mirror of
https://github.com/hcengineering/platform.git
synced 2026-08-17 18:05:42 +02:00
develop
8
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Don KendallandGitHub
|
5a3d673e84 |
feat(account): revocable API tokens managed from account settings (#10624)
* feat: API token management in workspace settings Add UI and backend support for creating, listing, and revoking API tokens scoped to workspaces. Includes owner-level workspace token visibility, OpenAPI documentation, Mongo/Postgres persistence, and i18n translations. Signed-off-by: Don Kendall <kendall@donkendall.com> * feat: enforce API token revocation at transactor level Embed apiTokenId in JWT extra field and add a per-token revocation cache (60s TTL) in the transactor REST handler. Revoked tokens are now rejected within ~60 seconds instead of remaining valid until JWT expiry. Adds checkApiTokenRevoked account service method for the transactor to query individual token revocation status. Signed-off-by: Don Kendall <kendall@donkendall.com> * feat: implement Phase 1 API token scopes (read/write/delete) Add coarse-grained scope enforcement for API tokens. Tokens can now be created with scopes ['read:*'], ['read:*','write:*'], or ['read:*','write:*','delete:*']. Existing tokens without scopes retain full access (backward compatible). - DB: v26 migration adds scopes TEXT[] column to api_tokens - Types: add scopes field to ApiToken and ApiTokenInfo - Operations: createApiToken accepts/validates/persists scopes, embeds in JWT via extra.scopes - Enforcement: withSession checks scopes against method; tx handler additionally requires delete:* for TxRemoveDoc - Client: createApiToken signature accepts optional scopes param - UI: scope preset dropdown in create popup (default: Read Only), permissions column in token list with i18n labels - Also fixes 3 pre-existing TS2322/TS2345 errors in operations.ts Signed-off-by: Don Kendall <kendall@donkendall.com> * test: add unit tests for API token scope enforcement - scopes.test.ts: 8 tests for hasScope() and getRequiredScope() logic - apiTokenScopes.test.ts: 7 tests for createApiToken scope validation (valid scopes, multiple scopes, no scopes backward compat, invalid format rejection, empty array rejection, domain-scope rejection) and listApiTokens scopes inclusion - Export hasScope/getRequiredScope from rpc.ts for testability Signed-off-by: Don Kendall <kendall@donkendall.com> * fix: address review feedback — role restriction, locale parity, formatting - Restrict API token creation/revocation to AccountRole.User or higher (guests cannot use API tokens), per reviewer suggestion - Add 5 missing translation keys (ApiTokenPermissions, ApiTokenScopePreset, ApiTokenScopeReadOnly, ApiTokenScopeReadWrite, ApiTokenScopeFullAccess) to all non-en locale files to fix locale parity CI test - Fix prettier formatting in apiTokenScopes.test.ts - Rename local `extra` to `tokenExtra` in createApiToken to avoid shadowing the decoded token's `extra` field Signed-off-by: Don Kendall <kendall@donkendall.com> * fix: address aonnikov architectural review feedback - rpc.ts: use system service token for checkApiTokenRevoked so the revocation check is not coupled to the user's potentially-revoked bearer token; systemAccountUuid + service:'server' ensures account service always accepts the call - ApiDocsSection.svelte: derive transactor base URL from login.metadata.LoginEndpoint (set on auth) instead of window.location.origin, which is not necessarily the transactor host - ApiTokenCreatePopup.svelte: replace manual translate() calls and themeStore language watch with DropdownLabelsIntl + DropdownIntlItem[], which handle i18n automatically; error state is now IntlString - General.svelte: remove legacy GenerateApiToken button, handler, and ApiTokenPopup import in favour of the new ApiTokens settings panel Signed-off-by: Don Kendall <kendall@donkendall.com> * fix: formatting in ApiTokenPopup, apiTokenScopes test, and operations Signed-off-by: Don Kendall <kendall@donkendall.com> * fix: apply rushx fmt to pass CI formatting check Signed-off-by: Don Kendall <dkendall@ledoweb.com> * fix: restore (s as any) cast in server_http.ts removed by ESLint autofix Signed-off-by: Don Kendall <dkendall@ledoweb.com> * refactor(token): centralize API token revocation/expiry in verifyToken Address @aonnikov's review: the bespoke checkApiTokenRevoked RPC and the ad-hoc revocation cache in the transactor are replaced by a reusable verifyToken in server-token that checks signature, expiry, and (for revokable API tokens) revocation via a pluggable checker. - server-token: add verifyToken + isTokenExpired + setApiTokenRevocationChecker (the 'method to verify' metadata the plugin needs, without depending on the account client). Revocation cache (60s TTL) now lives here, reusable by any service (transactor, blob access, etc.). - account: the account is now authoritative — wrap() rejects revoked/expired API tokens, so any account method (selectWorkspace/getWorkspaceInfo/...) naturally 401s. Removed the redundant checkApiTokenRevoked method. - account-client: drop checkApiTokenRevoked. - transactor: withSession uses verifyToken; the registered checker reuses the existing getLoginInfoByToken instead of a dedicated boolean RPC. Scopes are parsed once and threaded through (no re-decode in the tx handler). - tests: verifyToken/isTokenExpired unit coverage. Signed-off-by: Don Kendall <dkendall@ledoweb.com> * fix(setting): derive REST API base from account-provided transactor endpoint Address @aonnikov: the REST API host must come from the transactor endpoint returned by the account service (the login endpoint, a ws(s):// URL), not be constructed from window.location. Convert ws->http and append /api/v1, matching the existing ServerManagerGeneral pattern. Signed-off-by: Don Kendall <dkendall@ledoweb.com> * i18n(setting): translate API token strings across all locales Address @ArtyomSavchenko: the new API token UI strings were left in English in non-en locales. Provide translations for ru/de/es/fr/it/pt/pt-br/zh/ja/cs/tr. The en/ru locale-parity test passes (the prior failure was an en/ru key mismatch, resolved by the develop merge). Signed-off-by: Don Kendall <dkendall@ledoweb.com> * style: wrap long lines to satisfy prettier (account utils import, ApiDocsSection) Signed-off-by: Don Kendall <dkendall@ledoweb.com> * fix(api-token): drop unenforceable scopes, harden the token lifecycle The scopes were only ever consulted in the transactor's REST handler, so they promised a boundary the platform did not keep: - the WebSocket transport decodes the token and never looks at scopes, so a read-only token could open a socket and issue any transaction; - even on the REST path, delete:* only matched a top-level TxRemoveDoc and was bypassed by nesting the removal in a TxApplyIf; - nothing stopped a scoped token from calling createApiToken and minting an unscoped one. Narrowing a token's rights has to happen in the pipeline, where it covers every transport, and that is a larger design than this feature. Until then a token carries its account's rights and says so, rather than displaying a restriction that does not hold. Scopes are removed end to end. What is kept is made to work: - API tokens can no longer create, list or revoke API tokens. Otherwise a leaked token renews itself and revokes the tokens meant to stop it. - Revocation fails closed. The account is the only authority on it, so an unreachable account now rejects the token instead of admitting a revoked one to whoever can keep the account busy. Verdicts stay trusted for the cache TTL so brief outages do not cut off healthy tokens. - The revocation cache is bounded and re-checks negative verdicts. - Revoking your own token no longer requires a role in its workspace, so leaving a workspace cannot strand a credential you can never revoke. - The per-account limit counts only usable tokens; revoked and expired ones are kept for the audit trail and used to lock out anyone rotating. - Rejected REST tokens are logged with a reason, since expired, revoked and unverifiable are one opaque 401 from outside. The unused listWorkspaceApiTokens/revokeWorkspaceApiToken pair is removed; it had no caller and no test. Tests cover the role