threefoldtecharchive / jumpscaleX_threebot

Apache License 2.0
0 stars 3 forks source link

adding a wallet in farm management gives error #673

Closed gmachtel closed 4 years ago

gmachtel commented 4 years ago

3bot correctly signed in, is the same as the farm owner

image

grimpy commented 4 years ago

This is the kind of error you would get if you try to manage a farm that you are not the owner of... Are you sure your identity was setup correctly for this 'network'?

gmachtel commented 4 years ago

Reproduced, now giving this error when I try to add TFTA to my farm as a valid address. I manage a farm that is my own.

image

zaibon commented 4 years ago

This is the kind of error you would get if you try to manage a farm that you are not the owner of... Are you sure your identity was setup correctly for this 'network'?

You only see the farm you are owner of in the farm management page. So my guess is the threebot id use to get all the farm is indeed correct. But the key pair used to sign the update request is not the correct one. Thus the signature verification error.

To send an update the frontend actually calls an actor : https://github.com/threefoldtech/jumpscaleX_threebot/blob/d3c0ebe32fb2d67626597c3470200994c56cb7e9/ThreeBotPackages/threebot/farmmanagement/actors/farm_management.py#L9-L11

the actor just calls the explorer client: https://github.com/threefoldtech/jumpscaleX_libs/blob/85cd513d820053b635750bbe8128c1511103cb08/JumpscaleLibs/clients/explorer/farms.py#L48-L55

When no identities is passed to the update method j.myidentities.me is used by default. Is this the right way to do ? Or is the admin panel relies on another identity ? @grimpy

zaibon commented 4 years ago

Looking a bit more at the code... When the farm management page loads it does a call to "/auth/authenticated" which answer something like:

{"username": "zaibon.3bot", "email": "christophe@threefold.tech", "devmode": false}

Then a call is done to the explorer (https://explorer.grid.tf/explorer/users?name=zaibon.3bot) to find the matching user in the phonebook using the username return by the previous call. This allow to know the threebot ID of the user.

Using this threebot ID a call on the explorer is done to list all of the farm owned by this user (https://explorer.grid.tf/explorer/farms?owner=152)

At this point all the farms and nodes are shown.

So if we take this in account and my previous comment. When we do the call to update the farms, nothing actually make sure that j.myidentities.me actually is pointing to the same matching user then /auth/authenticated

zaibon commented 4 years ago

Probably one way to solve this is instead of getting the current user from /auth/authenticated which return the info from the 3bot connect app, get it from another endpoint that serve the actual identity currently in use by jumpscale which contains, username and threebot ID directly. Since this identity is supposed to have been created on the explorer it should always use the proper keypair for signature and avoid these kind of weird error.

grimpy commented 4 years ago

This is the kind of error you would get if you try to manage a farm that you are not the owner of... Are you sure your identity was setup correctly for this 'network'?

You only see the farm you are owner of in the farm management page. So my guess is the threebot id use to get all the farm is indeed correct. But the key pair used to sign the update request is not the correct one. Thus the signature verification error.

To send an update the frontend actually calls an actor :

https://github.com/threefoldtech/jumpscaleX_threebot/blob/d3c0ebe32fb2d67626597c3470200994c56cb7e9/ThreeBotPackages/threebot/farmmanagement/actors/farm_management.py#L9-L11

the actor just calls the explorer client: https://github.com/threefoldtech/jumpscaleX_libs/blob/85cd513d820053b635750bbe8128c1511103cb08/JumpscaleLibs/clients/explorer/farms.py#L48-L55

When no identities is passed to the update method j.myidentities.me is used by default. Is this the right way to do ? Or is the admin panel relies on another identity ? @grimpy

In the chatflows we opted for always using j.me, you can not rely on the user you are logged in with as you can not sign requests on behave of this use (you don't have his private key)

So most likely the problem here happened when identityies where switched in such a case j.myidentities.me might still point to an old identity while j.me would not

zaibon commented 4 years ago

So I guess just passing j.me to the identity parameter of all the method of the farm management actor would also solve it. But I think loading the threebotID from j.me should also be done so we avoid any future confusion.

AhmedSa-mir commented 4 years ago

commits: https://github.com/threefoldtech/jumpscaleX_libs/commit/b14f71c6d6ec2fac6f4c63472e3734ab47201400 https://github.com/threefoldtech/jumpscaleX_libs/commit/ee5129937dd7280a7037753984e383f64ca6e113 https://github.com/threefoldtech/jumpscaleX_threebot/commit/4cbcd721c272b562def786921c363197480ee262

zaibon commented 4 years ago

@AhmedHanafy725 there are other places that needs to be update to replace j.myidentities.me to j.me.

Can you please open a PR about this instead of just pushing code without review and then dumping commit link here. That would avoid finding this kind of problem after the code is already merged. thanks

Dina-Abd-Elrahman commented 4 years ago