Repository navigation
feat(audit): API-key sign-in for the audit web UI (#915) - #916
Merged
Merged
Conversation
Add a development-only /audit/login/key path so holders of audit API keys (e.g. dev-environment students given a scoped key) can use the trace viewer in the browser, keeping campus.audit self-contained and user-blind — the key's owner_id is a display label, never resolved. - GET/POST paste-key form, CSRF-protected with a single-use token; the key is verified in-process via resources.apikeys.verify(). - Only keys whose scopes cover traces:read (wildcard-aware) may sign in; the session stores key id + owner label + expiry only (12h, capped by the key's expires_at), never the plaintext key. - Every gated request re-resolves the key record: revocation, expiry, and scope changes end access mid-session. - API-key and OAuth sessions are mutually exclusive; key logout clears the local session only (the key stays valid for API use). - Both route methods 404 unless ENV=development; the login page shows the second button only in development. - Docs: web-ui-requirements.md gains §5.3. CLI counterpart for minting/managing keys: nyjc-computing/campus-cli#54
hmac.compare_digest() raises TypeError when either argument contains non-ASCII characters, and the submitted token on /audit/login/key is raw form data. A POST with a non-ASCII csrf_token therefore crashed the view with a 500 instead of the intended 400. Encode both sides to UTF-8 before comparing, and cover the case with a regression test.
This was referenced Oct 20, 2026
This was referenced Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #915
Summary
Adds a development-only "Sign in with API key" path to the audit
web UI, so holders of audit API keys (e.g. dev-environment students
given a minted key) can use the trace viewer in the browser without
being on the
AUDIT_ADMINSallowlist. campus.audit staysself-contained and user-blind: no campus.auth dependency, and the
key's
owner_idis a display label, never resolved against any userstore.
Behavior
GET/POST /audit/login/key— CSRF-protected paste form. The key isverified in-process via
resources.apikeys.verify()(the samecheck
/audit/v1uses; rejects revoked/expired keys, bumpslast_used). Unknown/revoked/expired keys all get one generic 401(no existence leak); keys lacking
traces:read(wildcard-aware:traces:*/*qualify) get 403.never the plaintext key (cookie sessions are signed, not encrypted).
TTL is 12h, capped by the key's own
expires_at.revocation, expiry, and scope changes end access on the next
request, mid-session.
wins). Logout for a key session clears the local session only — the
key stays valid for API/CLI use.
ENV=development; the login page shows the second button only indevelopment. Dev DBs are per-deployment, so minted keys don't exist
elsewhere.
AUDIT_ADMINS) is unchanged.Docs
campus/audit/docs/web-ui-requirements.mdgains §5.3 (API-keysign-in).
Testing
tests/unit/audit/test_web_apikey_auth.py(15 tests): route404s outside development, CSRF enforcement, login accept/reject
paths, wildcard scopes, session-ttl cap, plaintext-never-stored,
mid-session revocation/scope-downgrade/expiry, mutual exclusivity
via the real callback flow, local-only logout.
ruff check .clean, pyright clean on changed files.
Related
feat(cli):
campus auditcommand group — API-key auth, key management, trace queries campus-cli#54