[3/n] `/v1/me/access-tokens` list and delete #8227

david-crespo · 2025-05-27T22:27:49Z

Built on top of #8137 and #8214.

This is only for a user to list and delete their own tokens. It doesn't quite match RFD 570, which says /v1/device-tokens instead of /v1/me/access-tokens, but it feels good under /v1/me, and after trying to make the UI too, I think "access tokens" is much more intuitive. If I stick with this, I will update RFD 570 to match.

I'm not sure about the path /v1/device-tokens — in the API we call them Device Access Tokens. I think /v1/access-tokens might be more intuitive because the device is sort of an implementation detail, it refers to the OAuth device auth flow, which we are using. In practice, the user just gets a token with the CLI and pastes a code into the web UI and they don't have to think too much about it, so exposing that detail in the name might not be worth it. Went with /v1/me/access-tokens.

Basic token list and delete
Basic integration tests
Finalize endpoint paths
Figure out authz story
- Went with restricting datastore functions to current actor for now

david-crespo · 2025-05-27T22:30:37Z

nexus/db-queries/src/db/datastore/device_auth.rs

+        }
+
+        Ok(())
+    }


This is a hard delete — might want to put that in the name, since it's unusual. We do that in the session delete method. If we wanted a soft delete, we could set time_expires to now instead. That feels kind of bad to me, but so does hard delete.

I think the hard delete is fine, setting time_expires feels kind of worse especially with regards to errors when that token is used. Adding hard_delete to the name is fine with me, if you think that's important.

david-crespo · 2025-05-29T22:31:43Z

nexus/db-queries/src/db/datastore/device_auth.rs

+    // typical authz check, instead effectively encoding the policy here that
+    // any user is allowed to list and delete their own tokens. When we add the
+    // ability for silo admins to list and delete tokens from any user, we will
+    // have to model these permissions properly in the polar policy.


This is important. We hack around the harder authz problem of modeling token properly by restricting these functions to the current actor (for now).

Closes #8139. Token IDs are used in #8227 and #8231 for token CRUD. WIP. Everything compiles and existing tests work, but we are not yet testing retrieval by ID and we need to think about authz checks on the datastore functions for retrieving tokens and sessions by token string. This PR would be a lot shorter if not for the fact that the `token` column was the primary key on both tables, so adding the `id` requires a bunch of migration steps to change the primary key. There were also a lot of changes to code and tests around making things ID-centric instead of token-centric. * [x] SQL migrations for adding `id` col and changing primary key to that * [x] Add `TypedUuid` to session and token DB models * [x] Update `authz_resource!` and `lookup_resource!` calls for new primary key * [x] Update `Session` trait methods to use `id` instead of `token` * [x] Update app and datastore session and token methods to use ID instead of token * [x] Update two distinct but nearly identical `FakeSession` implementations (one for unit tests, one for integration tests) to a) track sessions in a `Vec` instead of a `HashMap` with token keys * [x] Figure out authz situation in new fetch session/token by token string methods

hawkw

this one is pretty straightforwards, no big concerns from me!

hawkw · 2025-06-03T20:14:34Z

nexus/external-api/output/nexus_tags.txt

+current_user_access_token_delete         DELETE   /v1/me/access-tokens/{token_id}
+current_user_access_token_list           GET      /v1/me/access-tokens


I think I'm in favor of putting this under /v1/me, personally!

hawkw · 2025-06-03T20:17:59Z

nexus/db-queries/src/db/datastore/device_auth.rs

+        }
+
+        Ok(())
+    }


I think the hard delete is fine, setting time_expires feels kind of worse especially with regards to errors when that token is used. Adding hard_delete to the name is fine with me, if you think that's important.

Closes #8147. Built on #8137, #8214, and #8227. This is pretty straightforward, I think. The user gives us a TTL in seconds at token request time. We store it on the request row. When they come back in the later step to confirm the code and generate the token, we retrieve the TTL, validate that it is less than the silo max (if one is set), and we use it to generate the `time_expires` timestamp, which cannot be changed later. One slightly surprising bit is that we can't validate the TTL against the silo max at initial request time because we don't have any idea what silo the user is associated with until the confirm step. So probably want to make sure we are handling TTL validation errors nicely in the web console, because I think that's where they will show up.

