synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-13 21:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: issue with token auth (#4483)

Browse Source
This commit is contained in:
Garrett Delfosse
2022-10-11 11:58:28 -04:00
committed by GitHub
parent a70278e0e1
commit 3cb2d52a08
3 changed files with 43 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
coderd/httpmw/apikey.go
View File

@ -204,7 +204,7 @@ func ExtractAPIKey(cfg ExtractAPIKeyConfig) func(http.Handler) http.Handler {
// Tracks if the API key has properties updated
changed = false
)
if key.LoginType != database.LoginTypePassword {
if key.LoginType == database.LoginTypeGithub || key.LoginType == database.LoginTypeOIDC {
link, err = cfg.DB.GetUserLinkByUserIDLoginType(r.Context(), database.GetUserLinkByUserIDLoginTypeParams{
UserID: key.UserID,
LoginType: key.LoginType,

39
coderd/httpmw/apikey_test.go
View File

@ -589,6 +589,45 @@ func TestAPIKey(t *testing.T) {
require.Equal(t, http.StatusOK, res.StatusCode)
require.EqualValues(t, 1, atomic.LoadInt64(&count))
})
t.Run("Tokens", func(t *testing.T) {
t.Parallel()
var (
db = databasefake.New()
id, secret = randomAPIKeyParts()
hashed = sha256.Sum256([]byte(secret))
r = httptest.NewRequest("GET", "/", nil)
rw = httptest.NewRecorder()
user = createUser(r.Context(), t, db)
)
r.Header.Set(codersdk.SessionCustomHeader, fmt.Sprintf("%s-%s", id, secret))
sentAPIKey, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
ID: id,
HashedSecret: hashed[:],
LoginType: database.LoginTypeToken,
LastUsed: database.Now(),
ExpiresAt: database.Now().AddDate(0, 0, 1),
UserID: user.ID,
Scope: database.APIKeyScopeAll,
})
require.NoError(t, err)
httpmw.ExtractAPIKey(httpmw.ExtractAPIKeyConfig{
DB: db,
RedirectToLogin: false,
})(successHandler).ServeHTTP(rw, r)
res := rw.Result()
defer res.Body.Close()
require.Equal(t, http.StatusOK, res.StatusCode)
gotAPIKey, err := db.GetAPIKeyByID(r.Context(), id)
require.NoError(t, err)
require.Equal(t, sentAPIKey.LastUsed, gotAPIKey.LastUsed)
require.Equal(t, sentAPIKey.ExpiresAt, gotAPIKey.ExpiresAt)
require.Equal(t, sentAPIKey.LoginType, gotAPIKey.LoginType)
})
}
func createUser(ctx context.Context, t *testing.T, db database.Store) database.User {