Add Query Tokens (View Only) to courses

[Xiangmingchen]

Context

As of now, to query information from broadway (such as grading job status) one must use the course token for authentication. However, the same course token is used for adding new grading jobs, adding new assignments, and modifying existing assignments. This means broadway on-demand server cannot risk sending this token to the client (browser) because that gives the student the opportunity to learn this token. Previously on-demand have been using the server as a middle man to relay requests and results. This was slowing down the performance of status requests. However, for SSE endpoint integration, the overhead of the rely becomes too high. Hence we decided to create a new kind of token for each course.

What's done

• Add query_tokens array to courses
• Replace authenticate_course function with authenticate_course_admin and authenticate_course_member_or_admin.
  • authenticate_course_admin only allows users with a token in the tokens array of the course
  • authenticate_course_member_or_admin allows users with both tokens or query_tokens
• Separate all endpoints that used authenticate_course to use either of the replacement functions
  • authenticate_course_admin:
    • POST/GET Grading config
    • POST Grading run
    • GET Grading job log (grading job logs might have sensitive information such as test case assertions)
    • GET Worker node info
    • GET Course total queue length
  • authenticate_course_member_or_admin:
    • GET Grading run status
    • GET Grading job's queue position
    • GET Grading job status with streaming Server Side Event connection
• Updated existing test cases/course config schema
• [x] add a test case for using query tokens on one of the designated services

Notes

Please note that if students do end up obtaining the query token, they will not be able to schedule more runs for themselves or modify current assignments. But, they will be able to query other students' grading run status/job queue position if they somehow obtain the job/run ids.

[jhenhapl]

LGTM, just have to update the integration tests to account for the new tokens

[ezhang887]

Can you update the wiki also? https://github.com/illinois-cs241/broadway/wiki/Configs#course-config

[Xiangmingchen]

Oops merged too early

Edit: nvm