Cloud 2020-11-04 Tracking issue

[tsenart]

Plan

1. Cloud: @ryanslade, @artemruts and @asdine will be working towards the first milestone of RFC 255, as broken down by @quinnkeast in Product Board.
2. Cloud Security: @unknwon, @flying-robot and @arussellsaw will be working on faster permissions updates with webhooks, speccing out 2FA auth and potentially implementing it already this cycle, and writing an RFC for end to end testing of our authorization.
3. Metrics: @arussellsaw will also be working on Log Sourcegraph extensions events in BigQuery which unblocks the @sourcegraph/web team's ability to have metrics around their extensions work.

Availability

If you have planned unavailability this iteration (e.g., vacation), you can note that here.

Tracked issues

@artemruts: 1.00d

• [ ] Make password reset link duration configurable by site admins (#13999; PRs: #15622) 1.00d 🔒

@arussellsaw: 7.00d

Completed: 7.00d

• [x] (🏁 11 days ago) Include database versions in ping data (~#14405~; PRs: ~#15389~) 2.00d
• [x] (🏁 11 days ago) Sharing of Sourcegraph searches breaks when using GitHub auth (~#15132~; PRs: ~#15439~) 1.00d
• [x] (🏁 8 days ago) UX: username is not mentioned in the verification email (~#10411~; PRs: ~#15572~) 0.50d 🔒
• [x] (🏁 5 days ago) Email disableTLS site config property is misnamed (~#13043~) 0.50d
• [x] (🏁 today) Log Sourcegraph extensions events in BigQuery (~#15007~) 3.00d

@asdine: 3.50d

Completed: 3.50d

• [x] (🏁 13 days ago) Move db helpers to internal/db (~#15317~) :shipit:
• [x] (🏁 13 days ago) Add support for kind filter to RepoStore.List (~#15383~) :shipit:
• [x] (🏁 13 days ago) Change ExternalService nullable variables from pointers to values (~#15388~) :shipit:
• [x] (🏁 11 days ago) Add IDs, UseOr and ExternalServiceID filters to repo store List method (~#15440~) :shipit:
• [x] (🏁 11 days ago) repo updater store: Simplify interface (~#14714~; PRs: ~#15343~) 2.00d 🧶
• [x] (🏁 8 days ago) Disable Gitlab's nameTransformations setting for user-added external services (~#15529~; PRs: ~#15577~) 0.50d
• [x] (🏁 4 days ago) Add private code feature flag and enforce it (~#15322~; PRs: ~#15730~) 1.00d

@flying-robot: 2.50d

• [ ] Make password reset link duration configurable by site admins (#13999; PRs: #15622) 1.00d 🔒

Completed: 1.50d

• [x] (🏁 11 days ago) Submodules not actionable on file tree (~#15286~; PRs: ~#15441~) 1.00d 👩
• [x] (🏁 8 days ago) frontend: build relative submodule links in a safer way (~#15574~) :shipit:
• [x] (🏁 7 days ago) debugserver: handle wildcard pprof requests (~#15587~) :shipit:🐛
• [x] (🏁 4 days ago) Error when updating display name and avatar URL (~#15663~; PRs: ~#15693~) 0.50d 👩

@quinnkeast: 0.50d

Completed: 0.50d

• [x] (🏁 8 days ago) UX: username is not mentioned in the verification email (~#10411~; PRs: ~#15572~) 0.50d 🔒

@ryanslade: 3.50d

Completed: 3.50d

• [x] (🏁 13 days ago) repo-updater: Small test cleanups (~#15390~) :shipit:
• [x] (🏁 5 days ago) Improve description and possible solutions of alert "cloud: time since oldest sync" (~#15376~; PRs: ~#15614~) 0.50d
• [x] (🏁 4 days ago) All accounts always have a confirmed primary email address (~#15274~; PRs: ~#15683~) 1.00d
• [x] (🏁 4 days ago) User can set primary email (~#15393~; PRs: ~#15683~) 1.00d
• [x] (🏁 4 days ago) workerutil: Remove repeated Store in names (~#15732~) :shipit:
• [x] (🏁 1 day ago) Be explicit about global code hosts for Cloud (~#14985~; PRs: ~#15748~, ~#15796~) 1.00d 🐛
• [x] (🏁 today) frontend: Reduce number of external services queried (~#15834~) :shipit:
• [x] (🏁 today) monitoring: Remove alert for 'time since last sync' (~#15860~) :shipit:
• [x] (🏁 today) Fix typo in dev script (~#15867~) :shipit:
• [x] (🏁 today) EITHER we require codehost authentication (no built-in auth) OR we need to improve our built-in auth security (~#15275~)

