-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[PLAT-14672] getSessionInfo should return a valid api token
Summary: With D35345 change, YBA does not store the api token in plain text anymore. Only the hash of the api token is saved and used for auth verification. As part of D35345 the getSessionInfo was returning the hashed api token in the response. This is not useful for the end user. The workflow for getting started with YBA API is to first /api_login. This returns a SessionInfo response that contains a apiToken, customer uuid, and user uuid. This information can then used for subsequent API calls, with apiToken placed in X-AUTH-YW-API-TOKEN header. The API token will be refreshed when calling any of the unauthenticated APIs /login, /api_login, or the authenticated APIs /api_token, and /session_info. With this diff, the change in behaviour is: Old: getSessionInfo used to return the previously generated api token Now: getSessionInfo generates a new api token and returns it Clients (like YBM) that could invoke concurrent requests to fetch the api token should use the `/api_token??apiTokenVersion=$lastApiTokenVersion` to make sure that the latest valid api token is used in the current thread. Invoking /session_info will always generate a new api token, and if invoked concurrently, will leave only one of the invoking threads with a valid api token. So for example, this method in YBM needs to be updated to use `/api_token??apiTokenVersion=$lastApiTokenVersion`: ``` https://github.com/yugabyte/yugabyte-cloud/blob/acb47b1c01e138a726d339888652eebf45fb7df5/common/src/main/java/clients/platform/PlatformClientImpl.java#L436-L444 @OverRide public String generateApiKey(UUID customerUUID, boolean withRetries) throws RetryableException, InterruptedException { // Call the session_info endpoint which uses "user.getOrCreateApiToken()", and hence is safe for // out-of-order generate requests // Creates the apiToken if it isn't already created, else just returns it String url = String.format("%s/api/v1/session_info", hostname); JsonNode responseJson = get(url, true /* useAuthToken */, withRetries); return responseJson.get("apiToken").asText(); } ``` Test Plan: Manually tested the /session_info returns a valid api token that then works for a subsequent API call Reviewers: dkumar, amalyshev, cwang, anijhawan, #yba-api-review, amindrov, daniel, dnolan Reviewed By: dkumar, #yba-api-review Subscribers: yugaware Differential Revision: https://phorge.dev.yugabyte.com/D36560
- Loading branch information
1 parent
56d2d2d
commit c8e7530
Showing
5 changed files
with
17 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters