Implement file store API #4

asmega · 2019-03-14T12:08:00Z

API to handle file upload and download from runner

… result

this is because it is a GET request and we SHOULD not be including json payload within the request of the body. instead it is included as part of the query string which has been base64 encoded. it is this base64 encoded string that is signed in the JWT which we can use to verify the authenticity of the request

"checksum" is added to the JWT payload and is the SHA256 digest of the request body.

theKHutDeveloper

Looks good

Andrien Ricketts and others added 30 commits March 5, 2019 10:40

Add a place holder for file upload endpoint

ca6a07e

The controller is able to decode a Base64 encoded file

abe0ee2

Decoded data is saved to local file

e995419

Return 400 error status if file size exceeds maximum

e3aa27e

Return error if mime type of file is not in the approved list

c2af8e0

Render json instead of just returning the status

84a09e6

Generate fingerprint

20103df

Generate filename

d6a2717

Encrypt filename with AES-256, then generate a hashed digest from the…

c310236

… result

Refactor

021eff2

Add get route and set x-header

86c4fd4

remove unused controller

c816910

fix tests by bypassing JWT logic

96e3afc

persist files to quarantine with random filename

5ba4f97

introduce FileManager

cf6bdca

file manager implements file size check

6896e44

file manager can check file type

28d4f36

WIP disk uploader

4ed1b67

ensure quarantine folder exists before using

1b1fbb1

wip

638b992

extract controller methods

e4a79a7

return error when exception is raised on upload

babed7c

added timecop gem

38ef09f

added response on file upload

ef55c72

fix test

1bd9f2f

return 204 if file already exists

cedd3fc

added Storage::Disk::Downloader

9d69f73

correct service_token to service_slug

e2d9337

able to download stored files

32c3d3b

delete file from qurantine post upload

7fed709

Phil Lee added 24 commits March 8, 2019 15:13

key encryption iv now uses ENV var

944d7d6

use service token service to fetch tokens

89d7b13

enforce request must be application/json

d54166a

use encrypted_user_id_and_token as cipher key

d4fc7de

swap to strict base64 encode and decode

405d68f

update README on how to make API calls via CLI

0ce2d6f

always use JWT payload for iat value

15755cd

cipher key now md5 digest as 32 bytes expected

24e759b

README includes how to write file to disk

31cfb19

upload response now returns fingerprint not url

e39e513

remove original filename from s3 metadata

bb90b0c

check checksum in JWT payload

4890e43

"checksum" is added to the JWT payload and is the SHA256 digest of the request body.

filter sensitive data from rails logs

5e2a1da

return 200 when same file uploaded again

e70961a

support wildcards for whitelisting mime types

a855188

check upload params and set defaults

6e3c896

check params when downloading

349c175

split out uploads and downloads controllers

dfb078a

fix README examples to include checksum

ebf3774

choice of storage now configurable

2f22d27

fix api to S3 downloader

e1d4f12

JWT payload checksum checks payload param first

4a246bd

update README examples

f764a93

asmega requested review from theKHutDeveloper and solidgoldpig March 14, 2019 12:08

theKHutDeveloper approved these changes Mar 14, 2019

View reviewed changes

solidgoldpig approved these changes Mar 14, 2019

View reviewed changes

asmega merged commit 104f6ac into master Mar 15, 2019

asmega deleted the implement-file-store branch March 15, 2019 12:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement file store API #4

Implement file store API #4

asmega commented Mar 14, 2019

theKHutDeveloper left a comment

Implement file store API #4

Implement file store API #4

Conversation

asmega commented Mar 14, 2019

theKHutDeveloper left a comment

Choose a reason for hiding this comment