search

nodesource / ncm-ci

NCM for CICD systems
https://nodesource.com/products/certified-modules
MIT License
8 stars 2 forks source link

check token permissions before doing anything #17

Closed pmuellr closed 6 years ago

pmuellr commented 6 years ago

Somewhat related to: https://github.com/nodesource/accounts-ui/issues/500

Rather than wait to make sure the user has the right permissions to use ncm-ci, wondering if we should perhaps check first. Then we could provide an error message indicating what permissions are required.

One reason to do this is that the error messages coming back from ncm2-api aren't really clear as to what the problem is, other than "auth errors". We could have ncm2-api actually return information regarding the permissions required, but ... that's slightly weird. I guess we would also have to return information regarding "roles" (if they passed a user token).

It's possible long-term we'll have a better story for customers here, but for now it seems like adding a token permission check in ncm-ci will be the simplest thing to do.

For reference, this is what accounts-api returns for GET /user/details when a service token is passed in the Auth header:

{
    "tokenId": "<token-id-here>",
    "orgId": "<org-id-here>",
    "tokenName": "my-new-service-token",
    "permissions": [
        "ncm:policy:read",
        "ncm:cert:read"
    ]
}
juliangruber commented 6 years ago

Great idea! Added:

Insufficient permissions. Your token needs at least:
- ncm:policy:read
- ncm:cert:read