Check token for validity #96
Conversation
|
Warning Rate limit exceeded@NickCao has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 23 minutes and 4 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (3)
WalkthroughThe changes enhance secret management by improving logging and error handling in the secret existence checks of both client and exporter controllers. In the respective methods, a logger is instantiated from the context; token validity is checked using the Signer; and when a secret is missing or contains an invalid token, errors are managed gracefully, including logging and deletion of the invalid secret. Additionally, a new Changes
Sequence Diagram(s)sequenceDiagram
participant C as Controller (Client/Exporter)
participant L as Logger
participant S as Secret Store
participant G as Signer
C->>L: Instantiate logger from context
C->>S: Retrieve secret (client or exporter)
alt Secret not found
S-->>C: NotFound error
C->>L: Log secret absence
C->>C: Return false (or trigger credential creation)
else Secret found
C->>G: Verify token from secret
alt Token valid
G-->>C: nil
C->>C: Return true
else Token invalid
G-->>C: error
C->>L: Log invalid token
C->>S: Delete secret
C->>C: Return true
end
end
sequenceDiagram
participant Caller as Caller
participant S as Signer
participant J as JWT Parser
Caller->>S: Call Verify(token)
S->>J: jwt.Parse(token, callback)
alt Parsing successful
J-->>S: Valid token payload
S-->>Caller: nil
else Parsing fails
J-->>S: Error message
S-->>Caller: error
end
Possibly related PRs
Suggested reviewers
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
internal/controller/client_controller.go (1)
96-100: Improve error logging for token validation failures.The current implementation logs a generic "invalid" message. More detailed error information would help with debugging.
Apply this diff to enhance error logging:
token, ok := secret.Data["token"] -if !ok || r.Signer.Verify(string(token)) != nil { - logger.Info("reconcileStatusCredential: the client secret is invalid", "client", client.Name) +if !ok { + logger.Info("reconcileStatusCredential: token missing in client secret", "client", client.Name) + return false, r.Delete(ctx, secret) +} +if err := r.Signer.Verify(string(token)); err != nil { + logger.Info("reconcileStatusCredential: invalid token in client secret", + "client", client.Name, + "error", err) return false, r.Delete(ctx, secret) }internal/controller/exporter_controller.go (1)
108-113: Apply consistent error logging for token validation failures.For consistency with the client controller, enhance the error logging here as well.
Apply this diff to maintain consistency:
token, ok := secret.Data["token"] -if !ok || r.Signer.Verify(string(token)) != nil { - logger.Info("reconcileStatusCredential: the exporter secret is invalid", "exporter", exporter.Name) +if !ok { + logger.Info("reconcileStatusCredential: token missing in exporter secret", "exporter", exporter.Name) + return false, r.Delete(ctx, secret) +} +if err := r.Signer.Verify(string(token)); err != nil { + logger.Info("reconcileStatusCredential: invalid token in exporter secret", + "exporter", exporter.Name, + "error", err) return false, r.Delete(ctx, secret) }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
internal/controller/client_controller.go(2 hunks)internal/controller/exporter_controller.go(3 hunks)internal/oidc/op.go(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: deploy-kind
- GitHub Check: e2e-tests
NickCao
force-pushed
the
token-followup
branch
from
1924c92 to
b80dca3
Compare
Summary by CodeRabbit
New Features
Bug Fixes