-
-
Notifications
You must be signed in to change notification settings - Fork 227
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: Validate that auth token provided when needed #1951
Conversation
@@ -251,6 +256,10 @@ pub enum ApiErrorKind { | |||
CompressionFailed, | |||
#[error("region overrides cannot be applied to absolute urls")] | |||
InvalidRegionRequest, | |||
#[error( | |||
"Auth token is required for this request. Please run `sentry-cli login` and try again!" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What do you think of this error message?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM apart from some minor nits.
src/commands/info.rs
Outdated
Err(QuietExit(1).into()) | ||
} else { | ||
Ok(()) | ||
Err(err) => Err(anyhow::anyhow!(err)), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would suggest replacing this entire match:
let info = info_rv?;
if let Some(ref user) = info.user {
println!(" User: {}", user.email);
}
if let Some(ref auth) = info.auth {
println!(" Scopes:");
for scope in &auth.scopes {
println!(" - {scope}");
}
}
Ok(())
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice, yeah that looks much cleaner!
Co-authored-by: Sebastian Zivota <[email protected]>
Previously, if users ran a Sentry CLI command that required authentication via an auth token, the CLI would make the API request, which would fail with a 403 error because the user did not provide any authentication. With this change, we locally validate that the auth token is present whenever it is required, and if it is missing, we do not perform the API request.
This change is implemented by creating a new struct called
AuthenticatedApi
in theapi.rs
file. TheAuthenticatedApi
holds a reference to anApi
struct, whose config has been verified to have a non-None auth. Anauthenticated
function has been added to theApi
struct. This function ensures theApi
it is called on has an auth, and if it does, it returns anOk
containing anAuthenticatedApi
wrapping the&Api
; otherwise,authenticated
returns an error.All high-level
Api
functions, which call API endpoints requiring authentication (most of the high-levelApi
functions require authentication), have been moved toAuthenticatedApi
.Api
now only implements the low-level API functions and the high-level functions that call endpoints which don't require token authentication. All calls to the moved high-level functions have been updated by adding anauthenticated()?
call before calling methods requiring authentication.Fixes GH-1905