Merge pull request #408 from ExaWorks/service_key

Use auth keys for test uploads

Author: hategan

README-testing.md

@@ -36,6 +36,10 @@ python/cpython-x.y.z`) or something similar, such as loading a conda or
 virtual environment, please run the relevant commands before invoking
 `psij-ci-setup`.
 
+Note: To upload data to the test server, you will need an authentication
+key. You can obtain such a key from https://testing.psij.io/auth.html.
+Obtaining a key requires a valid email.
+
 
 Testing with the CI Runner
 ==========================

psij-ci-setup

@@ -206,6 +206,60 @@ check_email() {
     fi
 }
 
+check_key() {
+    if ! -f ~/.psij/key ; then
+        BASE_URL=`egrep '^[^#]*server_url.*' ./testing.conf |awk '{split($0, a, "="); print a[2]}'|xargs`
+        AUTH_URL="${BASE_URL}/auth.html"
+
+        echo
+        echo "================================================================"
+        echo "There is no upload key (~/.psij/key). An upload key is needed   "
+        echo "to upload results to the results site. To obtain a key, please  "
+        echo "go to ${AUTH_URL}/auth.html in a browser and follow "
+        echo "the instructions on that page.                                  "
+        echo "================================================================"
+        echo
+
+        RESPONSE=""
+        DONE="0"
+
+        while [ "$DONE" == "0" ]; do
+            echo "1. (C)ontinue without a key                                 "
+            echo "2. E(x)it?                                                  "
+            echo "3. (E)nter a key here to be placed in ~/.psij/key           "
+            if [ "$XDG_CURRENT_DESKTOP" != "" ]; then
+                echo "4. (O)pen $AUTH_URL in a browser    "
+            fi
+            read -n1 RESPONSE
+            echo
+            RESPONSE=${RESPONSE^}
+
+            if [ "$RESPONSE" == "C" ] || [ "$RESPONSE" == "1" ]; then
+                DONE=1
+            elif [ "$RESPONSE" == "X" ] || [ "$RESPONSE" == "2" ]; then
+                echo "Operation canceled"
+                exit 1
+            elif [ "$RESPONSE" == "E" ] || [ "$RESPONSE" == "3" ]; then
+                RESPONSE=""
+                while [ "$RESPONSE" != "Y" ]; do
+                    echo -n "Enter key: "
+                    read KEY
+                    echo "You entered '$KEY'."
+                    echo "Is this correct (Y/N)?"
+                    read -n1 RESPONSE
+                    RESPONSE=${RESPONSE^}
+                done
+                echo "$KEY" > ~/.psij/key
+                chmod 600 ~/.psij/key
+                DONE=1
+            elif [ "$RESPONSE" == "O" ] || [ "$RESPONSE" == "4" ]; then
+                xdg-open "$AUTH_URL"
+            fi
+        done
+
+    fi
+}
+
 FORCE=0
 
 if [ "$1" == "-f" ]; then
@@ -230,6 +284,8 @@ continue_or_exit
 
 check_email
 
+check_key
+
 cd "$MYPATH"
 
 echo -n "Installing dependencies..."

testing.conf

@@ -148,28 +148,6 @@ custom_attributes =
 server_url = https://testing.psij.io
 
 
-#
-# A key authenticates a test ID such that it reduces the odds that two machines
-# compete to overwrite each other's results. The machines are identified by their
-# IDs. However, without additional steps, any other test deployment can set its
-# ID to an existing one. The "key" setting allows a secret to be used to
-# authenticate requests. There are two valid values:
-#
-# random:
-#     Generates a random key on the first upload attempt. The server will then
-#     only accept subsequent requests from the same ID if the key matches. There
-#     is a 7 day expiration of a pairing which allows for a new key to be used
-#     if an old key has not been used for 7 or more days. Random keys are
-#     persisted locally in ~/.psij
-#
-# "<string>":
-#     A custom string to be used as a key.
-#
-# key = random | "<string>"
-
-key = random
-
-
 #
 # The maximum age, in hours, for saved test results to be kept on disk. When
 # tests are run with the "--save-results", test results are saved on disk.

tests/conftest.py

@@ -257,13 +257,20 @@ def _cache(file_path, fn):
 
 
 def _get_key(config):
-    key = config.getoption('key')
-    if key == 'random':
-        return _cache(KEY_FILE, secrets.token_hex)
-    elif key[0] == '"' and key[-1] == '"':
-        return key[1:-1]
+    if Path('~/.psij/key').exists():
+        with open('~/.psij/key') as f:
+            return f.read().strip()
     else:
-        raise ValueError('Invalid value for --key argument: "%s"' % key)
+        # use legacy if needed
+        key = config.getoption('key')
+        logger.warning('Legacy keys are deprecated. Please go to https://testing.psij.io/auth.html '
+                       'to obtain an authentication key.')
+        if key == 'random':
+            return _cache(KEY_FILE, secrets.token_hex)
+        elif key[0] == '"' and key[-1] == '"':
+            return key[1:-1]
+        else:
+            raise ValueError('Invalid value for --key argument: "%s"' % key)
 
 
 def _get_id(config):