Skip to content

Request minimal scopes on interactive authentication #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Aug 9, 2023
Merged

Request minimal scopes on interactive authentication #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2bd37a8
Also log status when getting a change
DavidS-ovm Aug 7, 2023
210c1bf
Fix error handling when streaming UpdateChangingItems responses
DavidS-ovm Aug 7, 2023
18f4191
Only request minimal scopes for each operation
DavidS-ovm Aug 9, 2023
8fc4741
Add cloudfront datamaps
DavidS-ovm Aug 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cmd/createbookmark.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ func CreateBookmark(signals chan os.Signal, ready chan bool) int {
))
defer span.End()

ctx, err = ensureToken(ctx, signals)
ctx, err = ensureToken(ctx, []string{"changes:write"}, signals)
if err != nil {
log.WithContext(ctx).WithError(err).WithFields(log.Fields{
"url": viper.GetString("url"),
Expand Down
72 changes: 72 additions & 0 deletions cmd/datamaps/awssource.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion cmd/endchange.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ func EndChange(signals chan os.Signal, ready chan bool) int {
))
defer span.End()

ctx, err = ensureToken(ctx, signals)
ctx, err = ensureToken(ctx, []string{"changes:write"}, signals)
if err != nil {
log.WithContext(ctx).WithFields(log.Fields{
"url": viper.GetString("url"),
Expand Down
2 changes: 1 addition & 1 deletion cmd/getaffectedbookmarks.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ func GetAffectedBookmarks(signals chan os.Signal, ready chan bool) int {
))
defer span.End()

ctx, err = ensureToken(ctx, signals)
ctx, err = ensureToken(ctx, []string{"changes:read"}, signals)
if err != nil {
log.WithContext(ctx).WithError(err).WithFields(log.Fields{
"url": viper.GetString("url"),
Expand Down
2 changes: 1 addition & 1 deletion cmd/getbookmark.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ func GetBookmark(signals chan os.Signal, ready chan bool) int {
))
defer span.End()

ctx, err = ensureToken(ctx, signals)
ctx, err = ensureToken(ctx, []string{"changes:read"}, signals)
if err != nil {
log.WithContext(ctx).WithError(err).WithFields(log.Fields{
"url": viper.GetString("url"),
Expand Down
3 changes: 2 additions & 1 deletion cmd/getchange.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ func GetChange(signals chan os.Signal, ready chan bool) int {
))
defer span.End()

ctx, err = ensureToken(ctx, signals)
ctx, err = ensureToken(ctx, []string{"changes:read"}, signals)
if err != nil {
log.WithContext(ctx).WithFields(log.Fields{
"url": viper.GetString("url"),
Expand Down Expand Up @@ -90,6 +90,7 @@ func GetChange(signals chan os.Signal, ready chan bool) int {
log.WithContext(ctx).WithFields(log.Fields{
"change-uuid": uuid.UUID(response.Msg.Change.Metadata.UUID),
"change-created": response.Msg.Change.Metadata.CreatedAt.AsTime(),
"change-status": response.Msg.Change.Metadata.Status.String(),
"change-name": response.Msg.Change.Properties.Title,
"change-description": response.Msg.Change.Properties.Description,
}).Info("found change")
Expand Down
2 changes: 1 addition & 1 deletion cmd/getsnapshot.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ func GetSnapshot(signals chan os.Signal, ready chan bool) int {
))
defer span.End()

ctx, err = ensureToken(ctx, signals)
ctx, err = ensureToken(ctx, []string{"changes:read"}, signals)
if err != nil {
log.WithContext(ctx).WithError(err).WithFields(log.Fields{
"url": viper.GetString("url"),
Expand Down
2 changes: 1 addition & 1 deletion cmd/request.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ func Request(signals chan os.Signal, ready chan bool) int {

lf := log.Fields{}

ctx, err = ensureToken(ctx, signals)
ctx, err = ensureToken(ctx, []string{"explore:read"}, signals)
if err != nil {
log.WithContext(ctx).WithFields(lf).WithField("api-key-url", viper.GetString("api-key-url")).WithError(err).Error("failed to authenticate")
return 1
Expand Down
4 changes: 2 additions & 2 deletions cmd/root.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ func Execute() {
}

// ensureToken
func ensureToken(ctx context.Context, signals chan os.Signal) (context.Context, error) {
func ensureToken(ctx context.Context, requiredScopes []string, signals chan os.Signal) (context.Context, error) {
// get a token from the api key if present
if viper.GetString("api-key") != "" {
log.WithContext(ctx).Debug("using provided token for authentication")
Expand Down Expand Up @@ -97,7 +97,7 @@ func ensureToken(ctx context.Context, signals chan os.Signal) (context.Context,
// Authenticate using the oauth resource owner password flow
config := oauth2.Config{
ClientID: viper.GetString("auth0-client-id"),
Scopes: []string{"openid", "profile", "email", "gateway:stream", "request:send", "reverselink:request", "account:read", "source:read", "source:write", "api:read", "api:write", "gateway:objects"},
Scopes: requiredScopes,
Endpoint: oauth2.Endpoint{
AuthURL: fmt.Sprintf("https://%v/authorize", viper.GetString("auth0-domain")),
TokenURL: fmt.Sprintf("https://%v/oauth/token", viper.GetString("auth0-domain")),
Expand Down
2 changes: 1 addition & 1 deletion cmd/startchange.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ func StartChange(signals chan os.Signal, ready chan bool) int {
))
defer span.End()

ctx, err = ensureToken(ctx, signals)
ctx, err = ensureToken(ctx, []string{"changes:write"},signals)
if err != nil {
log.WithContext(ctx).WithFields(log.Fields{
"url": viper.GetString("url"),
Expand Down
11 changes: 5 additions & 6 deletions cmd/submitplan.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,7 +206,7 @@ func SubmitPlan(signals chan os.Signal, ready chan bool) int {

lf := log.Fields{}

ctx, err = ensureToken(ctx, signals)
ctx, err = ensureToken(ctx, []string{"changes:write"}, signals)
if err != nil {
log.WithContext(ctx).WithFields(lf).WithField("api-key-url", viper.GetString("api-key-url")).WithError(err).Error("failed to authenticate")
return 1
Expand Down Expand Up @@ -459,11 +459,6 @@ func SubmitPlan(signals chan os.Signal, ready chan bool) int {
last_log := time.Now()
first_log := true
for resultStream.Receive() {
if resultStream.Err() != nil {
log.WithContext(ctx).WithFields(lf).WithError(err).Error("error streaming results")
return 1
}

msg := resultStream.Msg()

// log the first message and at most every 250ms during discovery
Expand All @@ -475,6 +470,10 @@ func SubmitPlan(signals chan os.Signal, ready chan bool) int {
first_log = false
}
}
if resultStream.Err() != nil {
log.WithContext(ctx).WithFields(lf).WithError(err).Error("error streaming results")

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information

[Sensitive data returned by an access to apiKey](1) flows to a logging call.
return 1
}

changeUrl := fmt.Sprintf("%v/changes/%v", viper.GetString("frontend"), changeUuid)
log.WithContext(ctx).WithFields(lf).WithField("change-url", changeUrl).Info("change ready")
Expand Down