From 9a31b9c077389623e7d6614c21d6cba1487012d7 Mon Sep 17 00:00:00 2001 From: Xavier Stouder Date: Thu, 3 Jul 2025 21:59:07 +0200 Subject: [PATCH] api: change endpoint name and allow it to be called even if not in current token scope --- doc/api/garage-admin-v2.json | 8 ++++---- src/api/admin/admin_token.rs | 14 +++++++------- src/api/admin/api.rs | 6 +++--- src/api/admin/api_server.rs | 3 ++- src/api/admin/openapi.rs | 8 ++++---- src/api/admin/router_v2.rs | 2 +- 6 files changed, 21 insertions(+), 20 deletions(-) diff --git a/doc/api/garage-admin-v2.json b/doc/api/garage-admin-v2.json index 5c26aa84..9f140081 100644 --- a/doc/api/garage-admin-v2.json +++ b/doc/api/garage-admin-v2.json @@ -1108,20 +1108,20 @@ } } }, - "/v2/IntrospectAdminToken": { + "/v2/GetCurrentAdminTokenInfo": { "get": { "tags": [ "Admin API token" ], "description": "\nReturn information about the calling admin API token.\n ", - "operationId": "IntrospectAdminToken", + "operationId": "GetCurrentAdminTokenInfo", "responses": { "200": { "description": "Information about the admin token", "content": { "application/json": { "schema": { - "$ref": "#/components/schemas/IntrospectAdminTokenResponse" + "$ref": "#/components/schemas/GetCurrentAdminTokenInfoResponse" } } } @@ -2832,7 +2832,7 @@ } } }, - "IntrospectAdminTokenResponse": { + "GetCurrentAdminTokenInfoResponse": { "type": "object", "required": [ "name", diff --git a/src/api/admin/admin_token.rs b/src/api/admin/admin_token.rs index 598c4bca..a4fa17ea 100644 --- a/src/api/admin/admin_token.rs +++ b/src/api/admin/admin_token.rs @@ -175,14 +175,14 @@ impl RequestHandler for DeleteAdminTokenRequest { } } -impl RequestHandler for IntrospectAdminTokenRequest { - type Response = IntrospectAdminTokenResponse; +impl RequestHandler for GetCurrentAdminTokenInfoRequest { + type Response = GetCurrentAdminTokenInfoResponse; async fn handle( self, garage: &Arc, _admin: &Admin, - ) -> Result { + ) -> Result { let now = now_msec(); if garage @@ -192,7 +192,7 @@ impl RequestHandler for IntrospectAdminTokenRequest { .as_ref() .is_some_and(|s| s == &self.admin_token) { - return Ok(IntrospectAdminTokenResponse { + return Ok(GetCurrentAdminTokenInfoResponse { id: None, created: None, name: "metrics_token (from daemon configuration)".into(), @@ -209,7 +209,7 @@ impl RequestHandler for IntrospectAdminTokenRequest { .as_ref() .is_some_and(|s| s == &self.admin_token) { - return Ok(IntrospectAdminTokenResponse { + return Ok(GetCurrentAdminTokenInfoResponse { id: None, created: None, name: "admin_token (from daemon configuration)".into(), @@ -307,10 +307,10 @@ fn apply_token_updates( Ok(()) } -fn my_admin_token_info_results(token: &AdminApiToken, now: u64) -> IntrospectAdminTokenResponse { +fn my_admin_token_info_results(token: &AdminApiToken, now: u64) -> GetCurrentAdminTokenInfoResponse { let params = token.params().unwrap(); - IntrospectAdminTokenResponse { + GetCurrentAdminTokenInfoResponse { id: Some(token.prefix.clone()), created: Some( DateTime::from_timestamp_millis(params.created as i64) diff --git a/src/api/admin/api.rs b/src/api/admin/api.rs index 7ad2c652..1af3b7ba 100644 --- a/src/api/admin/api.rs +++ b/src/api/admin/api.rs @@ -56,7 +56,7 @@ admin_endpoints![ CreateAdminToken, UpdateAdminToken, DeleteAdminToken, - IntrospectAdminToken, + GetCurrentAdminTokenInfo, // Layout operations GetClusterLayout, @@ -393,13 +393,13 @@ pub struct DeleteAdminTokenRequest { pub struct DeleteAdminTokenResponse; #[derive(Debug, Clone, Serialize, Deserialize)] -pub struct IntrospectAdminTokenRequest { +pub struct GetCurrentAdminTokenInfoRequest { pub admin_token: String, } #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)] #[serde(rename_all = "camelCase")] -pub struct IntrospectAdminTokenResponse { +pub struct GetCurrentAdminTokenInfoResponse { /// Identifier of the admin token (which is also a prefix of the full bearer token) pub id: Option, /// Creation date diff --git a/src/api/admin/api_server.rs b/src/api/admin/api_server.rs index 14029423..9884500b 100644 --- a/src/api/admin/api_server.rs +++ b/src/api/admin/api_server.rs @@ -24,6 +24,7 @@ use garage_api_common::generic_server::*; use garage_api_common::helpers::*; use crate::api::*; +use crate::api::AdminApiRequest::GetCurrentAdminTokenInfo; use crate::error::*; use crate::router_v0; use crate::router_v1; @@ -273,7 +274,7 @@ fn verify_authorization( .get_local(&EmptyKey, &prefix.to_string())? .and_then(|k| k.state.into_option()) .filter(|p| !p.is_expired(now_msec())) - .filter(|p| p.has_scope(endpoint_name)) + .filter(|p| p.has_scope(endpoint_name) || endpoint_name == "GetCurrentAdminTokenInfo") .ok_or_else(|| Error::forbidden(invalid_msg))? .token_hash } else { diff --git a/src/api/admin/openapi.rs b/src/api/admin/openapi.rs index 09780fa0..248fd29f 100644 --- a/src/api/admin/openapi.rs +++ b/src/api/admin/openapi.rs @@ -192,17 +192,17 @@ fn UpdateAdminToken() -> () {} fn DeleteAdminToken() -> () {} #[utoipa::path(get, - path = "/v2/IntrospectAdminToken", + path = "/v2/GetCurrentAdminTokenInfo", tag = "Admin API token", description = " Return information about the calling admin API token. ", responses( - (status = 200, description = "Information about the admin token", body = IntrospectAdminTokenResponse), + (status = 200, description = "Information about the admin token", body = GetCurrentAdminTokenInfoResponse), (status = 500, description = "Internal server error") ), )] -fn IntrospectAdminToken() -> () {} +fn GetCurrentAdminTokenInfo() -> () {} // ********************************************** // Layout operations @@ -885,7 +885,7 @@ impl Modify for SecurityAddon { CreateAdminToken, UpdateAdminToken, DeleteAdminToken, - IntrospectAdminToken, + GetCurrentAdminTokenInfo, // Layout operations GetClusterLayout, GetClusterLayoutHistory, diff --git a/src/api/admin/router_v2.rs b/src/api/admin/router_v2.rs index 06836b46..3009d128 100644 --- a/src/api/admin/router_v2.rs +++ b/src/api/admin/router_v2.rs @@ -40,7 +40,7 @@ impl AdminApiRequest { POST CreateAdminToken (body), POST UpdateAdminToken (body_field, query::id), POST DeleteAdminToken (query::id), - GET IntrospectAdminToken (admin_token), + GET GetCurrentAdminTokenInfo (admin_token), // Layout endpoints GET GetClusterLayout (), GET GetClusterLayoutHistory (),