🔏 Requires valid access tokens for API calls #173
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## main #173 +/- ##
==========================================
+ Coverage 66.86% 68.08% +1.22%
==========================================
Files 20 20
Lines 848 893 +45
==========================================
+ Hits 567 608 +41
- Misses 281 285 +4
📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
* Adds a verified access token as a dependency to API endpoints, including;
* POST /api/events/
* POST /api/sony_ci/sync
* This same dependency can now be added to any API endpoint.
* The verified access token dependency is resolved by:
1. Fetching the unverified access token from the HTTP request header.
2. Verifying the access key by decoding it with the signing key.
a. In the production and development environments, the signing key is the
public half of a public/private key pair available with from our Auth0 account.
b. In test environment a fake signing key is used for both encoding and decoding.
* Adds tests for testing the authentication and authorization dependencies of the API
endpoints.
* The testing pattern involves a factory for generating a fake access tokens with
whatever permissions the test is concerned with testing.
* Refactors the FastAPI dependencies for API endpoints for better testability.
Also:
* Removes unused launch config for tests. Use vscode pytest settings instead.
* Changes param name from allow_redirects to follow_redirects to fix deprecation warning
* Adds git-guardian cache dir to git ignore
* Adds constants to config used for verifying access token and specifying the authorization 'audience'.
* Renames admin_user dependency to to 'get_admin_user' for consistency.
* Renames get_user to get_oauth_user for specificity -- i.e. not a User model from the Chowda db.
* Adds pyjwt for dealing with Javascript Web Tokens (jwt).
* Removes test for api calls to create batches - not needed.
* Removes .env files from revision, but leaves a sample template: '.env.sample'.
* Prefixes all env vars and constants having to do with Auth0 with "AUTH0_" for consistency.
* Sets test db used in github CI workflow to use name 'chowda' and default port 5432.
Closes #153.
mrharpo
requested changes
Oct 20, 2023
chowda/auth/utils.py
Outdated
Comment on lines
28
to
32
| class OAuthIDToken(BaseModel): | ||
| """OAuth ID Token with User info""" | ||
|
|
||
|
|
||
| class OAuthUser(BaseModel): |
There was a problem hiding this comment.
Are these supposed to be the same thing?
chowda/routers/sony_ci.py
Outdated
| @@ -12,7 +14,9 @@ class SyncResponse(BaseModel): | |||
|
|
|||
|
|
|||
| @sony_ci.post('/sync', tags=['sync']) | |||
| async def sony_ci_sync() -> SyncResponse: | |||
| async def sony_ci_sync( | |||
| token: Annotated[OAuthAccessToken, Depends(verified_access_token)] | |||
There was a problem hiding this comment.
Need to check for sync:sonyci permissions here.
|
| GitGuardian id | Secret | Commit | Filename | |
|---|---|---|---|---|
| 8543931 | Bearer Token | 2dab4f9 | tests/routers/test_events.py | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Our GitHub checks need improvements? Share your feedbacks!
Adds tests for Sony Ci sync API endpoint.
afred
commented
Oct 24, 2023
mrharpo
added a commit
that referenced
this pull request
Oct 25, 2023
* main: 🔏 Requires valid access tokens for API calls (#173)
mrharpo
added a commit
that referenced
this pull request
Feb 26, 2024
* main: 🍼 Ensure pip (#195) Adds pip to venv (#192) Adds venv to start of PATH (#191) Activates venv in production image (#190) 🎬 Row actions (#188) 🤖 Update dependencies (#186) 📩 MMIF Download (#182) ⛓️ Metaflow links (#185) 🎱 Fields: `Finished`, `Successful` (#184) ➕ Add MMIF to batch (#181) 🤖 Update dependencies (#177) 🔏 Requires valid access tokens for API calls (#173) 🏞 `MMIF` source (#168) ⌛ Expires all (#172) 🤖 Update dependencies (#171) 📄 Page title (#162) Fixes MediaFilesGuidsField, combines usage (#170)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Verified Access Token
POST /api/events/POST /api/sony_ci/synca. In the production and development environments, the signing key is the
public half of a public/private key pair available with from our Auth0 account.
b. In test environment a fake signing key is used for both encoding and decoding.
endpoints.
whatever permissions the test is concerned with testing.
Misc
audience.admin_userdependency to toget_admin_userfor consistency.get_usertoget_oauth_userfor specificity -- i.e. not a User model from the Chowda db..envfiles from revision, but leaves a sample template:.env.sample."AUTH0_"for consistency.'chowda'and default port5432.Closes #153