Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Validate that auth token provided when needed #1951

Merged
merged 8 commits into from
Feb 26, 2024

Conversation

szokeasaurusrex
Copy link
Member

Previously, if users ran a Sentry CLI command that required authentication via an auth token, the CLI would make the API request, which would fail with a 403 error because the user did not provide any authentication. With this change, we locally validate that the auth token is present whenever it is required, and if it is missing, we do not perform the API request.

This change is implemented by creating a new struct called AuthenticatedApi in the api.rs file. The AuthenticatedApi holds a reference to an Api struct, whose config has been verified to have a non-None auth. An authenticated function has been added to the Api struct. This function ensures the Api it is called on has an auth, and if it does, it returns an Ok containing an AuthenticatedApi wrapping the &Api; otherwise, authenticated returns an error.

All high-level Api functions, which call API endpoints requiring authentication (most of the high-level Api functions require authentication), have been moved to AuthenticatedApi. Api now only implements the low-level API functions and the high-level functions that call endpoints which don't require token authentication. All calls to the moved high-level functions have been updated by adding an authenticated()? call before calling methods requiring authentication.

Fixes GH-1905

@@ -251,6 +256,10 @@ pub enum ApiErrorKind {
CompressionFailed,
#[error("region overrides cannot be applied to absolute urls")]
InvalidRegionRequest,
#[error(
"Auth token is required for this request. Please run `sentry-cli login` and try again!"
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you think of this error message?

Copy link
Contributor

@loewenheim loewenheim left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM apart from some minor nits.

Err(QuietExit(1).into())
} else {
Ok(())
Err(err) => Err(anyhow::anyhow!(err)),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would suggest replacing this entire match:

    let info = info_rv?;
    if let Some(ref user) = info.user {
        println!("  User: {}", user.email);
    }
    if let Some(ref auth) = info.auth {
        println!("  Scopes:");
        for scope in &auth.scopes {
            println!("    - {scope}");
        }
    }
    Ok(())

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, yeah that looks much cleaner!

src/utils/sourcemaps.rs Outdated Show resolved Hide resolved
@szokeasaurusrex szokeasaurusrex enabled auto-merge (squash) February 26, 2024 14:52
@szokeasaurusrex szokeasaurusrex merged commit 26da328 into master Feb 26, 2024
12 checks passed
@szokeasaurusrex szokeasaurusrex deleted the szokeasaurusrex/auth-token-validate branch February 26, 2024 14:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Validate that required AUTH_TOKEN environment variable is not null
2 participants