Repository navigation
Upstream/10 26 updates - #8
Merged
Merged
Conversation
…aud (uc-cdis#1356) * validate audience = 'gen3' * fix client_id in audience * generate access token with additional aud * add custom exp * update authutils * force adding TES aud to token from API key * fix * query param instead of body * fix for old API keys and tokens * do not force add work_order param * comment * clean up * fix revoke invalid token logic * client can revoke access token * add token revocation and check status endpoints * update swagger doc * update comments * simplify /token/blacklisted endpoint * add log * fix unit tests * unit tests * more expiration checks * add authz check * fix test * latest commit of authutils branch * fix to accept gen3-workflow s3 endpoint auth header * handle blacklisted expired token * fix typo * remove custom revoke endpoint, no regular token revocation, remove scopes from aud * validate_jwt does not check if regular token is blacklisted * authz check * revert 400 to 200 for genwf s3 endpoint use case * rename work order token => task token * update openapi doc * fix getting auth mapping * fix: task token can only be used for the specific task * clean up * Add Caching of Blakclisted tokens, other small improvements. * Update task_tokens.md * Remove accidental commit of release notes.md * Update secrets baseline * Respond to PR comments. * Update `can_user_get_task_token` implementation based on the PR comments. * Clarifying comments and revert `/cdis/access_token` * Respond to PR comments * Add FIFO cache and bring back `EXP_ERR_TOLERANCE` * Prevent audeince mismatch error. * Update `is_task_token` functionality to be based on `claims["context"]["task_token_type"]` * Include api key in test_revoke tests. Rename blacklist to denylist wherever needed. * Replace `aud="gen3"` with a constant ; separate larger unit tests * Provide only default scopes for task token * Add "user" scope to task token * Update config to have Default Task token scopes * Update pyproject and poetry to pin authutils to >=8.0.0 --------- Co-authored-by: Sai Shanmukha <nss10@outlook.com> (cherry picked from commit 92f0679)
(cherry picked from commit 3d7e52a)
* update refresh token exp setup * add new tests (cherry picked from commit 40758b0)
get_updated_token() was updating _encoded_token with a freshly-signed JWT but leaving session_token (the decoded dict) stale. get_expiration_time() reads session_token["exp"] to set the cookie Expires attribute, so the browser received a cookie that expired at the previous token's exp while the JWT value inside it was valid until a later time. Under normal use the drift grew with each renewal until the browser discarded the cookie early. Fix: decode the new token back into self.session_token immediately after signing so get_expiration_time() always reads the current exp. Also adds a regression test asserting cookie Expires == JWT exp after renewal. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> (cherry picked from commit 5d63fbb)
(cherry picked from commit feb7bb3)
…token renewel in a valid session (cherry picked from commit 1703bde)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.