Add bot token storage, audit logging, and HTTP APIs for bot token management#2015
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7d43d06e12
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Adds bot-token lifecycle support across the stack: a new Mono HTTP router for admin-only bot token management, plus new Jupiter storage capabilities for generating/listing/revoking/looking up bot tokens and writing audit-log entries.
Changes:
- Add
/api/v1/bots/{bot_id}/tokensendpoints in Mono (create/list/revoke/revoke_all) with OpenAPI tagging. - Extend Jupiter
BotsStoragewith HMAC-hashed bot token storage + lookup helpers and exposebots_storage()fromStorage. - Introduce
AuditStorageas a centralized audit-log insert entrypoint.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| mono/src/server/http_server.rs | Adds BOT_TAG OpenAPI tag constant. |
| mono/src/api/router/mod.rs | Registers the new bot_router module. |
| mono/src/api/router/bot_router.rs | Implements admin-only bot token management HTTP APIs + schemas. |
| mono/src/api/api_router.rs | Merges bot_router into the main API router. |
| jupiter/src/storage/mod.rs | Wires in AuditStorage, exposes audit_storage() and bots_storage(). |
| jupiter/src/storage/bots_storage.rs | Implements token generate/list/revoke/find using HMAC hashing. |
| jupiter/src/storage/audit_storage.rs | Adds AuditStorage::log_audit insert helper. |
| jupiter/src/model/bot_token_dto.rs | Adds BotTokenInfo DTO for listing token metadata without plaintext. |
| /// Generate a new bot token, persist its HMAC-SHA256 hash and return the model with plaintext. | ||
| pub async fn generate_bot_token( | ||
| &self, | ||
| bot_id: i64, | ||
| token_name: &str, |
WiedersehenM
force-pushed
the
feature/bot-token
branch
from
7d43d06 to
ff087c4
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ff087c4e30
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| let models = bot_tokens::Entity::find() | ||
| .filter(bot_tokens::Column::BotId.eq(bot_id)) | ||
| .order_by_desc(bot_tokens::Column::CreatedAt) |
There was a problem hiding this comment.
list_bot_tokens only queries bot_tokens by bot_id and never verifies that the bot exists, so an invalid bot_id yields an empty list and the handler returns 200. That behavior conflicts with the endpoint contract in mono/src/api/router/bot_router.rs (which documents 404 for missing bots) and makes a typoed/stale bot ID indistinguishable from a valid bot with zero tokens.
Useful? React with 👍 / 👎.
| if let Some(model) = bot_tokens::Entity::find_by_id(token_id) | ||
| .filter(bot_tokens::Column::BotId.eq(bot_id)) | ||
| .one(conn) | ||
| .await? | ||
| { |
There was a problem hiding this comment.
revoke_bot_token silently succeeds when no row matches (bot_id, token_id) because the method falls through when the query returns None. This means DELETE /bots/{bot_id}/tokens/{id} can return success even though no token was revoked, which can leave compromised tokens active while callers believe cleanup succeeded and also contradicts the route’s documented 404 behavior for missing bot/token.
Useful? React with 👍 / 👎.
本次提交进行的修复1. jupiter/src/model/mod.rs
2. jupiter/src/storage/bots_storage.rs
3. jupiter/src/storage/audit_storage.rs
4. mono/src/api/router/bot_router.rs
未修改项
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8b2a47a538
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| let conn = self.get_connection(); | ||
|
|
||
| let token = bot_tokens::Entity::find() | ||
| .filter(bot_tokens::Column::TokenHash.eq(token_hash)) |
There was a problem hiding this comment.
find_bot_by_token authenticates by querying bot_tokens on token_hash, but the schema currently only defines idx_bot_tokens_bot_id and uq_bot_tokens_name_hash(bot_id, token_name, token_hash) (see jupiter/src/migration/m20260306_121829_create_bots_related_table.rs), so this predicate has no efficient leading-column index and will devolve into scans as token rows grow; that can materially increase latency for every bot-authenticated request path using this function.
