Api key implementation #466

AliasXoX · 2024-07-02T21:26:36Z

This pull request implements a new authentication method for lea5 using API Keys.
The authentication procedure using an API key has been documented.
Here's an overview of the changes coming with this pull request :

A new controller and view in order for admin to see, create and delete API keys
~~A new rails concern to authorize API key authentication (see api_key_authenticatable.rb)~~
A new /api endpoint to login as an api key bearer (see routes.rb ;)
A new rails secret to hash API keys (see api_key.rb)
An encoded file for credentials for the test environment
A new api namespace (under /api/)
A new application controller for api requests only (see api/api_application_controller.rb ; api/users_controller.rb ; api/machines_controller.rb ; api/api_keys_controller.rb)
Modifying the way Cancancan abilities work in lea5 (see user_ability.rb ; api_key_ability.rb ; api/api_application_controller.rb ; application_controller.rb)
Some tests that cover abilities, login with an api key and of course the api key controller's actions
Custom cop for RuboCop

The method of implemention is highly inspired by https://keygen.sh/blog/how-to-implement-api-key-authentication-in-rails-without-devise/

Co-authored-by: DioFun <DioFun@users.noreply.github.com> Co-authored-by: Nymous <thomas.gaudin@centraliens-lille.org> Co-authored-by: AliasXoX <AliasXoX@users.noreply.github.com> Co-authored-by: Molymawk <Molymawk@users.noreply.github.com>

tekvalir · 2024-12-24T15:54:58Z

app/abilities/api_key_ability.rb

+  def initialize(api_key)
+    return if api_key.blank?
+
+    can :read, :all


We'll need in a near future to refine the permissions of each key, maybe by listing all the endpoints when creating one and let the user select which he wants the bearer to access (read, create, update, destroy), and change the permissions in the edit view.

tekvalir · 2024-12-24T16:04:52Z

app/controllers/api_keys_controller.rb

+
+  def index
+    @api_keys = ApiKey.accessible_by(current_ability)
+    authorize! :index, @api_keys


note: differs from how we manage index in user_controller

tekvalir · 2024-12-24T16:08:21Z

app/controllers/application_controller.rb


  private

  def still_authenticated?
    log_out if should_log_out?
  end
+
+  def api_auth
+    return unless request.path[0, 5] == '/api/'


Surely useless comment, but there is hard-coded text right here

tekvalir · 2024-12-24T16:12:36Z

app/helpers/sessions_helper.rb

+  def log_in_api(bearer)
+    reset_session # For security reasons, we clear the session data before login
+    session[:api_key_id] = bearer.id
+    session[:expires_at] = Time.current


Can't understand why it's done this way

tekvalir · 2024-12-24T16:29:02Z

app/controllers/application_controller.rb

+
+  def current_ability
+    @current_ability ||= if !session[:api_key_id].nil?
+


Suggested change

tekvalir · 2024-12-24T16:31:02Z

app/controllers/sessions_controller.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true

 class SessionsController < ApplicationController
+  include ApiKeyAuthenticatable


Suggested change

include ApiKeyAuthenticatable

I'm not sure this is still useful

tekvalir · 2024-12-24T16:49:58Z

config/initializers/_constants.rb

+# Path to login via api key
+AUTH_API_PATH = '/auth/api'
+


Suggested change

# Path to login via api key

AUTH_API_PATH = '/auth/api'

I think it's an artifact of the previous version that uses full connection and not Authorization header

tekvalir · 2024-12-24T16:51:02Z

config/routes.rb

+    resources :users, controller: :users, as: 'api_users'
+    resources :api_keys, controller: :api_keys, as: 'api_api_keys'
+    resources :machines, controller: :machines, as: 'api_machines'


Surely things to do about these endpoints but that's not the goal of this PR

tekvalir · 2024-12-24T16:55:21Z

test/controllers/sessions_controller_test.rb

+    @api_key = api_keys(:FakeRadius)
+    @real_key = '5fcdb374f0a70e9ff0675a0ce4acbdf6d21225fe74483319c2766074732d6d80'
+


Is this necessary ?

tekvalir · 2024-12-24T16:57:18Z

test/controllers/api_keys_controller_right_test.rb

Maybe test if a wrong api key is provided ?

app/controllers/api_machines_controller.rb

app/controllers/api_users_controller.rb

nymous

Great PR! Limited in scope, with tests, docs and example sources...

