search

CarnegieLearningWeb / UpGrade

Framework for adding A/B testing to education applications
https://www.upgradeplatform.org/
BSD 3-Clause "New" or "Revised" License
25 stars 12 forks source link

Bypass Google Authentication for '/experiments' and '/metric' Endpoints #1752

Closed zackcl closed 1 week ago

zackcl commented 1 month ago

Is your feature request related to a problem? Please describe. The api/experiments and api/metric/save endpoints are being requested by the demo app and the tester app, but they currently fail with a 401 (Unauthorized) error due to lack of Google authentication in the request.

I believe these endpoints are useful for testing UpGrade, and requiring Google authentication makes it difficult to use them. If we are concerned about the security, I think we can require different authentication methods, like an API key for developers.

Describe the solution you'd like The @Authorized() decorator for these endpoints should be commented out (search for @JsonController('/experiments') and @JsonController('/metric') in the codebase) to bypass the Google authentication until we implement a different authentication method.

Describe alternatives you've considered Implement different authentication methods, like an API key for developers.

UPDATE: We decided to add support for service account access token verification for API authentication.

zackcl commented 1 month ago

I believe the person who owns the GOOGLE_CLIENT_ID we use for UpGrade needs to create a service account at https://console.cloud.google.com/, then create a service key JSON file and share the file with me through pwpush (so that I can generate the access token for API requests). See this Slack post for your reference.

@VivekFitkariwala @ppratikcr7 @danoswaltCL @bcb37

ppratikcr7 commented 1 month ago

I believe the person who owns the GOOGLE_CLIENT_ID we use for UpGrade needs to create a service account at https://console.cloud.google.com/, then create a service key JSON file and share the file with me through pwpush (so that I can generate the access token for API requests). See this Slack post for your reference.

@VivekFitkariwala @ppratikcr7 @danoswaltCL @bcb37

I will do this for you. But I cant access the slack chat. Maybe you can share details on my personal slack. Thanks :)