🐛 Login: Fixes Unauthorized during resend-code

[pcrespov]

What do these changes do?

This PR redesigns the session access to overcome some limitations detected during manual exploratory testing.

Some of the new authentication workflows include multiple requests to the auth entrypoints. In order to secure these entrypoints, there is a session access control mechanism in place. Once the starting auth entrypoint succeds, an access token is created for the next entrypoint/s and so on. For example, a request to auth/login-continue is unauthorized until a request to auth/login-start is successful. This is implemented as

@router.post("/auth/login-start)
@on_success_grant_session_access_to( name="login_continue" ) # <--
def login_start(request):
    ...

@router.post("/auth/login-continue)
@session_access_required( name="login_continue" ) # <--
def login_continue(request):
    ...
 
@router.get("/me)
@login_required # <--
def user_profile(request):
   ...

@router.get("/unprotected)
def unprotected_entrypoint(request):
   ...

Note that login_continue and login_start do not have login_required.

Related issue/s

• Login

How to test

• services/web/server/tests/unit/with_dbs/03/test_session_access.py tests workflows followed by the front-end
• test

Checklist

• manual test+record workflows with @odeimaiz
• Unit tests for the changes exist
• Runs in the swarm
• Documentation reflects the changes

[codecov]

Codecov Report

Merging #3775 (b8c7883) into master (4105a93) will increase coverage by 1.3%.
The diff coverage is 96.9%.

@@           Coverage Diff            @@
##           master   #3775     +/-   ##
========================================
+ Coverage    83.5%   84.8%   +1.3%     
========================================
  Files         915     915             
  Lines       38837   38866     +29     
  Branches      791     791             
========================================
+ Hits        32450   32991    +541     
+ Misses       6177    5665    -512     
  Partials      210     210             

Flag	Coverage Δ
integrationtests	66.9% <78.4%> (+2.2%)	⬆️
unittests	82.0% <96.9%> (+1.0%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
...er/src/simcore_service_webserver/session_access.py	96.8% <95.3%> (+1.5%)	⬆️
.../src/simcore_service_webserver/login/_constants.py	100.0% <100.0%> (ø)
...rc/simcore_service_webserver/login/handlers_2fa.py	84.7% <100.0%> (ø)
...c/simcore_service_webserver/login/handlers_auth.py	94.0% <100.0%> (+0.1%)	⬆️
...e_service_webserver/login/handlers_confirmation.py	90.6% <100.0%> (+0.1%)	⬆️
...e_service_webserver/login/handlers_registration.py	89.1% <100.0%> (-0.2%)	⬇️
.../src/simcore_service_webserver/session_settings.py	100.0% <100.0%> (ø)
...eb/server/src/simcore_service_webserver/session.py	86.9% <0.0%> (-13.1%)	⬇️
...mcore_service_webserver/garbage_collector_utils.py	83.3% <0.0%> (-1.3%)	⬇️
.../director/src/simcore_service_director/producer.py	67.7% <0.0%> (+0.4%)	⬆️
... and 26 more

[sanderegg]

cool! maybe finish the description of the PR...

[pcrespov]

cool! maybe finish the description of the PR...

@sanderegg what do you mean?

[codeclimate]

Code Climate has analyzed commit b8c7883 and detected 0 issues on this pull request.

View more on Code Climate.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication