[gRPC] Enable PATs to be used for authorizing with the gRPC API #19081

geropl · 2023-11-16T10:13:31Z

Description

~~Blocked by/based on: #19023~~

Adds the ability to call the gRPC API with a PAT token. This works because PATs at the moment only supporting two "scopes":

all functions
nothing

Only if the "all functions" are allowed, we accept it for the gRPC API.

Summary generated by Copilot

`🤖[deprecated] Generated by Copilot at a29e3ea`

This pull request enhances the bearer token authentication and authorization logic for different kinds of subjects, such as users and tokens. It adds a new SubjectId class to represent subjects, a new extractFunctionScopes method to handle function scopes, and a new authExpressRequest method to authenticate express requests. It also renames and refactors some existing methods and functions for clarity and consistency. The affected files are server.ts, bearer-authenticator.ts, function-access.ts, and authorizer.ts.

Related Issue(s)

Fixes EXP-897

How to test

login
create a PAT token
open a workspace on this PR
dev/gpctl
export GPCTL_PUBLICAPI_TOKEN=<your pat>
go run main.go api ws ls <an org id> --address gpl-897-pat-api.preview.gitpod-dev.com ✔️
go run main.go api ws get <ws id> --address gpl-897-pat-api.preview.gitpod-dev.com ✔️

Documentation

Preview status

Gitpod was successfully deployed to your preview environment.

🏷️ Name - gpl-897-pat-api
🔗 URL - gpl-897-pat-api.preview.gitpod-dev.com/workspaces.
📚 Documentation - See our internal documentation for information on how to interact with your preview environment.
📦 Version - gpl-897-pat-api-gha.20224
🗒️ Logs - GCP Logs Explorer

Build Options

Build

/werft with-werft
Run the build with werft instead of GHA
leeway-no-cache
/werft no-test
Run Leeway with --dont-test

Publish

/werft publish-to-npm
/werft publish-to-jb-marketplace

Installer

analytics=segment
with-dedicated-emulation
workspace-feature-flags
Add desired feature flags to the end of the line above, space separated

Preview Environment / Integration Tests

/werft with-local-preview
If enabled this will build install/preview
/werft with-preview
/werft with-large-vm
/werft with-gce-vm
If enabled this will create the environment on GCE infra
/werft preemptible
Saves cost. Untick this only if you're really sure you need a non-preemtible machine.
with-integration-tests=all
Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh. If enabled, with-preview and with-large-vm will be enabled.
with-monitoring

/hold

components/server/src/auth/bearer-authenticator.ts

components/server/src/auth/personal-access-token.spec.ts

akosyakov

code wise looks good, I did not try yet.

@geropl is going to change gpctl public-api-get-workspace to use gitpod/v1 that we can verify against internal CLI, i will test then

akosyakov · 2023-11-17T09:50:11Z

I tested though dummy service and it sill work with cookie auth.

mustard-mh · 2023-11-17T09:55:36Z

UPDATE: test it wrong, cli will not hit PR's changes

✅ Access Check (with no access and full access)

✅ API call

➜  ~ gitpod ws list
ID REPOSITORY BRANCH STATUS 
➜  ~ gitpod ws list
ID                                  REPOSITORY                   BRANCH STATUS       
mustardmh-templatesvelt-lnwyoj49jcg mustard-mh/template-sveltejs        initializing 
➜  ~ gitpod ws stop mustardmh-templatesvelt-lnwyoj49jcg
Nov 17 17:52:05.551 [INFO ] waiting for workspace to stop...
Nov 17 17:52:06.387 [INFO ] workspace status: stopping
Nov 17 17:52:06.410 [INFO ] workspace stopped
➜  ~

✅ regenerate

➜  ~ gitpod whoami
Error: internal: jsonrpc2: connection is closed

cc @filiptronicek it's nice to use cli for testing 🎉 . we need to check if we can have proper error message if token is invalidated

geropl · 2023-11-17T10:00:14Z

@mustard-mh I think I got it wrong: The CLI is still based on experimental/v1, which already supported PATs. I will move some of the gpctl api ws methods to your new v1 implementations from yesterday, then we can use that for testing. 🙏

geropl · 2023-11-17T14:04:49Z

@akosyakov @mustard-mh Works now, and can be tested using the steps in the description ☝️

akosyakov · 2023-11-17T14:36:29Z

components/server/src/auth/bearer-authenticator.ts

-            .map((s) => s.substring("function:".length));
-        if (functionScopes.length === 1 && functionScopes[0] === "*") {
+        const { isAllAccessFunctionGuard, functionScopes } = FunctionAccessGuard.extractFunctionScopes(scopes);
+        if (isAllAccessFunctionGuard) {


@geropl how can we test for a regression of this path manually? to use gitpod cli with PAT?