@tsenart

Completed

• [x] (🏁 11 days ago) license_expiration: Check all subscriptions (~#15483~) :shipit:
• [x] (🏁 7 days ago) grafana: Add Gitserver Cloud internal dashboard (~#15589~) :shipit:
• [x] (🏁 6 days ago) graphql: Record queries that trigger getCommit calls (~#15648~) :shipit:
• [x] (🏁 5 days ago) grafana: Add gitserver commands panel (~#15654~) :shipit:
• [x] (🏁 5 days ago) git: Send actual repo.Name to Honeycomb (~#15660~) :shipit:
• [x] (🏁 5 days ago) ~git: Send IP addr and user agent to Honeycomb for debugging~ (~#15661~) :shipit:
• [x] (🏁 4 days ago) ~monitoring: Allow arbitrary number of alerts per Observable~ (~#15716~) :shipit:
• [x] (🏁 4 days ago) monitoring: Allow Observables without alerts (~#15742~) :shipit:
• [x] (🏁 4 days ago) graphqlbackend: Lazy load git commit for each hunk (~#15746~) :shipit:
• [x] (🏁 4 days ago) sourcegraph/deploy-sourcegraph-dot-com (~#3830~) :shipit:
• [x] (🏁 4 days ago) graphqlbackend: Proper lazy loading in GitCommitResolver (~#15752~) :shipit:

@unknwon: 4.50d

Completed: 4.50d

• [x] (🏁 13 days ago) RFC 167: Not allowed to apply license with unknown plan (~#14031~; PRs: ~#15307~)
• [x] (🏁 8 days ago) docs: add auth troubleshooting page (~#14702~; PRs: ~#15429~) 1.00d
• [x] (🏁 7 days ago) RFC 167: Enforce site-admin roles (~#14023~; PRs: ~#15570~) 1.00d
• [x] (🏁 7 days ago) secret: store base64-encoded secret key in the secret file (~#14661~; PRs: ~#15605~) 0.50d 🔒
• [x] (🏁 4 days ago) Pure-SQL authz approach (~#11767~; PRs: ~#15427~, ~#15603~, ~#15604~) 1.50d 🎩🧶
• [x] (🏁 4 days ago) Update CHANGELOG.md (~#15733~) :shipit:
• [x] (🏁 1 day ago) GraphQL API returns invalid repository and tree URLs for repo with spaces in name (not percent-encoded) (~#15667~) 0.50d 👩🐛
• [x] (🏁 today) db: add expired_at and last_valid_at columns to user_external_accounts table (~#15789~) :shipit:

Legend

• 👩 Customer issue
• 🐛 Bug
• 🧶 Technical debt
• 🎩 Quality of life
• 🛠️ Roadmap
• 🕵️ Spike
• 🔒 Security issue
• :shipit: Pull Request

[github-actions[bot]]

Heads up @tsenart - the "team/cloud" label was applied to this issue.

[tsenart]

Writing the plan section tomorrow morning before sending our team's weekly update out.

[ryanslade]

Week ending 6 November

• Pulling tickets out for RFC 255 and RFC 261
• I was off Thursday and Friday

[unknwon]

Last week

• Finalized the approach for pure-SQL authz #11767
• Finished adding auth troubleshooting page to docs #14702

This week

• Roll out core changes of pure-SQL authz
• RFC 167: Enforce site-admin roles #14023
• Write an RFC for end-to-end testing of all our authorization models #15273
• secret: store base64-encoded secret key in the secret file #14661
• authz: clean up rows that have broken auth_data in user_external_accounts #14899

[asdine]

Last week

• Introduced the new repo-updater store and added missing features to internal/db RepoStore and ExternalServiceStore #15317 #15383 #15388 #15440 #15343

This week

• Use new stores everywhere #14710 #14711 #14712
• Disable Gitlab's nameTransformations setting for user-added external services #15529
• Support filtering repos by owner in API #15488
• Add private code feature flag and enforce it #15322
• User can set primary email #15393

[arussellsaw]

Last Week

• Added database versions to ping data (#14405; PR: #15389)
• Fixed sharing links with oauth login flows (#15132; PR: #15439)
• Also some email formatting changes

  This Week

• Another email formatting task (#10411)
• Working on authz webhooks with @flying-robot (#14917)
• Once we decide on an approach, adding analytics for extension usage (see https://sourcegraph.slack.com/archives/CN4FC7XT4/p1604712142172600)

[flying-robot]

Last Week

• Fix relatively-pathed submodule link rendering (#15286; PR: #15441)
• Enforce maximum external service count per tier (#14024; PR: #15172)
• Add a debug endpoint for showing authz providers (#14891; PR: #15119)

This Week

• Work on authz withbooks with @arussellsaw (#14917)
• Work on making password reset link duration configurable with @artemruts (#13999)

[tsenart]

Work on authz withbooks with @arussellsaw (#14917)

Love our internal code names.

[flying-robot]

@tsenart you can't shame me into changing it.

[asdine]

Last week

• Worked on simplifying the repo-updater store and use internal db stores everywhere (#14710; PRs: #15530)
• Added private code feature flag (#15322; PR: #15730)

This week

• Support filtering repos by owner in API #15488
• Research: Simplify access to repository tokens for gitserver (#14910)

[unknwon]

Last week

• Landed core changes of pure-SQL authz.
• Finished all the engineering tasks of RFC 167, waiting for sales/product teams about when to publish (i.e. remove the feature flag).
• Started drafting RFC 266: End-to-end testing of all authorization models.

This week

• For the remaining two days of the current cycle, finish up planned tasks.
• Finished RFC 266: End-to-end testing of all authorization models and get approval.

[flying-robot]

Moving on to https://github.com/sourcegraph/sourcegraph/issues/15753