search

scientist-softserv / palni-palci

Other
1 stars 0 forks source link

Implement Authorization #1037

Open kirkkwang opened 4 months ago

kirkkwang commented 4 months ago

Story

Currently, WillowSword is unprotected and allows anyone to deposit. We must implement authorization before rolling this feature out.

https://github.com/CottageLabs/willow_sword/wiki/Enabling-Authorization-In-Willow-Sword

Acceptance Criteria

Testing Instructions

In your terminal send this request:

curl --request GET \
  --url <insert-appropriate-url-here>/sword/service_document \
  --header 'Content-Type: application/xml'

You should see and error because no API key was sent with the request.

See Kirk for API-key, and retest with the API-key, it should now succeed.

ShanaLMoore commented 3 months ago

@kirkkwang Does this need to be QA'd? If so, could you please include testing instructions? Thanks!

kirkkwang commented 3 months ago

@ShanaLMoore Got it, added some instructions.

ShanaLMoore commented 3 months ago

QA Results: Pass ✅

Tested by sending the curl request from my terminal to pals knapsack staging.

With NO API Key ✅

The request did not have an API key, so I was denied:

image

With API Key: ✅

Request was successful:

image

kirkkwang commented 3 months ago

To whoever is QA'ing this, please contact me on slack so I can set up your user with an API key

ctgraham commented 3 months ago

QA Results: Pass ✅

Confirmed Not Authorized without the key at https://demo.palni-palci-staging.notch8.cloud/sword/service_document .

Confirmed successful service document with an authorized key. The Content-type header does not seem to affect anything, but that is non-critical.

jillpe commented 1 month ago

This gets deployed with the knapsack cutover