search

NuGet / NuGetGallery

NuGet Gallery is a package repository that powers https://www.nuget.org. Use this repo for reporting NuGet.org issues.
https://www.nuget.org/
Apache License 2.0
1.55k stars 641 forks source link

[OIDC 4] Add method to create a short-lived API key (minimal) #10267

Closed joelverhagen closed 1 day ago

joelverhagen commented 1 week ago

Progress on https://github.com/NuGet/NuGetGallery/issues/10212. Depends on https://github.com/NuGet/NuGetGallery/pull/10262.

This adds a new method to CredentialBuilder which creates a short-lived API key given a federated credential trust policy.

This method has a TODO in it linking to the OIDC work item because the exact shape of the short lived API key is still in discussion. The created credential is not yet associated with a user (the created by user account) because this is the responsibility of IAuthenticationService.AddCredential: https://github.com/NuGet/NuGetGallery/blob/0ec99618043ae7f7e54a3ed8fdbbb47acc5e30b1/src/NuGetGallery.Services/Authentication/AuthenticationService.cs#L629-L641

This will be called in a future PR while executing the token trade endpoint.

This stub allows me to perform the token trade flow with a current V4 API key, without any of the improvements we will need (such as hiding this API keys from the API key page, not sending API key expiration messages, etc.).