david-crespo commented May 27, 2025

View reviewed changes

This was referenced May 28, 2025

[4/n] Let user request a specific TTL for a token #8231

Merged

[1/n] Add id column on tokens and sessions #8137

Merged

david-crespo force-pushed the device-tokens-api branch from 0cd9b5a to 214811b Compare May 29, 2025 22:25

david-crespo commented May 29, 2025

View reviewed changes

david-crespo changed the title ~~[3/n] /v1/me/tokens list and delete~~ [3/n] /v1/me/device-tokens list and delete May 29, 2025

david-crespo marked this pull request as ready for review May 29, 2025 22:34

david-crespo force-pushed the device-tokens-api branch 2 times, most recently from f18022c to 6811931 Compare May 30, 2025 15:48

david-crespo force-pushed the silo-token-settings branch from f68b227 to 3c36e26 Compare May 30, 2025 16:56

david-crespo force-pushed the device-tokens-api branch from 6811931 to 1467bfd Compare May 30, 2025 16:56

david-crespo force-pushed the silo-token-settings branch from 3c36e26 to 26d25ab Compare May 31, 2025 00:00

david-crespo force-pushed the device-tokens-api branch from 1467bfd to 3e15398 Compare May 31, 2025 00:00

david-crespo mentioned this pull request May 31, 2025

[2/n] Silo-level max device token TTL #8214

Merged

7 tasks

david-crespo force-pushed the device-tokens-api branch 3 times, most recently from 66254ea to 9e014d0 Compare June 2, 2025 21:34

david-crespo force-pushed the silo-token-settings branch 2 times, most recently from d2fc15e to 14c544c Compare June 3, 2025 00:01

david-crespo force-pushed the device-tokens-api branch from 9e014d0 to 6772411 Compare June 3, 2025 00:01

david-crespo changed the title ~~[3/n] /v1/me/device-tokens list and delete~~ [3/n] /v1/me/access-tokens list and delete Jun 3, 2025

david-crespo force-pushed the device-tokens-api branch from 6772411 to 7fa6757 Compare June 3, 2025 02:36

david-crespo requested a review from hawkw June 3, 2025 17:11

david-crespo force-pushed the device-tokens-api branch from 7fa6757 to fd19e2d Compare June 3, 2025 17:19

david-crespo force-pushed the silo-token-settings branch from 14c544c to 4dd9321 Compare June 3, 2025 17:19

hawkw approved these changes Jun 3, 2025

View reviewed changes

david-crespo force-pushed the device-tokens-api branch from fd19e2d to ab6ec2b Compare June 3, 2025 21:18

Base automatically changed from silo-token-settings to main June 4, 2025 01:34

let's try GET /v1/me/tokens

dc6ec38

david-crespo added 6 commits June 3, 2025 20:35

DELETE /v1/me/tokens/{token_id}

938c077

fix the unauthorized test

a680b64

/me/tokens -> /me/device-tokens

8dd613a

remove TODO comment

474d82f

implicit authz on token list and delete by using current actor ID

9ace306

/me/device-tokens -> /me/access-tokens

bbcc90d

david-crespo force-pushed the device-tokens-api branch from ab6ec2b to bbcc90d Compare June 4, 2025 01:36

david-crespo enabled auto-merge (squash) June 4, 2025 01:38

david-crespo merged commit a8aeac6 into main Jun 4, 2025
17 checks passed

david-crespo deleted the device-tokens-api branch June 4, 2025 04:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[3/n] `/v1/me/access-tokens` list and delete #8227

[3/n] `/v1/me/access-tokens` list and delete #8227

Uh oh!

david-crespo commented May 27, 2025 •

edited

Loading

Uh oh!

david-crespo May 27, 2025 •

edited

Loading

Uh oh!

hawkw Jun 3, 2025

Uh oh!

david-crespo May 29, 2025

Uh oh!

hawkw left a comment

Uh oh!

hawkw Jun 3, 2025

Uh oh!

hawkw Jun 3, 2025

Uh oh!

Uh oh!

Uh oh!

+                      }
+                      Ok(())
+                  }

		current_user_access_token_delete DELETE /v1/me/access-tokens/{token_id}
		current_user_access_token_list GET /v1/me/access-tokens

[3/n] /v1/me/access-tokens list and delete #8227

[3/n] /v1/me/access-tokens list and delete #8227

Uh oh!

Conversation

david-crespo commented May 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

david-crespo May 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hawkw Jun 3, 2025

Choose a reason for hiding this comment

Uh oh!

david-crespo May 29, 2025

Choose a reason for hiding this comment

Uh oh!

hawkw left a comment

Choose a reason for hiding this comment

Uh oh!

hawkw Jun 3, 2025

Choose a reason for hiding this comment

Uh oh!

hawkw Jun 3, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

[3/n] `/v1/me/access-tokens` list and delete #8227

[3/n] `/v1/me/access-tokens` list and delete #8227

david-crespo commented May 27, 2025 •

edited

Loading

david-crespo May 27, 2025 •

edited

Loading