Useful? React with 👍 / 👎.
WiedersehenM
force-pushed
the
feature/bot-token
branch
from
8b2a47a to
6924b8d
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6924b8d9d6
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| .routes(routes!(create_bot_token)) | ||
| .routes(routes!(list_bot_tokens)) | ||
| .routes(routes!(revoke_bot_token)) | ||
| .routes(routes!(revoke_all_bot_tokens)), |
There was a problem hiding this comment.
The router registration now includes only token-management handlers, so the previously exposed installation endpoints under /api/v1/bots/{id}/installations are no longer mounted. I checked mono/src/api/router for moved handlers (rg "installations") and found no replacement routes, while installation storage methods still exist in Jupiter, which means existing installation workflows will regress to 404 after this change.
Useful? React with 👍 / 👎.
|
修复 Clippy 报错：在 AuditStorage::log_audit 中去掉对 metadata 的多余 map(Into::into) 调用，直接使用 Option<serde_json::Value>，消除了 clippy::useless-conversion 警告。 修复 mono 编译失败）：在 bot_router 中的 revoke_bot_token 和 revoke_all_bot_tokens 两个接口上，调整 #[utoipa::path] 的 responses 描述，取消 body = CommonResult<()>，改为只保留 200 状态码的文本描述，从而避免 utoipa 对 () 类型解析时的 TypeTree must have a path panic，routes! 宏恢复正常展开。 Codex 的性能建议：新增迁移 m20260316_120000_add_bot_tokens_token_hash_index，为 bot_tokens.token_hash 创建单列索引 idx_bot_tokens_token_hash，并在 migration::mod 中注册该迁移，以优化 find_bot_by_token 中按 token_hash 的查询性能，避免未来在 Bot 请求量增大时退化为全表扫描。 |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 736130f550
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| .routes(routes!(create_bot_token)) | ||
| .routes(routes!(list_bot_tokens)) | ||
| .routes(routes!(revoke_bot_token)) | ||
| .routes(routes!(revoke_all_bot_tokens)), |
There was a problem hiding this comment.
The router now mounts only token-management handlers, so the previously available installation APIs under /api/v1/bots/{id}/installations are no longer reachable and will return 404 after this change. I checked the updated router registration here and there is no replacement installation route in mono/src/api/router for this commit, while installation storage operations still exist in Jupiter, so existing install/list/update/uninstall client flows regress at runtime.
Useful? React with 👍 / 👎.
本次提交进行的修改1. Bot 身份提取：从 HTTP Header 到 Jupiter 校验
2. Ceres 层统一的 Bot 权限检查入口
3. Cedar Guard 中区分 Human / Bot principal
|
…using HMAC-SHA256 with an env-based secret, storing only token hashes and metadata while returning plaintext once on creation
- Implement listing, single revoke, bulk revoke, and plaintext-based lookup (with bot_ prefix) for bot tokens to support authentication flows
- Introduce AuditStorage wrapper around BaseStorage with a log_audit API using ActorTypeEnum / AuditActionEnum / TargetTypeEnum and JSON metadata
- Expose audit_storage from Storage/AppService so Mono and Ceres can record bot token lifecycle events and bot access audits
- Add bot_router with /api/v1/bots/{bot_id}/tokens CRUD-style endpoints and DTOs for creating, listing, and revoking bot tokens, including OpenAPI documentation and BOT_TAG swagger tag
- Wire bot_router into api_router and expose bots_storage() from Jupiter Storage so Mono can call bot token storage APIs
Signed-off-by: Hongze Gao <15101764808@163.com>
Signed-off-by: Hongze Gao <15101764808@163.com>
