Scoped API tokens with clearance group access #1766
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
lamppu
had a problem deploying
to
test-environment
GitHub Actions
Failure
lamppu
temporarily deployed
to
unittest-environment
GitHub Actions
Inactive
lamppu
force-pushed
the
scoped-api-tokens-with-clearance-groups-access
branch
from
fb39f4a to
94f14e5
Compare
lamppu
temporarily deployed
to
test-environment
GitHub Actions
Inactive
lamppu
temporarily deployed
to
unittest-environment
GitHub Actions
Inactive
lamppu
force-pushed
the
scoped-api-tokens-with-clearance-groups-access
branch
from
94f14e5 to
391523b
Compare
lamppu
temporarily deployed
to
test-environment
GitHub Actions
Inactive
lamppu
temporarily deployed
to
unittest-environment
GitHub Actions
Inactive
lamppu
force-pushed
the
scoped-api-tokens-with-clearance-groups-access
branch
from
391523b to
e845bf8
Compare
lamppu
temporarily deployed
to
unittest-environment
GitHub Actions
Inactive
lamppu
temporarily deployed
to
test-environment
GitHub Actions
Inactive
lamppu
force-pushed
the
scoped-api-tokens-with-clearance-groups-access
branch
from
e845bf8 to
2e68120
Compare
lamppu
temporarily deployed
to
test-environment
GitHub Actions
Inactive
lamppu
temporarily deployed
to
unittest-environment
GitHub Actions
Inactive
Introduce an API client as a top-level entity to group API tokens, e.g. per customer or client instance (such as an ORT Server instance). This will also later allow for aggregating usage data per client for comparison. The API tokens are added with support for scoped access to the API, as well as a ranked access to specific clearance groups. The ranking order will be used to determine which clearance items to return in case there are multiple clearance items for the same entity from different groups. Signed-off-by: Johanna Lamppu <[email protected]>
Signed-off-by: Johanna Lamppu <[email protected]>
Export the cache from a module to use the same cache instance from several places. This allows for invalidating a specific token in the cache for example when revoking the token. It should be noted though, that in the case of multiple server replicas, the cache could be implemented for example as a shared Redis cache, as the Node cache will exist within a single Node process. But in the context of this PR, the cache will only be used for the frequently polled job state endpoint, so invalidating the cache before the TTL has expired is not critical. Signed-off-by: Johanna Lamppu <[email protected]>
Use an HMAC secret for hashing the API tokens. This prevents raw token disclosure from the database but still allows a fast and deterministic lookup during request authentication. It also allows for emergency invalidation of all tokens by rotating the secret. The ranking order of the clearance groups to allow a token access to is based on the order of which they are given in the request body. Updating the ranking or the clearance groups will be done by providing the whole list in the patch request. Adding or removing a scope from a token is performed similarly, with a patch request for the token. Signed-off-by: Johanna Lamppu <[email protected]>
Ensure Express Request type augmentation remains global even when the file contains imports, by explicitly using `declare global`. Without imports TypeScript treats the file as a global script, but when imports are added, it treats it as a module instead. This is done in preparation of extending the type in a way that requires an import. Signed-off-by: Johanna Lamppu <[email protected]>
The function authenticates the token and saves the available scopes and clearance groups (in the ranking order) in the request object. Also add a function for authorizing requests only for a specific scope. Signed-off-by: Johanna Lamppu <[email protected]>
Also use an API request context from the new fixture wrapper in the existing scanner router tests and edit test descriptions slightly. Signed-off-by: Johanna Lamppu <[email protected]>
Use the new middleware for authentication and the scoped authorization in the scanner router. Signed-off-by: Johanna Lamppu <[email protected]>
lamppu
force-pushed
the
scoped-api-tokens-with-clearance-groups-access
branch
from
2e68120 to
6e2fb24
Compare
Member
|
A general question: will we be needing two separate tokens from now on / in future, one for the DOS Scanner and one for the PCP? If that happens at some point, it needs to be then clearly communicated to all customers (including us developers) and thought should be given to how to distribute these tokens. |
Member
Author
The same token can (and in the current cases will) be provided access to both the scan data and the clearance data, so both scopes can be added to the same token. |
Etsija
approved these changes
Jan 29, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add API clients as a top-level entity to group API tokens, e.g. per customer or client instance. This hierarchy structure can later be used to aggregate and compare usage data per client and possibly limit requests per client. The tokens are added with support for two different scopes, to allow for separating access to scan data and clearance data. This PR also adds the basis for allowing access for a token to specific clearance groups in a ranked order. Applying this access in the package configurations endpoint will be added in a separate PR.