Flamenco-Server Proposal: Open Manager Interface calls to local users #54587

New Issue

Kael Baldwin · 2018-04-12T22:42:02+02:00

Kael Baldwin commented

2018-04-12 22:42:02 +02:00

Currently, only users logged in via blender id can use the manager's interface actions, such as create_new(), revoke_auth_token(), as well as the PATCH eve call used to edit managers.

This is because the only method being used to authenticate users is the validate_token() method that is ran before every request is processed.

The validate_token() can find a user if one of the following is true:

a token is provided via a Bearer Authorization header.
a blender id token is provided via a session cookie.

My proposal is to change the second option to not only accept blender id tokens, but any other provided token that is stored in the database and is provided via the session cookie.

Currently, only users logged in via blender id can use the manager's interface actions, such as create_new(), revoke_auth_token(), as well as the PATCH eve call used to edit managers. This is because the only method being used to authenticate users is the validate_token() method that is ran before every request is processed. The validate_token() can find a user if one of the following is true: - a token is provided via a Bearer Authorization header. - a blender id token is provided via a session cookie. My proposal is to change the second option to not only accept blender id tokens, but any other provided token that is stored in the database and is provided via the session cookie. ```

Kael Baldwin commented

2018-04-12 22:42:02 +02:00

Added subscriber: @KaelenBaldwin

Kael Baldwin changed title from ~~Flamenco-Server Proposal: Open Manager Interface API calls to local users~~ to Flamenco-Server Proposal: Open Manager Interface calls to local users

2018-04-12 22:43:46 +02:00

Kael Baldwin commented

2018-04-12 23:33:09 +02:00

This looks as easy as grabbing the session from flask and then taking the user_id from that session and validating based on that user id.

I'm not sure why we aren't just using flask_login to authenticate these routes however, since it's already authenticating via session cookie anyways. Maybe flask_login doesn't handle login via the blender_id cookie?

If the goal is not to use session cookies, then the front end needs to be altered to use Bearer Tokens instead, and then the validate_token method needs to not check for session cookies at all... I think.

This looks as easy as grabbing the session from flask and then taking the user_id from that session and validating based on that user id. I'm not sure why we aren't just using flask_login to authenticate these routes however, since it's already authenticating via session cookie anyways. Maybe flask_login doesn't handle login via the blender_id cookie? If the goal is not to use session cookies, then the front end needs to be altered to use Bearer Tokens instead, and then the validate_token method needs to not check for session cookies at all... I think.

Francesco Siddi commented

2018-04-13 00:59:49 +02:00

Added subscriber: @fsiddi

Kael Baldwin commented

2018-04-23 21:35:23 +02:00

The create new manager and revoke existing token endpoints are easy to fix.

The problem I'm running into now is with editing a manager.
The interface uses the flamenco/manager patch method, which goes through Pillar's patch_handler, which uses authorization.require_login.

I feel like it would be too intrusive to edit the patch_manager, since that's a part of pillar itself.

I think the best solution for allowing a local user to edit a manager, would be to create an actual edit route, that does not use the patch_handler.
This would more closely mirror pillar's project edit workflow.

But I'm curious what you think @fsiddi

The create new manager and revoke existing token endpoints are easy to fix. The problem I'm running into now is with editing a manager. The interface uses the flamenco/manager patch method, which goes through Pillar's patch_handler, which uses authorization.require_login. I feel like it would be too intrusive to edit the patch_manager, since that's a part of pillar itself. I think the best solution for allowing a local user to edit a manager, would be to create an actual edit route, that does not use the patch_handler. This would more closely mirror pillar's project edit workflow. But I'm curious what you think @fsiddi

Francesco Siddi commented

2018-05-08 16:40:51 +02:00

Hello Kael, unfortunately I'm very busy with other projects at the moment. I'll come back to this conversation later next week.

Kael Baldwin commented

2018-07-29 02:38:15 +02:00

Hey @fsiddi , I ended up becoming busy myself with another project as well, but am freed up now and am looking into this again.

Would you have time to look at this, perhaps?

I'm going to have to re-acclimate myself to the project again, but once I do I'd like to go ahead and implement this if it sounds like the right direction to go.

Hey @fsiddi , I ended up becoming busy myself with another project as well, but am freed up now and am looking into this again. Would you have time to look at this, perhaps? I'm going to have to re-acclimate myself to the project again, but once I do I'd like to go ahead and implement this if it sounds like the right direction to go.

Francesco Siddi commented

2018-08-13 21:26:38 +02:00

Hi Kael - same here unfortunately. I'm definitely interested in looking into this, but it might take some time. I'll keep you posted!

Kael Baldwin commented

2018-08-31 15:40:06 +02:00

no problem thanks!

Dalai Felinto commented

2019-12-23 18:39:40 +01:00

Added subscriber: @dfelinto

Dalai Felinto commented

2019-12-23 18:39:40 +01:00

Changed status from 'Confirmed' to: 'Archived'

Dalai Felinto closed this issue

2019-12-23 18:39:40 +01:00

Dalai Felinto self-assigned this 2019-12-23 18:39:40 +01:00

Dalai Felinto commented

2019-12-23 18:39:40 +01:00

Hi, thanks for your patch.

We are undergoing a Tracker Curfew where we are automatically closing old patches.

If you think the patch is still relevant please update and re-submit it. For new features make sure there is a clear design from the user level perspective.

Hi, thanks for your patch. We are undergoing a [Tracker Curfew ](https://code.blender.org/?p=3861) where we are automatically closing old patches. If you think the patch is still relevant please update and re-submit it. For new features make sure there is a clear design from the user level perspective.

Sign in to join this conversation.