…le and storage - Export bot_token_dto in jupiter model so BotTokenInfo is reachable - BotsStorage: add get_bot_by_id() for bot existence checks - BotsStorage: use update_many() in revoke_bot_tokens_by_bot to avoid N+1 - BotsStorage: validate HMAC secret (non-empty, min 32 chars) in load_bot_token_hmac_key - BotsStorage: use DateTimeWithTimeZone for expiry comparison in find_bot_by_token - AuditStorage: set created_at with DateTimeWithTimeZone (Utc::now().into()) - bot_router: ensure bot exists before create/list/revoke; return 404 when missing - bot_router: validate expires_in range (1..=10y) to avoid overflow/panic - tests: add audit_storage to AppService in test_storage() Signed-off-by: Hongze Gao <15101764808@163.com>
…r token hash - Resolve Clippy warning in by removing the redundant conversion. - Fix mono OpenAPI annotations for bot token revoke endpoints by avoiding as a documented response body, preventing utoipa - Add a dedicated index via a new migration to optimize lookups in and address authentication path performance concerns. Signed-off-by: Hongze Gao <15101764808@163.com>
…nference - Import and installation enums (, ) from in so installation queries and models resolve correctly. - Implement bot installation management helpers in : , , , and . - Add explicit / type annotations around SeaORM calls to satisfy the compiler and eliminate type inference errors in CI. Signed-off-by: Hongze Gao <15101764808@163.com>
…incipal support - Introduce BotIdentity extractor in the mono OAuth module to validate 'Bearer bot_' tokens via Jupiter BotsStorage - Add MonoApiService::check_bot_permission in Ceres to combine bot status, installation scope, and permission_scope for authorization - Update Cedar guard to distinguish human and bot principals while keeping the current permit-all policy Signed-off-by: Hongze Gao <15101764808@163.com>
- Re-add /api/v1/bots/{id}/installations endpoints (install/list/update/uninstall) that were
accidentally dropped when introducing bot token management routes.
- Keep token management routes mounted while preserving backward compatibility for existing
installation client workflows.
Signed-off-by: Hongze Gao <15101764808@163.com>
WiedersehenM
force-pushed
the
feature/bot-token
branch
from
736130f to
e680bc3
Compare
|
@codex review |
There was a problem hiding this comment.
Pull request overview
This PR adds end-to-end bot token lifecycle support across the stack: secure token generation/storage in Jupiter, admin-only HTTP management endpoints in Mono, and initial bot-aware identity/permission plumbing plus audit logging support.
Changes:
- Add HMAC-based bot token storage + lookup/revocation APIs in
jupiter::BotsStorage, plus a non-plaintext DTO for listing tokens. - Introduce
AuditStorageas a centralized writer foraudit_logs, and wire it intoStorage/test helpers. - Add Mono
/api/v1/bots/{bot_id}/tokensadmin endpoints (create/list/revoke/revoke_all) and introduceBotIdentityextraction for bot-auth flows.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| mono/src/server/http_server.rs | Rename/standardize the OpenAPI tag constant for bot management endpoints. |
| mono/src/api/router/bot_router.rs | Add admin-only bot token management endpoints and related request/response DTOs. |
| mono/src/api/oauth/mod.rs | Add BotIdentity extractor to validate bot_ bearer tokens via Jupiter storage. |
| mono/src/api/guard/cedar_guard.rs | Update authorization principal resolution to distinguish Bot vs User (but currently via request extensions). |
| jupiter/src/tests.rs | Extend test storage wiring to include AuditStorage. |
| jupiter/src/storage/mod.rs | Register and expose AuditStorage from Storage/AppService. |
| jupiter/src/storage/bots_storage.rs | Implement bot token generate/list/revoke/find-by-token with HMAC hashing + expiry/revocation filtering. |
| jupiter/src/storage/audit_storage.rs | Add AuditStorage::log_audit writer for audit_logs. |
