Don't autogenerate access token on homepage.

[efixler]

What's Here

This PR updates the homepage (aka test console) to require a valid token for API usage, building on the UX introduced in the prior PRs:

• Add token entry/storage functionality to test console #7
• Refactor test console ahead of upcoming auth changes #6

Here's a screenshot of the token entry widget:

Tokens may be saved to local storage, in which case they'll be pre-loaded for future sessions.

---

The prior behavior (where API access via the homepage was provided by short-lived token passed from the server) is preserved and can be enabled via the -public-home flag. This mode is useful for development and may also be useful in production environments where route authentication is handled upstream from this service.

Steps to Test

Building this release

Without Go on your machine

In the branch root: make docker-build

With Go 1.22.x on your machine

In the branch root: make

Running the Server

You'll need a signing key to start the server, and a corresponding token to access functionality from the test console.

Here's a signing key for testing:

bCdcAT8EBvQXo7A50c4cSbkTc2gMvpVoMYrVaOpuKmM=

With Go

./build/scrape-server -signing-key [insert signing key from above here]

With Docker

• In your Docker Desktop find the scrape-bookworm-slim image you just built. If it's running, stop it.
• Click the play button
• When the modal opens, expand Optional Settings
• For host port, enter 8080
• Make an environment variable called SCRAPE_SIGNING_KEY
• Set its value to the signing key above
• Start the container

Testing Functionality

• Try to fetch a url without entering a token, it should not work and you should see a 401 message in the output field.
• Unfurl the token entry widget
• Here's a token that will you can paste into the token entry field:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzY3JhcGUiLCJzdWIiOiJ0ZXN0ZXIiLCJhdWQiOlsibW96Il0sImV4cCI6MTc1Mjc3NjM1MiwiaWF0IjoxNzIxMjQwMzUyfQ.ldabSHpxSyBA6VkRvFF2RgQDNfAXCui0zILkdv9ZFhM

• Operations should work now
• Save the token and confirm that it's restored when the page is loaded
• Clear the token and confirm that that works too

[cass-moz]

Works locally for me!

[efixler]

Awesome, thanks @cass-moz ! I will let you know when I tag this release.

[rolf-moz]

I don't know go, but seems to make sense.