Api key implementation #466

AliasXoX · 2024-07-02T21:26:36Z

This pull request implements a new authentication method for lea5 using API Keys.
The authentication procedure using an API key has been documented.
Here's an overview of the changes coming with this pull request :

A new controller and view in order for admin to see, create and delete API keys
A new rails concern to authorize API key authentication (see api_key_authenticatable.rb) (to understand : https://keygen.sh/blog/how-to-implement-api-key-authentication-in-rails-without-devise/)
A new /api endpoint to login as an api key bearer (see routes.rb ; sessions_controller.rb ; sessions_helper.rb ; application_controller.rb)
A new rails secret to hash API keys (see api_key.rb)
An encoded file for credentials for the test environment
Modifying the way Cancancan abilities work in lea5 (see user_ability.rb ; user_ability.rb ; application_controller.rb)
Some tests that cover abilities, login with an api key and of course the api key controller's actions

Co-authored-by: DioFun <[email protected]> Co-authored-by: Nymous <[email protected]> Co-authored-by: AliasXoX <[email protected]> Co-authored-by: Molymawk <[email protected]>

codecov · 2024-07-02T21:28:32Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (f5516c8) to head (d1c5a4c).

Additional details and impacted files

@@            Coverage Diff            @@
##            master      #466   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           26        31    +5     
  Lines          337       414   +77     
  Branches        35        44    +9     
=========================================
+ Hits           337       414   +77

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Letiste · 2024-07-11T16:54:04Z

docs/features/api_authentication.md

@@ -0,0 +1,21 @@
+# API Authentication


For API authentication with API key, we usually do the authentication only with the Authorization header, and we would include it in all the requests. We don't have an authentication endpoint for APIs.
Why did you decide to use session? Maybe it was discussed somewhere else and I'm just not aware

Sorry for the late reply, I came to this conclusion because I didn't really know how to make the difference between a request coming from a regular user and an API key bearer because they both eventually end up making a GET request to access the website. I'll think of another way to recognize an API call to make it more conventional.

We should rework the way API is functionning. At first, there were a will of having the same link for API and normal pages. But, actually, it would be easier to have special path for api (/api/...).

DioFun · 2024-12-24T15:54:58Z

app/abilities/api_key_ability.rb

+  def initialize(api_key)
+    return if api_key.blank?
+
+    can :read, :all


We'll need in a near future to refine the permissions of each key, maybe by listing all the endpoints when creating one and let the user select which he wants the bearer to access (read, create, update, destroy), and change the permissions in the edit view.

DioFun · 2024-12-24T16:04:52Z

app/controllers/api_keys_controller.rb

+
+  def index
+    @api_keys = ApiKey.accessible_by(current_ability)
+    authorize! :index, @api_keys


note: differs from how we manage index in user_controller

DioFun · 2024-12-24T16:08:21Z

app/controllers/application_controller.rb


  private

  def still_authenticated?
    log_out if should_log_out?
  end
+
+  def api_auth
+    return unless request.path[0, 5] == '/api/'


Surely useless comment, but there is hard-coded text right here

DioFun · 2024-12-24T16:12:36Z

app/helpers/sessions_helper.rb

+  def log_in_api(bearer)
+    reset_session # For security reasons, we clear the session data before login
+    session[:api_key_id] = bearer.id
+    session[:expires_at] = Time.current


Can't understand why it's done this way

DioFun · 2024-12-24T16:29:02Z

app/controllers/application_controller.rb

+
+  def current_ability
+    @current_ability ||= if !session[:api_key_id].nil?
+


Suggested change

DioFun · 2024-12-24T16:31:02Z

app/controllers/sessions_controller.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true

 class SessionsController < ApplicationController
+  include ApiKeyAuthenticatable


Suggested change

include ApiKeyAuthenticatable

I'm not sure this is still useful

DioFun · 2024-12-24T16:49:58Z

config/initializers/_constants.rb

+# Path to login via api key
+AUTH_API_PATH = '/auth/api'
+


Suggested change

# Path to login via api key

AUTH_API_PATH = '/auth/api'

I think it's an artifact of the previous version that uses full connection and not Authorization header

DioFun · 2024-12-24T16:51:02Z

config/routes.rb

+    resources :users, controller: :users, as: 'api_users'
+    resources :api_keys, controller: :api_keys, as: 'api_api_keys'
+    resources :machines, controller: :machines, as: 'api_machines'


Surely things to do about these endpoints but that's not the goal of this PR

DioFun · 2024-12-24T16:55:21Z

test/controllers/sessions_controller_test.rb

+    @api_key = api_keys(:FakeRadius)
+    @real_key = '5fcdb374f0a70e9ff0675a0ce4acbdf6d21225fe74483319c2766074732d6d80'
+


Is this necessary ?