restriction, the API-token guard, ownership on revoke, the limit accounting and fail-closed revocation. Removing any of those checks fails them. Claude-Session: https://claude.ai/code/session_01ANdoXbdn5k2hZy734EwKe7 Signed-off-by: Don Kendall <dkendall@ledoweb.com> * fix(setting): correct the API token settings page - Moves the page from workspace settings to account settings. Tokens belong to the account: the page already lists them across every workspace, and creating one only needs the User role the account service checks, not Owner as the category required. - Surfaces failures. A failed revoke was logged to the console and the row re-rendered unchanged; loading workspaces could reject unhandled and leave an empty dropdown with no explanation. - Outside a secure context there is no clipboard API, so the OK button did nothing and the dialog had no way out but Cancel. It now closes, leaving the token selectable. - Replaces hardcoded English labels, adds aria-expanded on the docs disclosure and labels on the copy targets. - Fills in the Korean and Polish translations, which were the only two locales missing these keys, and drops the API access strings orphaned when this PR replaced the old Generate API token button. Claude-Session: https://claude.ai/code/session_01ANdoXbdn5k2hZy734EwKe7 Signed-off-by: Don Kendall <dkendall@ledoweb.com> * chore: drop docs/openapi.yaml from the API token PR Unrelated to this feature and wrong for this repo: it documents a /_tokens minting service and a tools/mint-token CLI that do not exist here, uses reverse-proxy prefixes from a self-hosted deployment rather than the transactor's /api/v1 routes, and states that revocation is a future enhancement, which is what this PR implements. Nothing references it. REST API docs belong in their own change, generated against the routes that exist. Claude-Session: https://claude.ai/code/session_01ANdoXbdn5k2hZy734EwKe7 Signed-off-by: Don Kendall <dkendall@ledoweb.com> --------- Signed-off-by: Don Kendall <kendall@donkendall.com> Signed-off-by: Don Kendall <dkendall@ledoweb.com> |
||
|
|
cc16352be9 |
Sync with foundations packages (#10703)
* fix: redesign and compact Signed-off-by: Leonid Kaganov <lleo@lleo.me> * fix: comments Signed-off-by: Leonid Kaganov <lleo@lleo.me> * fix: correctly dropping connections in timeout Signed-off-by: Leonid Kaganov <lleo@lleo.me> * feature: loglevel in config Signed-off-by: Leonid Kaganov <lleo@lleo.me> * fix: loglevel in config Signed-off-by: Leonid Kaganov <lleo@lleo.me> * features lopt: direct personal messages between websockets by username Signed-off-by: Leonid Kaganov <lleo@lleo.me> * fix collaborator security query Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Fix svelte warnings Signed-off-by: Artem Savchenko <armisav@gmail.com> * Change log Signed-off-by: Artem Savchenko <armisav@gmail.com> * Add workspace permissions enum Signed-off-by: Artem Savchenko <armisav@gmail.com> * Add changelog Signed-off-by: Artem Savchenko <armisav@gmail.com> * Permission methods Signed-off-by: Artem Savchenko <armisav@gmail.com> * Update core and account versions Signed-off-by: Artem Savchenko <armisav@gmail.com> * Fix predicate Signed-off-by: Artem Savchenko <armisav@gmail.com> * Add changelog Signed-off-by: Artem Savchenko <armisav@gmail.com> * Fix object clone Signed-off-by: Artem Savchenko <armisav@gmail.com> * Bump and add changelog Signed-off-by: Artem Savchenko <armisav@gmail.com> * Fix exception in getTypeOf Signed-off-by: Artem Savchenko <armisav@gmail.com> * Disable changelog check Signed-off-by: Artem Savchenko <armisav@gmail.com> * Fix failed to fetch errors in account client Signed-off-by: Artem Savchenko <armisav@gmail.com> * Clean up Signed-off-by: Artem Savchenko <armisav@gmail.com> * Support in-memory mode for hulypulse Signed-off-by: Artem Savchenko <armisav@gmail.com> * Update platform-rig Signed-off-by: Artem Savchenko <armisav@gmail.com> * Comment change log verification Signed-off-by: Artem Savchenko <armisav@gmail.com> * Update pnpm lock Signed-off-by: Artem Savchenko <armisav@gmail.com> * Sync with foundation Signed-off-by: Artem Savchenko <armisav@gmail.com> * Update platform-rig Signed-off-by: Artem Savchenko <armisav@gmail.com> * Sync with foundation and bump versions Signed-off-by: Artem Savchenko <armisav@gmail.com> * Sync with foundations Signed-off-by: Artem Savchenko <armisav@gmail.com> * Update and increment versions Signed-off-by: Artem Savchenko <armisav@gmail.com> * Skip change log verification Signed-off-by: Artem Savchenko <armisav@gmail.com> * Fix hulypulse connections Signed-off-by: Artem Savchenko <armisav@gmail.com> * Fix formatting and ci Signed-off-by: Artem Savchenko <armisav@gmail.com> * Fix validation warnings Signed-off-by: Artem Savchenko <armisav@gmail.com> * Fix formatting Signed-off-by: Artem Savchenko <armisav@gmail.com> * Fix validation Signed-off-by: Artem Savchenko <armisav@gmail.com> * Fix pnpm lock Signed-off-by: Artem Savchenko <armisav@gmail.com> * Update versions Signed-off-by: Artem Savchenko <armisav@gmail.com> * Update hulypulse version Signed-off-by: Artem Savchenko <armisav@gmail.com> --------- Signed-off-by: Leonid Kaganov <lleo@lleo.me> Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> Signed-off-by: Artem Savchenko <armisav@gmail.com> Co-authored-by: Leonid Kaganov <lleo@lleo.me> Co-authored-by: Alexander Onnikov <Alexander.Onnikov@xored.com> |
||
|
Artyom SavchenkoandGitHub
|
5613b4f708 |
Fix npm packages to not use legacy repository format (#10576)
* Fix packages script Signed-off-by: Artem Savchenko <armisav@gmail.com> * Fix npm packages to not use legacy string repo Signed-off-by: Artem Savchenko <armisav@gmail.com> --------- Signed-off-by: Artem Savchenko <armisav@gmail.com> |
||
|
|
d2d8fb74eb |
Update dependencies (#10305)
* fix: redesign and compact Signed-off-by: Leonid Kaganov <lleo@lleo.me> * fix: comments Signed-off-by: Leonid Kaganov <lleo@lleo.me> * fix: correctly dropping connections in timeout Signed-off-by: Leonid Kaganov <lleo@lleo.me> * feature: loglevel in config Signed-off-by: Leonid Kaganov <lleo@lleo.me> * fix: loglevel in config Signed-off-by: Leonid Kaganov <lleo@lleo.me> * features lopt: direct personal messages between websockets by username Signed-off-by: Leonid Kaganov <lleo@lleo.me> * fix collaborator security query Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Fix svelte warnings Signed-off-by: Artem Savchenko <armisav@gmail.com> * Change log Signed-off-by: Artem Savchenko <armisav@gmail.com> * Add workspace permissions enum Signed-off-by: Artem Savchenko <armisav@gmail.com> * Add changelog Signed-off-by: Artem Savchenko <armisav@gmail.com> * Permission methods Signed-off-by: Artem Savchenko <armisav@gmail.com> * Update core and account versions Signed-off-by: Artem Savchenko <armisav@gmail.com> * Update core and account versions Signed-off-by: Artem Savchenko <armisav@gmail.com> --------- Signed-off-by: Leonid Kaganov <lleo@lleo.me> Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> Signed-off-by: Artem Savchenko <armisav@gmail.com> Co-authored-by: Leonid Kaganov <lleo@lleo.me> Co-authored-by: Alexander Onnikov <Alexander.Onnikov@xored.com> |
||
|
Denis Bykhov
|
c3eba17a7e |
update deps
Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com> |
||
|
Denis Bykhov
|
fd0b7130eb |
Add 'foundations/core/' from commit '4f31d1b32637d2f124f555531ee12be8af3fd4fc'
git-subtree-dir: foundations/core git-subtree-mainline: |
||
|
Denis Bykhov
|
6ea92dd409 |
remove to prepare for subtree
Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com> |
||
|
+1
|
98652c6476 |
Include sub projects (#10201)
* Add bump-changes * Add utility tests * Add utility tests * Bump to new version of esbuild and typescript * v0.7.3 * use platform rig 0.7.10 * upgrade: memory engine optimized; change name to (was recommended by Copilot and Onnikov, TODO: CHANGE CLIENT TOO!!!) Signed-off-by: Leonid Kaganov <lleo@lleo.me> * Fix rate limits bug * Bump versions * Fix lock file * Fix bug in queue cleanup * Add more tests for queue * Add api-test tests * Initial commit * Improve hierarchy + tests Add tests for hierarchy and few performance/memory optimizations. * Add more hierarchy tests * Move from Huly platform repository * Add docker tests setup * Fix test to be executed only once * Add connection tests * Fix package include source files * More tests * Create README.md * Fix pnpm lock * Fix packages publish * Remove broken tests * feat: adjust hulylake client for storage adapter Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Fix export * Fix publish * Fix message update (#114) Signed-off-by: Kristina Fefelova <kristin.fefelova@gmail.com> * Bump version Signed-off-by: Kristina Fefelova <kristin.fefelova@gmail.com> * Bump versions Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Fix lang store (#115) Signed-off-by: Kristina Fefelova <kristin.fefelova@gmail.com> * update hulylake client Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Bump version Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Add hulylake storage adapter Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Bump version Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * fix validation issues Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * fix: do not fail on deseralization error and add logs Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * bump version -> 0.1.14 Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * fix collaboration test Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Update prettier and new update-deps script Prettier + svelte support * fix unstable ydoc tests Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Add tx ordering middleware * Fix ordering tests * Fix Kafka close of admin * Add tests for measurement and understand overhead * Fix not updated lock file * Fix update-deps * Fix update-deps * Use latest platform-rig * Fix deps * Add rush check to CI * Use latest versions * Bump versions * Fix lock file * validate json patch Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * bump version -> 0.1.15 Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * fix merge unit tests Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Script to sync eslint deps * Fix deps * Fix tests * Fix platform-rig detection * Update to latest platform-rig * Update to latest platform rig and core * Bump typescript * Bump typescript * Rollback eslint plugins * Fix lock file * Bump platform-rig * Update to latest platform-rig * update to latest platform-rig * Allow to compile svelte files * Add ui-test component for checking compile * Fix log levels rename compile ui -> compile ui-esbuild * Fix build * Bump esbuild svelte version * Chore: use fixed versions in update-deps Signed-off-by: Alexey Zinoviev <alexey.zinoviev@xored.com> * Chore: commit changes Signed-off-by: Alexey Zinoviev <alexey.zinoviev@xored.com> * Update deps * Add tests for session manager * Fix txOrdering implementation * Bump ordering * Prevent metrics zero values in measure + Fix format svelte files * Revert update-deps script logic * v0.7.19 * update to latest platform-rig * Update deps * Fix pnpm * Session counters * Fix pnpm lock * Add storage client Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Bump versions Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * fix versions Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Bump core * Fix pnpm * Get rid of communication dependency * Add copilot memory file * Use proper name for instructions file * Fix instructions * Use domain instead of test name in gauges * Update instructions file * fix front service upload Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * remove incorrect test Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Move packages to huly.core * Move packages to core, since they are not utils * Add global user profile Signed-off-by: Alexey Zinoviev <alexey.zinoviev@xored.com> * Fix lock file Signed-off-by: Alexey Zinoviev <alexey.zinoviev@xored.com> * Add support for memory limit check * Bump version * Fix pnpm * report more accurate upload progress Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * fic validation issues Signed-off-by: Alexander Onnikov <Alexander.Onnikov@xored.com> * Fix deps Signed-off-by: Kristina Fefelova <kristin.fefelova@gmail.com> * Move LowLevelStorage to server * Fix linting * Revert "Fix linting" This reverts commit |