HTTPBearer token is set, Auth button not shown on /api/docs #67
Conversation
Igoranze
changed the title
|
@Igoranze still needs some linting fixes |
|
I think linting (the mypy) errors here are really important. as fixing them, more changes reveals |
@torkashvand I have changed the request type to |
|
@pboers1988 let's briefly wait with merging this, I want to run it through some tests in okteto on thursday |
Co-authored-by: Mark Moes <[email protected]>
Co-authored-by: Mark Moes <[email protected]>
…-lib into auth-b-shown
| id_token_extractor: IdTokenExtractor | None = None, | ||
| ): | ||
| if not id_token_extractor: | ||
| self.id_token_extractor = HttpBearerExtractor() |
There was a problem hiding this comment.
Maybe keep the kwarg in __init__ and when a value is passed log a (deprecation) warning instead?
There was a problem hiding this comment.
Great spot by you (@Igoranze): if a custom id_token_extractor is passed then it's not actually assigned to self.id_token_extractor so authenticate() raises an AttributeError when trying to call it.
The only way this can have worked for others is if they override authenticate() as well. So, we don't need to worry about backwards compatibility
| if not extracted_id_token: | ||
| raise HTTPException(status_code=HTTP_403_FORBIDDEN, detail="Not authenticated") | ||
| if not token: | ||
| raise HTTPException(status_code=HTTP_403_FORBIDDEN, detail="Not authenticated") |
There was a problem hiding this comment.
I think you did this because the new WebSocket implementation passes the token in a header. Nice!
There was a problem hiding this comment.
Correct :) And it no longer servers only for the websocket since that should not matter
Part of workfloworchestrator/orchestrator-core#670
This PR adds a Class TokenExtractor that is used as a Depends and extracts the token from the request in order to allow for HTTPBearer requests.
Part of the missing HTTPBearer request was that the /api/docs auth button was not shown.
Also added a statement to the authentication in order to filter out strawberry requests and get the token via the HTTPBearer without the Depends