[Rest Server] Application token api #3774

sunqinzheng · 2019-10-25T11:28:05Z

Changes

Token format

Application will be a JSON Web Token with an additional boolean field application
- User / frontend service can decode the jwt and get if the token is an application token
Since we will query k8s secret when authentication (check if it is revoked), the admin field in jwt is removed. The permission info will be retrieved dynamically from k8s secret

Storage

The signed jwt list will be stored in the pai-user-token namespace of k8s secret
Each user's token list will be a k8s secret item
- name: username's hex string
- data: uuid -> token
The namespace will be created (if not exist) when rest server starts

Authentication error

Token is expired error message is removed.
Only a token is invalid error message will be shown now.

k8s secret model

Since previous k8s secret interface is implemented for specific use, a new k8s secret interface (model) for general use is implemented.

API routes

GET /api/v1/token
- Get list of available tokens (portal token + application token)
POST /api/v1/token/application
- Generate an application token
DELETE /api/v1/token/:token
- Revoke a token (portal token / application token)

Test Cases

Token

Login and get the browser token from cookies
Decode the jwt token and the data should not conclude admin field.
Check if the token is stored in k8s secret's pai-user-token namespace as the structure described before.
Revoke the browser token through rest api
View home page through web portal, and "invalid token" alert message will be popped out.

Application Token

Tested in unit test "userToken.js"

abuccts

LGTM

abuccts · 2019-10-29T02:47:43Z

src/rest-server/src/controllers/v2/token.js

      token: token,
      admin: admin,
-      hasGitHubPAT: userInfo.extension.hasOwnProperty('githubPAT')&& Boolean(userInfo.extension['githubPAT']),
+      hasGitHubPAT: userItem.extension.githubPAT,


do not need hasGitHubPAT any more?

I don't know the current state of github pat feature.
I just keep the original logic and simplify the code.

Binyang2014 · 2019-10-29T08:38:54Z

src/rest-server/src/middlewares/token.js

+    if (token.username === username && token.application) {
+      return token;
+    } else {
+      throw new Error('Invalid authorization header');
    }


Not quiet understand for this line. In which situation, the HTTP authentication header will be "Basic credentials" #Closed

Other platforms (github, vso) uses basic authentication for their pats (BASIC username:pat_string).
I provide a similar authentication option here if user is more used to them. #Closed

Thanks, got it

In reply to: 339970596 [](ancestors = 339970596)

ydye · 2019-10-30T12:13:57Z

src/rest-server/src/models/k8s-secret.js

+  return axios.create(config);
+};
+
+const serialize = (object) => {


Encode data to base64？

It's an inner function and I think it won't be used by other components.
I prefer using a shorter function name.

I will add some comments on them to improve code readability

ydye · 2019-10-30T12:14:14Z

src/rest-server/src/models/k8s-secret.js

+};
+
+
+const deserialize = (object) => {


decode data from base64

ydye · 2019-10-30T12:16:47Z

src/rest-server/src/models/k8s-secret.js

+
+const createNamespace = async (namespace) => {
+  const url = new URL(`/api/v1/namespaces/`, apiserver.uri).href;
+  const config = {


Is it deplicate with initClient ?

It's a namespace api with different base uri.
Maybe it should be in another file like k8s-util.js or k8s-namespace.js.
I think we can reorganize the k8s api file structure later.

ydye · 2019-10-30T12:46:41Z

src/rest-server/src/models/token.js

+  });
+};
+
+const purge = (data) => {


Delete invalid token?

yiyione · 2019-11-25T10:18:32Z

Token

Login and get the browser token from cookies
Decode the jwt token and the data should not conclude admin field.
Check if the token is stored in k8s secret's pai-user-token namespace as the structure described before.
Revoke the browser token through rest api
🍏 App Token: "Applications are not allowed to do this operation."
🍏 Browser Token: "revoke successfully"
View job list through web portal, and "invalid token" alert message will be popped out.
🍎 e.forEach is not a function

Application Token

Tested in unit test "userToken.js"

710

96b8eb1

sunqinzheng requested review from debuggy, ydye and abuccts October 25, 2019 11:28

sunqinzheng added 2 commits October 28, 2019 14:12

fix lint error

3bde457

doc

d6b2a5f

sunqinzheng marked this pull request as ready for review October 28, 2019 06:42

sunqinzheng requested review from yds05, fanyangCS and Binyang2014 October 28, 2019 07:14

abuccts reviewed Oct 29, 2019

View reviewed changes

debuggy approved these changes Oct 29, 2019

View reviewed changes

Binyang2014 reviewed Oct 29, 2019

View reviewed changes

abuccts approved these changes Oct 30, 2019

View reviewed changes

ydye reviewed Oct 30, 2019

View reviewed changes

src/rest-server/src/models/k8s-secret.js

};

const deserialize = (object) => {

Copy link

Contributor

ydye Oct 30, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

decode data from base64

ydye reviewed Oct 30, 2019

View reviewed changes

src/rest-server/src/models/token.js

});

};

const purge = (data) => {

Copy link

Contributor

ydye Oct 30, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Delete invalid token?

ydye approved these changes Oct 30, 2019

View reviewed changes

add jsdocs

6a28afb

sunqinzheng merged commit b6bd2ab into master Nov 1, 2019

sunqinzheng deleted the qinsu/rest/token-api branch November 1, 2019 01:24

abuccts mentioned this pull request Nov 25, 2019

Pure K8S Alpha Release Plan #3382

Closed

42 tasks

hzy46 mentioned this pull request Apr 27, 2020

add release note #4452

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Rest Server] Application token api #3774

[Rest Server] Application token api #3774

sunqinzheng commented Oct 25, 2019 •

edited

Loading

abuccts left a comment

abuccts Oct 29, 2019

sunqinzheng Oct 29, 2019

Binyang2014 Oct 29, 2019 •

edited

Loading

sunqinzheng Oct 29, 2019 •

edited by Binyang2014

Loading

Binyang2014 Oct 30, 2019

ydye Oct 30, 2019

sunqinzheng Oct 31, 2019

sunqinzheng Oct 31, 2019

ydye Oct 30, 2019

ydye Oct 30, 2019 •

edited

Loading

sunqinzheng Oct 31, 2019

ydye Oct 30, 2019

yiyione commented Nov 25, 2019 •

edited

Loading

[Rest Server] Application token api #3774

[Rest Server] Application token api #3774

Conversation

sunqinzheng commented Oct 25, 2019 • edited Loading

Changes

Token format

Storage

Authentication error

k8s secret model

API routes

Test Cases

Token

Application Token

abuccts left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Binyang2014 Oct 29, 2019 • edited Loading

Choose a reason for hiding this comment

sunqinzheng Oct 29, 2019 • edited by Binyang2014 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ydye Oct 30, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yiyione commented Nov 25, 2019 • edited Loading

Token

Application Token

sunqinzheng commented Oct 25, 2019 •

edited

Loading

Binyang2014 Oct 29, 2019 •

edited

Loading

sunqinzheng Oct 29, 2019 •

edited by Binyang2014

Loading

ydye Oct 30, 2019 •

edited

Loading

yiyione commented Nov 25, 2019 •

edited

Loading