DioFun · 2024-12-24T16:57:18Z

test/controllers/api_keys_controller_right_test.rb

Maybe test if a wrong api key is provided ?

benoitlx and others added 30 commits May 31, 2024 20:07

Implementing search feature

636367a

Co-authored-by: DioFun <[email protected]> Co-authored-by: Nymous <[email protected]> Co-authored-by: AliasXoX <[email protected]> Co-authored-by: Molymawk <[email protected]>

add apikey controller

d390724

adding duration test the 31 of month #issue-2328471615

55ab055

add form and create feature for ApiKey

3b2c707

add apikey route

9cfb6ee

add new page and functionnal form to add api key

cf14ca4

delete api key create view

98e5f38

deleted function in api key helper

d46f1d1

add first tests

a24f1f9

test added for api key | checks if it can create an ApiKey

99385e2

New page for creating api keys

62ef0c7

add tests for api key index and destroy actions

a814f92

add fixture for api key

896d616

adding access via api authentication

0a84054

oups

0e60fad

adding cancancan abilities to api authentication

5be2472

oups 2

be2b48a

adding documentation

3b22322

adding hashed api keys

c94ec41

really hashing the keys

5823b20

don't really know what's going on but tests finally passed

7007ebc

adding credentials for test environment

543e5ad

Yes

23f2551

Merge branch 'master' of https://github.com/rezoleo/lea5

b912261

test credentials are public

a6b181d

adding tests

2f19aa3

Branch API_Key_implementation up to date with master

bc914f9

adding locals

fd171e1

adding locals

2431af6

adding locals

8e7d33f

AliasXoX requested review from nymous, DioFun, benoitlx and D0gmaDev July 2, 2024 21:26

AliasXoX added 4 commits July 3, 2024 14:21

adding tests to check rights for api keys

c6258a9

adding authorizations tests

0a5fde7

adding test for a session opened by an api key authentication

2917a3c

adding tests

3587ade

D0gmaDev previously approved these changes Jul 4, 2024

View reviewed changes

Letiste reviewed Jul 11, 2024

View reviewed changes

D0gmaDev mentioned this pull request Aug 18, 2024

Todo list #435

Open

23 tasks

AliasXoX added 4 commits October 26, 2024 14:03

creation of /api endpoint

862cab8

adding machines to /api scope & reformating api keys jbuilder view

f403dda

Merge branch 'master' of https://github.com/rezoleo/lea5

5737cc0

Merge branch 'master' into API_Key_implementation

a89d1cd

AliasXoX dismissed D0gmaDev’s stale review via a89d1cd October 26, 2024 13:16

Rubocop...

d1c5a4c

DioFun reviewed Dec 24, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Api key implementation #466

Api key implementation #466

AliasXoX commented Jul 2, 2024 •

edited

Loading

codecov bot commented Jul 2, 2024 •

edited

Loading

Letiste Jul 11, 2024 •

edited

Loading

AliasXoX Aug 28, 2024

DioFun Aug 28, 2024

DioFun Dec 24, 2024

DioFun Dec 24, 2024

DioFun Dec 24, 2024

DioFun Dec 24, 2024

DioFun Dec 24, 2024

DioFun Dec 24, 2024

DioFun Dec 24, 2024

DioFun Dec 24, 2024

DioFun Dec 24, 2024

DioFun Dec 24, 2024


		def current_ability
		@current_ability \|\|= if !session[:api_key_id].nil?

		@api_key = api_keys(:FakeRadius)
		@real_key = '5fcdb374f0a70e9ff0675a0ce4acbdf6d21225fe74483319c2766074732d6d80'

Api key implementation #466

Are you sure you want to change the base?

Api key implementation #466

Conversation

AliasXoX commented Jul 2, 2024 • edited Loading

codecov bot commented Jul 2, 2024 • edited Loading

Codecov Report

Letiste Jul 11, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

AliasXoX commented Jul 2, 2024 •

edited

Loading

codecov bot commented Jul 2, 2024 •

edited

Loading

Letiste Jul 11, 2024 •

edited

Loading