I left some comments on the files, and maybe a more "general" thing to consider:
Maybe we should rework a little bit the authenticate_with_http_token and its callback authenticator, which doesn't have a ! but raises an exception if the API key is not found, but because we only use authenticate_with_http_token and not authenticate_or_request_with_http_token Rails doesn't return a 401 if the API key is wrong, it's just a 404... Maybe get a bit closer from the example, where they use the or_request method, and the find_by (without !) to return nil if no API key matches instead of an exception, that way we have proper HTTP status codes (and we can always implement the "optional" auth if needed...)

app/models/api_key.rb

app/controllers/api_application_controller.rb

app/controllers/concerns/api_key_authenticatable.rb

app/controllers/api_api_keys_controller.rb

app/models/api_key.rb

test/controllers/api_keys_controller_test.rb

test/controllers/api_keys_user_right_test.rb

test/controllers/api_api_keys_controller_test.rb

test/controllers/api_machines_controller_test.rb

test/fixtures/api_keys.yml

nymous · 2025-05-08T12:58:39Z

app/controllers/api/api_keys_controller.rb

+  class ApiKeysController < ApiApplicationController
+    def index
+      @api_keys = ApiKey.accessible_by(current_ability)
+      authorize! :index, @api_keys


I'm not sure you can call authorize! :index with a list of objects, or if it works like you expect. Can you try to remove the permissions in your ability.rb and make sure this breaks as expected?
(But if it works, great! We will add it to the other "index" actions in all controllers ^^)

nymous · 2025-05-09T18:35:32Z

app/controllers/api_keys_controller.rb

-        format.html { render 'new', status: :unprocessable_entity }
-      end
+    if @api_key.save
+      flash[:new_api_key] = "ApiKey a dded! It is #{@api_key.api_key}"


If you specify the entire flash text, I think you can keep the :success key. I was thinking of using a custom flash key to allow for a specific presentation in the view, where we show the API key in a code block.

nymous · 2025-05-09T19:55:05Z

test/controllers/api_keys_user_right_test.rb

-    assert_raises CanCan::AccessDenied do
-      get "#{api_api_keys_path}.json"
-    end
+    get "#{api_api_keys_path}.json"


You can now remove these .json in paths, with the default fomat: :json!

nymous · 2025-05-09T20:01:35Z

lib/custom_cops/inherits_api_application_controller.rb

+    MOD_DIRECTORY = 'app/controllers/api/'
+    MOD_CONTROLLER = 'ApiApplicationController'
+    MSG = "All controllers in the Mod namespace should inherit from #{MOD_CONTROLLER}" # rubocop:disable Style/MutableConstant


Suggested change

MOD_DIRECTORY = 'app/controllers/api/'

MOD_CONTROLLER = 'ApiApplicationController'

MSG = "All controllers in the Mod namespace should inherit from #{MOD_CONTROLLER}" # rubocop:disable Style/MutableConstant

API_DIRECTORY = 'app/controllers/api/'

API_CONTROLLER = 'ApiApplicationController'

MSG = "All controllers in the Api namespace should inherit from #{API_CONTROLLER}".freeze

nymous · 2025-05-09T20:39:07Z

lib/custom_cops/inherits_api_application_controller.rb

+      parent_class = node.parent_class&.const_name || ''
+
+      if parent_class == MOD_CONTROLLER ||
+         (parent_module_name.split('::').include?('Mod') && "Mod::#{parent_class}" == MOD_CONTROLLER)


Suggested change

(parent_module_name.split('::').include?('Mod') && "Mod::#{parent_class}" == MOD_CONTROLLER)

(parent_module_name.split('::').include?('Api') && "Api::#{parent_class}" == MOD_CONTROLLER)

nymous

Let's gooooo

tekvalir · 2025-05-10T17:00:57Z

test/models/ability_test.rb

@@ -107,4 +110,8 @@ def setup
  test 'admin can do everything' do
    assert @admin_ability.can?(:manage, :all)
  end
+
+  test 'shoul be able to read everything with an api key' do


typo shoul instead of should

benoitlx and others added 30 commits May 31, 2024 20:07

Implementing search feature

636367a

Co-authored-by: DioFun <DioFun@users.noreply.github.com> Co-authored-by: Nymous <thomas.gaudin@centraliens-lille.org> Co-authored-by: AliasXoX <AliasXoX@users.noreply.github.com> Co-authored-by: Molymawk <Molymawk@users.noreply.github.com>

