BB2-4250: Make v3_endpoints waffle switch app specific #1429
Conversation
…er waffle_flag. Working for read/search v3 calls, v3 auth/token flows (still need to add to some other auth views)
… flag is not enabled for that app
…s in the flag. Add 403 handling for userinfo v3
…Token and Authorization views
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…ier in auth process
jimmyfagan
left a comment
jimmyfagan
left a comment
There was a problem hiding this comment.
This is close to being good to go, but just a little more fine tuning. Hopefully we can just do a quick working session on some of this in the morning.
| path_info = self.request.__dict__.get('path_info') | ||
| version = get_api_version_number_from_url(path_info) | ||
| # If it is not version 3, we don't need to check anything, just return | ||
| if version == Versions.V3 and self.validate_v3_call: |
There was a problem hiding this comment.
I'm questioning the usefulness of the validate_v3_call variable. It seems like it is always true, unless we find that the v3 call wasn't allowed for the app, in which case we set it to false, but at the same time we find it as false, we end up throwing an exception which prevents us from getting to the next step in the auth flow meaning we won't get to this line again anyway. I like the idea, but we might be okay to just always do the check and not try to persist the result. Let's talk about it tomorrow in case I'm missing something.
| # 4250-TODO Do we need this? | ||
| return JsonResponse( | ||
| {'status_code': 500, 'message': 'Error retrieving data'}, | ||
| status=500, | ||
| ) |
There was a problem hiding this comment.
We probably ought to resolve this to-do. Not sure how this case would be hit, but if it is hit, we could maybe just treat this as the application not having v3 enabled.
| # 4250-TODO Do we need this? | ||
| return JsonResponse( | ||
| {'status_code': 500, 'message': 'Error retrieving data'}, | ||
| status=500, | ||
| ) |
| version = get_api_version_number_from_url(path_info) | ||
| # If it is not version 3, we don't need to check anything, just return | ||
| if version == Versions.V3 and self.validate_v3_call: | ||
| self.validate_v3_authorization_request() |
There was a problem hiding this comment.
In testing with a running local server with the flag created but without any apps enabled, I ended up with a generic 500 server error when issuing the authorize request. Seems like maybe in this path we need to add some kind of exception handling?
JIRA Ticket:
BB2-4250
What Does This PR Do?
This PR ensures that once we enable the v3_endpoints waffle switch, we are able to control access to v3 endpoints on an app by app basis.
What Should Reviewers Watch For?
If you're reviewing this PR, please check for these things in particular:
Validation
UPDATE dot_ext_application SET user_id = {{user_id added in django admin to flag}} WHERE id = 1;UPDATE dot_ext_application SET user_id = {{any user_id besides the one added to the flag in django admin}} WHERE id = 1;What Security Implications Does This PR Have?
Please indicate if this PR does any of the following:
security engineer's approval.
Any Migrations?
We are not adding data to the database, but we will have to create a waffle flag as we roll this out. We will then add specific user_ids to that flag to enable v3 endpoint access.
etc)