| jupiter/src/model/mod.rs | Export the new bot token DTO module. |
| jupiter/src/model/bot_token_dto.rs | Add BotTokenInfo DTO for safe token listing without plaintext. |
| jupiter/src/migration/mod.rs | Register the new bot token hash index migration. |
| jupiter/src/migration/m20260316_120000_add_bot_tokens_token_hash_index.rs | Add an index on bot_tokens.token_hash to speed up token lookup. |
| ceres/src/api_service/mod.rs | Register new bot operations module. |
| ceres/src/api_service/bot_ops.rs | Add a basic check_bot_permission helper (bot enabled + has enabled installation + scope check). |
| let login_user = req.extensions().get::<LoginUser>(); | ||
| let bot_identity = req.extensions().get::<BotIdentity>(); | ||
|
|
||
| let _username = match user { | ||
| Some(user) => user.username, | ||
| None => "reader".to_string(), | ||
| let (principal_type, principal_id) = if let Some(bot) = bot_identity { | ||
| ("Bot".to_string(), bot.bot.id.to_string()) | ||
| } else if let Some(user) = login_user { | ||
| ("User".to_string(), user.username.clone()) | ||
| } else { | ||
| ("User".to_string(), "reader".to_string()) | ||
| }; |
| (status = 200, description = "Token revoked successfully"), | ||
| (status = 401, description = "Unauthorized"), | ||
| (status = 403, description = "Forbidden - admin only"), | ||
| (status = 404, description = "Bot or token not found"), |
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Related issue
#1999
Summary
AuditStorageas a centralized audit logging entrypoint for bot-related flows./api/v1/bots/{bot_id}/tokens.Details
Bot token storage (Jupiter)
BotTokenInfoDTO for listing bot tokens without exposing plaintext.BotsStoragewith:generate_bot_tokenthat creates high-entropy random bot tokens, Base64-encodes them, prefixes withbot_, stores only an HMAC-SHA256 hash of the token body (without prefix) inbot_tokens.token_hash, and returns the plaintext token once.list_bot_tokensto return per-bot token metadata ordered bycreated_at, without plaintext values.revoke_bot_tokenandrevoke_bot_tokens_by_botto mark tokens as revoked in an idempotent way.find_bot_by_tokenthat:bot_prefix.bot_tokens.revoked = falseandexpires_ateitherNULLor in the future.Nonewhen the token or corresponding bot record is missing.MEGA_BOT_TOKEN_HMAC_SECRET, returning a clearMegaErrorif it is missing or invalid.Audit logging (Jupiter)
audit_storage.rsdefiningAuditStorage { base: BaseStorage }.log_audit(actor_id, actor_type: ActorTypeEnum, action: AuditActionEnum, target_type: TargetTypeEnum, target_id, metadata: Option<serde_json::Value>)which:idviaIdInstance::next_id().callisto-generated types to stay aligned with the DB schema.Json.created_at = Utc::now()and inserts a row intoaudit_logs.storage::mod:pub mod audit_storage;.audit_storage: AuditStoragetoStorage/AppService, initialize it inStorage::new()andAppService::mock().pub fn audit_storage(&self) -> AuditStoragefor higher layers.actor_type = Bot,target_type,target_id, and richermetadata(bot ID, permission scope, installation targets, API path, decision results, etc.).Mono HTTP API for bot token management
bot_routerthat exposes admin-only bot token endpoints, all requiring authenticatedLoginUserand anensure_admincheck:POST /api/v1/bots/{bot_id}/tokensBotsStorage::generate_bot_token.token_plain), plus metadata.GET /api/v1/bots/{bot_id}/tokensDELETE /api/v1/bots/{bot_id}/tokens/{id}POST /api/v1/bots/{bot_id}/tokens/revoke_allBOT_TAG = "Bot Management"for OpenAPI.bot_routerin the mainapi_routerso the endpoints are served under/api/v1.bots_storage()from JupiterStorageso Mono can call:generate_bot_tokenlist_bot_tokensrevoke_bot_tokenrevoke_bot_tokens_by_bot