-
-
Notifications
You must be signed in to change notification settings - Fork 4
feat(auth): rust client support for bearer auth #237
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
jan-auer
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM once rebased, thanks!
ac6f38b to
0c50276
Compare
lcian
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. Let's not forget to add this token_generator to the README as well.
|
|
||
| /// Sets a [`TokenGenerator`] that will be used to sign authorization tokens before | ||
| /// sending requests to Objectstore. | ||
| pub fn token_generator(self, token_generator: TokenGenerator) -> Self { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We need to pass either an enum or a trait that has two implementations:
- The
TokenGenerator, as implemented. - A fully signed
Token(could be a newtype around a string). This will be needed in sentry_cli.
There's a workaround currently that we configure the reqwest client builder and add a static header, but it would be much better that we make this a first-party functionality.
I'm good if this is added in a follow-up. Example for the trait in case you choose to implement it right now:
// disadvantage: Whatever we pass in must be public now. Maybe better to have a custom, internally borrowing struct.
pub use crate::client::ScopeInner as TokenScope;
pub trait TokenProvider {
fn sign_for_scope(&self, scope: &TokenScope) -> crate::Result<Token>;
}
struct ClientBuilderInner {
...
token_provider: Box<dyn TokenProvider>,
}
impl ClientBuilder {
pub fn token_provider<T: TokenProvider>(self, provider: T) -> Self {
let Ok(mut inner) = self.0 else { return self };
inner.token_provider = Some(Box::new(provider));
Self(Ok(inner))
}
}
0c50276 to
eba14de
Compare
|
technically i left it out of the README but it is added to the example client construction in the doc comments. |
depends on: - #240 - #237 - #243 rust and python e2e tests now have authorization checks enabled. i added new test cases to ensure requests fail when the token has the wrong scope or wrong permissions, but currently the server throws 500 for any issue so the tests can't actually assert 403 like they should i am told the `.secret_scan_ignore` file should prevent our scanners from yelling about the checked-in test keys. the format with escaped slashes is strange but that's what was on the doc i was sent ¯\_(ツ)_/¯ Ref FS-202
mint tokens in our client library if a secret key and other config has been passed in
i will update #231 for end-to-end testing of both clients
depends on #236
Ref FS-202