Yes, exactly. Still works 😉

components/server/src/auth/bearer-authenticator.ts

akosyakov

I tested that it works from dashboard with gRPC and JSON RPC, and from cli against experimental and gitpod

i left some comments

geropl · 2023-11-17T15:07:29Z

/unhold

akosyakov · 2023-11-19T20:22:28Z

dev/gpctl/cmd/public-api-workspaces-get.go

@@ -6,7 +6,8 @@ package cmd

 import (
 	"github.com/gitpod-io/gitpod/common-go/log"
-	v1 "github.com/gitpod-io/gitpod/components/public-api/go/experimental/v1"
+	v1 "github.com/gitpod-io/gitpod/components/public-api/go/v1"


@iQQBot could you approve it?

@easyCZ Would it be alright if ownership of gpctl or public-api-* files are shared with EXP team?

roboquat added do-not-merge/work-in-progress do-not-merge/hold size/L labels Nov 16, 2023

geropl force-pushed the gpl/request-context branch from 2443926 to e8e0eee Compare November 16, 2023 11:13

akosyakov reviewed Nov 16, 2023

View reviewed changes

components/server/src/auth/bearer-authenticator.ts Outdated Show resolved Hide resolved

Base automatically changed from gpl/request-context to main November 16, 2023 12:54

roboquat added size/XXL and removed size/L labels Nov 16, 2023

geropl force-pushed the gpl/897-pat-api branch from a29e3ea to abf7ad7 Compare November 16, 2023 12:59

roboquat added size/L size/XL and removed size/XXL size/L labels Nov 16, 2023

geropl force-pushed the gpl/897-pat-api branch from 42f41fc to e9f13a8 Compare November 16, 2023 16:06

geropl marked this pull request as ready for review November 17, 2023 09:26

geropl requested a review from a team as a code owner November 17, 2023 09:26

roboquat removed the do-not-merge/work-in-progress label Nov 17, 2023

github-actions bot added the team: team-experience label Nov 17, 2023

akosyakov reviewed Nov 17, 2023

View reviewed changes

components/server/src/auth/personal-access-token.spec.ts Show resolved Hide resolved

akosyakov reviewed Nov 17, 2023

View reviewed changes

geropl force-pushed the gpl/897-pat-api branch from e9f13a8 to 316ffbb Compare November 17, 2023 13:41

geropl requested a review from a team as a code owner November 17, 2023 13:41

github-actions bot added the team: team-engine label Nov 17, 2023

akosyakov reviewed Nov 17, 2023

View reviewed changes

components/server/src/auth/bearer-authenticator.ts Outdated Show resolved Hide resolved

akosyakov approved these changes Nov 17, 2023

View reviewed changes

geropl added 2 commits November 17, 2023 15:00

[server] Make gRPC accept PAT tokens (incl. tests)

c51a06b

[gpctl] Switch "gpctl api ws ls/get" to use v1/v1connect

b6dff1a

geropl force-pushed the gpl/897-pat-api branch from 316ffbb to b6dff1a Compare November 17, 2023 15:01

roboquat removed the do-not-merge/hold label Nov 17, 2023

akosyakov reviewed Nov 19, 2023

View reviewed changes

iQQBot approved these changes Nov 20, 2023

View reviewed changes

roboquat merged commit c279fc4 into main Nov 20, 2023

roboquat deleted the gpl/897-pat-api branch November 20, 2023 07:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[gRPC] Enable PATs to be used for authorizing with the gRPC API #19081

[gRPC] Enable PATs to be used for authorizing with the gRPC API #19081

Uh oh!

geropl commented Nov 16, 2023 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

akosyakov left a comment

Uh oh!

akosyakov commented Nov 17, 2023

Uh oh!

mustard-mh commented Nov 17, 2023 •

edited

Loading

Uh oh!

geropl commented Nov 17, 2023

Uh oh!

geropl commented Nov 17, 2023

Uh oh!

akosyakov Nov 17, 2023

Uh oh!

geropl Nov 17, 2023

Uh oh!

Uh oh!

akosyakov left a comment

Uh oh!

geropl commented Nov 17, 2023

Uh oh!

akosyakov Nov 19, 2023

Uh oh!

Uh oh!

[gRPC] Enable PATs to be used for authorizing with the gRPC API #19081

[gRPC] Enable PATs to be used for authorizing with the gRPC API #19081

Uh oh!

Conversation

geropl commented Nov 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

🤖[deprecated] Generated by Copilot at a29e3ea

Related Issue(s)

How to test

Documentation

Preview status

Build Options

Uh oh!

Uh oh!

Uh oh!

akosyakov left a comment

Choose a reason for hiding this comment

Uh oh!

akosyakov commented Nov 17, 2023

Uh oh!

mustard-mh commented Nov 17, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

geropl commented Nov 17, 2023

Uh oh!

geropl commented Nov 17, 2023

Uh oh!

akosyakov Nov 17, 2023

Choose a reason for hiding this comment

Uh oh!

geropl Nov 17, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

akosyakov left a comment

Choose a reason for hiding this comment

Uh oh!

geropl commented Nov 17, 2023

Uh oh!

akosyakov Nov 19, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

geropl commented Nov 16, 2023 •

edited

Loading

`🤖[deprecated] Generated by Copilot at a29e3ea`

mustard-mh commented Nov 17, 2023 •

edited

Loading