github.com/cs3org/reva/blob/master/examples/storage-references/gateway.toml#L18 https://github.com/cs3org/reva/blob/master/examples/storage-references/storage-public.toml#L11-L15

Updated, let me know if it is ok

[ishank011]

@gmgigi96 looks good. But I meant that you could use the created password and show that it can only be used to access the resources present in the scope. For example

>> login appauth
>> stat /path/in/scope // Should proceed
>> stat /path/not/allowed // Should return permission denied

Also, can you add a new toml file to examples/storage-references with appauth auth? I'll merge it then

[gmgigi96]

@gmgigi96 looks good. But I meant that you could use the created password and show that it can only be used to access the resources present in the scope. For example

>> login appauth
>> stat /path/in/scope // Should proceed
>> stat /path/not/allowed // Should return permission denied

Also, can you add a new toml file to examples/storage-references with appauth auth? I'll merge it then

Thanks @ishank011, I will make the changes this afternoon