Improved Messages: API Authentication Keys

[danfunk]

Allow users to create API keys which they can use to make calls directly to the SpiffWorkflow backend API without requiring a JSON web token.

• [ ] Modify the database to allow users to create and name one or more API keys which they can use to connect, these API keys should have some kind of TTL associated with them, and should be marked as invalid afterwards.
• [X] Update the UI to allow users to create and view api keys
• [X] Update the User.verify_token to allow authentication with an API key in addition to a JSON web token.

[chrda81]

Hi @danfunk,

this sounds wonderful, because I'm looking forward to start workflows from "outside" via the API. Is there an approximate time frame when this feature will be available?

[danfunk]

Want to help me work on it @chrda81 ? I believe the API key generation side of things is complete, but we need to refactor a few things about messages to make them easier to use and connect. There is work to be done in the API (Python), Front End (React) and BPMN-JS (POJS) if you would like to divide the work between us.

[chrda81]

@danfunk Maybe I can have a look at the Python stuff. Please tell me how I could help?

[calexh-sar]

Moving this ticket to Ready for QA, decided not to implement TTL at this time.

[jasquat]

implemented in PR #489. It requires a process model extension to run - https://github.com/sartography/enterprise-process-models/tree/main/extensions/api-keys.

[dinithihj]

Moving to Ready to Release as this is tested under https://www.notion.so/Authentication-Keys-47c6b7f49150410f8b07be836205d45d

[madhurrya]

Released to Prod on November 27th

[adebisi-fa]

implemented in PR #489. It requires a process model extension to run - https://github.com/sartography/enterprise-process-models/tree/main/extensions/api-keys.

Thank you all for the hard and thorough work on this project!

Interactions from external systems are a primary requirement for Workflow systems, and it is really pleasing to see this project adopt the pluggable extension architecture to achieve this (among other features), for maximum flexibility.

It is sad, though, that the API-keys extension, the ingredient to achieve these needed interactions, is locked away in the enterprise-process-models repository.

With all the power and flexibility it provides, SpiffArea's adoption as a project is pretty underwhelming, which is not very encouraging. However, this can change if this extension is released as part of the sample-process-model repository. It'll immediately put it on par with some BIG industry players or even quickly pull out to be better than them.

SpiffArena is awesome. The community would really like to contribute to its development in any way possible to maintain its awesomeness!

Well done, and thank you, once again!

Foluso.