API Authentication #285

elegaanz · 2018-10-21T16:28:07Z

App model
API endpoint to register an app
ApiToken model
OAuth2 endpoint to get a token, from app and user credentials
make ApiToken a request guard

Fixes #275

Stores their name, website, and credentials

src/main.rs

igalic

👀

plume-models/src/apps.rs

and use it for the posts API

trinity-1686a

I think it could help with readability to have a special type with some parameters, doing by itself something similar to ApiToken.can(), and which could be used as a request guard (so we could do something like fn read_post( [...] , _authorized: Authorization<Read, Post>) and it would deny request without tests to do by ourself)

docs/API.md

trinity-1686a · 2018-10-22T19:39:31Z

plume-api/src/apps.rs

+use canapi::Endpoint;
+
+#[derive(Clone, Default, Serialize, Deserialize)]
+pub struct AppEndpoint {


This feel strange to be at the same time data received from Post (with id, client_id and client_secret ignored, as they must be generated by the server) and data returned by the api (with those same field used, and most likely different than what was originally posted if they where). It should either be 2 different struct or at least a struct with FromForm custom-implemented to ensure that

We can't use FromForm in plume-api, or we would loose all the benefits of canapi.

But I think I may add a Server/Client/Both wrapper type to specify when a field is required and make it easier to check if something has been forgotten.

Or maybe canapi is just a bad idea and we should drop it... 🤔

plume-api/src/apps.rs

src/api/mod.rs

Filter requests that don't have an API token authorized to read or write a specific scope;

Co-Authored-By: BaptisteGelez <baptiste@gelez.xyz>

src/api/authorization.rs

And remove some warnings about unused parameters

trinity-1686a

There are just a few quick things that should be changed or discussed, and this will be good to go

plume-models/src/api_tokens.rs

src/api/posts.rs

Only require it when reading draft articles.

elegaanz added 2 commits October 21, 2018 14:19

Add a model for external apps

95ebf57

Stores their name, website, and credentials

Add an API endpoint to register apps

ac4bca3

elegaanz added A: API Related to the REST API C: Feature This is a new feature S: Incomplete This PR is not complete yet A: Security A: Backend Code running on the server labels Oct 21, 2018

trinity-1686a reviewed Oct 21, 2018

View reviewed changes

src/main.rs Outdated Show resolved Hide resolved

igalic reviewed Oct 22, 2018

View reviewed changes

plume-models/src/apps.rs Show resolved Hide resolved

elegaanz added 4 commits October 22, 2018 14:30

Add an ApiToken model, and an endpoint to get one

c845551

Disable CSRF for the whole API

2a98251

impl FromRequest for ApiToken

056f4fd

and use it for the posts API

Document API authentication and apps API

3629710

elegaanz added S: Ready for review This PR is ready to be reviewed and removed S: Incomplete This PR is not complete yet labels Oct 22, 2018

trinity-1686a reviewed Oct 22, 2018

View reviewed changes

elegaanz and others added 4 commits October 23, 2018 10:37

New request guard: Authorization<Action, Scope>

4249f5c

Filter requests that don't have an API token authorized to read or write a specific scope;

AppEndpoint.name is required for both the client and server

21f4c9d

Make it impossible to know if an username is used or not with the API

a1a062d

Use the full URL to refer to the Apps API

8e4ab95

Co-Authored-By: BaptisteGelez <baptiste@gelez.xyz>

elegaanz force-pushed the api-auth branch from d3342ed to 8e4ab95 Compare October 23, 2018 11:16

elegaanz commented Oct 23, 2018

View reviewed changes

src/api/authorization.rs Outdated Show resolved Hide resolved

elegaanz commented Oct 23, 2018

View reviewed changes

src/api/authorization.rs Outdated Show resolved Hide resolved

elegaanz force-pushed the api-auth branch 2 times, most recently from beb3d86 to 49e0605 Compare October 25, 2018 09:44

Use PhantomData intead of two Options useless for Authorization

1a2ad8d

And remove some warnings about unused parameters

elegaanz force-pushed the api-auth branch from 49e0605 to 1a2ad8d Compare October 25, 2018 09:45

trinity-1686a force-pushed the api-auth branch from 8eb5291 to 1a2ad8d Compare October 27, 2018 17:20

trinity-1686a reviewed Oct 27, 2018

View reviewed changes

plume-models/src/api_tokens.rs Show resolved Hide resolved

plume-models/src/api_tokens.rs Show resolved Hide resolved

src/api/posts.rs Outdated Show resolved Hide resolved

src/api/posts.rs Outdated Show resolved Hide resolved

ApiToken: rename what to scope

827026a

Make Authorization optional for read routes

0006bdf

Only require it when reading draft articles.

trinity-1686a approved these changes Oct 30, 2018

View reviewed changes

elegaanz merged commit e26a150 into master Oct 30, 2018

elegaanz deleted the api-auth branch October 30, 2018 17:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

API Authentication #285

API Authentication #285

elegaanz commented Oct 21, 2018 •

edited

Loading

igalic left a comment

trinity-1686a left a comment

trinity-1686a Oct 22, 2018

elegaanz Oct 22, 2018

trinity-1686a left a comment

API Authentication #285

API Authentication #285

Conversation

elegaanz commented Oct 21, 2018 • edited Loading

igalic left a comment

Choose a reason for hiding this comment

trinity-1686a left a comment

Choose a reason for hiding this comment

trinity-1686a Oct 22, 2018

Choose a reason for hiding this comment

elegaanz Oct 22, 2018

Choose a reason for hiding this comment

trinity-1686a left a comment

Choose a reason for hiding this comment

elegaanz commented Oct 21, 2018 •

edited

Loading