add apikey controller

d390724

adding duration test the 31 of month #issue-2328471615

55ab055

add form and create feature for ApiKey

3b2c707

add apikey route

9cfb6ee

add new page and functionnal form to add api key

cf14ca4

delete api key create view

98e5f38

deleted function in api key helper

d46f1d1

add first tests

a24f1f9

test added for api key | checks if it can create an ApiKey

99385e2

New page for creating api keys

62ef0c7

add tests for api key index and destroy actions

a814f92

add fixture for api key

896d616

adding access via api authentication

0a84054

oups

0e60fad

adding cancancan abilities to api authentication

5be2472

oups 2

be2b48a

adding documentation

3b22322

adding hashed api keys

c94ec41

really hashing the keys

5823b20

don't really know what's going on but tests finally passed

7007ebc

adding credentials for test environment

543e5ad

Yes

23f2551

Merge branch 'master' of https://github.com/rezoleo/lea5

b912261

test credentials are public

a6b181d

adding tests

2f19aa3

Branch API_Key_implementation up to date with master

bc914f9

adding locals

fd171e1

adding locals

2431af6

adding locals

8e7d33f

AliasXoX added 4 commits October 26, 2024 14:03

creation of /api endpoint

862cab8

adding machines to /api scope & reformating api keys jbuilder view

f403dda

Merge branch 'master' of https://github.com/rezoleo/lea5

5737cc0

Merge branch 'master' into API_Key_implementation

a89d1cd

AliasXoX dismissed D0gmaDev’s stale review via a89d1cd October 26, 2024 13:16

Rubocop...

d1c5a4c

tekvalir reviewed Dec 24, 2024

View reviewed changes

AliasXoX added 5 commits January 24, 2025 19:35

Rearranging api files

f79467a

Adding tests, removing artifacts and updating routes for api keys

351eb39

Merge branch 'master' of https://github.com/rezoleo/lea5

c14bb3f

Merge branch 'master' into API_Key_implementation

7fc0a58

adding and formatting tests and finalizing authorizations for api keys

b8f1eb2

github-advanced-security bot found potential problems Apr 9, 2025

View reviewed changes

app/controllers/api_machines_controller.rb Fixed Show fixed Hide fixed

app/controllers/api_users_controller.rb Fixed Show fixed Hide fixed

AliasXoX added 3 commits April 11, 2025 21:21

Merge branch 'master' of https://github.com/rezoleo/lea5

4a3ea29

Merge branch 'master' into API_Key_implementation

5a732cb

organizing files

ad04504

nymous requested changes Apr 14, 2025

View reviewed changes

github-project-automation bot moved this from Reviewer approved to Review in progress in Lea5 Apr 14, 2025

AliasXoX added 4 commits May 3, 2025 16:48

api keys update and some overall modifications

306468e

Merged of migrations and deleted bearer concept

1e0117a

remove custom cop from code coverage

2b5e14d

require rubocop for CI

b8ec91d

nymous requested changes May 9, 2025

View reviewed changes

fixing typos, semantic and remove 'authorize' for index

f240972

nymous approved these changes May 10, 2025

View reviewed changes

github-project-automation bot moved this from Review in progress to Reviewer approved in Lea5 May 10, 2025

AliasXoX merged commit 9da0348 into master May 10, 2025
7 checks passed

AliasXoX deleted the API_Key_implementation branch May 10, 2025 13:40

github-project-automation bot moved this from Reviewer approved to Done in Lea5 May 10, 2025

tekvalir reviewed May 10, 2025

View reviewed changes


		def current_ability
		@current_ability \|\|= if !session[:api_key_id].nil?

		@api_key = api_keys(:FakeRadius)
		@real_key = '5fcdb374f0a70e9ff0675a0ce4acbdf6d21225fe74483319c2766074732d6d80'

	(parent_module_name.split('::').include?('Mod') && "Mod::#{parent_class}" == MOD_CONTROLLER)
	(parent_module_name.split('::').include?('Api') && "Api::#{parent_class}" == MOD_CONTROLLER)

Api key implementation #466

Api key implementation #466

Uh oh!

Conversation

AliasXoX commented Jul 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nymous left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nymous left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

AliasXoX commented Jul 2, 2024 •

edited

Loading