Require OAuth for search engine checks #52
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Holding this until 14:00 UTC (or slightly later) to wait for comments from Earwig, then will deploy to Toolforge. |
ChlodAlejandro
force-pushed
the
feat/auth
branch
4 times, most recently
from
984943b to
cb72361
Compare
|
Just added a workflow speedup: the query attempted at request time should be run immediately after finishing the auth flow. |
ChlodAlejandro
force-pushed
the
feat/auth
branch
from
cb72361 to
45a6317
Compare
earwig
requested changes
Oct 4, 2024
ChlodAlejandro
force-pushed
the
feat/auth
branch
2 times, most recently
from
e90b4c9 to
3c367f0
Compare
ChlodAlejandro
force-pushed
the
feat/auth
branch
from
3c367f0 to
e267151
Compare
Adds the initial backend requirements for the OAuth flow, which will be made required for all search engine checks. This adds three new routes: - `/login` (GET, POST) - for logging in - `/logout` (GET, POST) - for logging out - `/oauth-callback` - OAuth 1.0a callback route Login/logout state can be checked through the header. By default, a separate page navigation is not required when the link is clicked by the user. When following a link to `/log(in|out)`, however, an extra button will be shown to prevent inadvertent logins/logouts.
Begin requiring OAuth for search engine checks. This adds an extra validation step in checker.py. It occurs after a cached result is checked for, which allows unauthenticated viewers to still preview cached results.
ChlodAlejandro
force-pushed
the
feat/auth
branch
from
e267151 to
10add79
Compare
earwig
approved these changes
Oct 4, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds the initial backend requirements for the OAuth flow and makes authentication required for all uncached search engine checks. This adds three new routes:
/login(GET, POST) - for logging in/logout(GET, POST) - for logging out/oauth-callback- OAuth 1.0a callback route, used by MediaWikiThis requires the following
.earwigbot/config.ymlvalues:wiki.copyvios.oauth.consumer_tokenwiki.copyvios.oauth.consumer_secretThis requires a new file in the root folder (on Toolforge,
~/git/copyvios/) namedconfig.py, to be used by Flask. This has already been added on Toolforge. This should export a single value,SECRET_KEY, which will be used to encrypt session data. An exampleconfig.pyfile can be as follows:This adds
mwoauth==0.3.8as a requirement.0.4.0is not a possible version since it is Python 3.x-only. There doesn't seem to be any significant differences between the two which would be detrimental to the auth flow.Login/logout state can be checked through the page header. By default, a separate page navigation is not required when the link is clicked by the user. When following a link to
/log(in|out), however, an extra button will be shown to prevent inadvertent logins/logouts.Cached data is still shown to unauthenticated users when available.
The commit which enables the requirement is separated to make it easily revertible in case something bad happens during deployment.