Implement GitHub OAuth to restrict access #73
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
danlivings-dxw
force-pushed
the
feature/use-auth
branch
from
39340ca to
d915e23
Compare
danlivings-dxw
force-pushed
the
feature/use-github-webhooks
branch
from
e303c55 to
61f8d54
Compare
danlivings-dxw
force-pushed
the
feature/use-auth
branch
from
d915e23 to
e59e3b1
Compare
danlivings-dxw
force-pushed
the
feature/use-github-webhooks
branch
from
61f8d54 to
6f0fd81
Compare
danlivings-dxw
force-pushed
the
feature/use-auth
branch
from
e59e3b1 to
4f8638a
Compare
danlivings-dxw
force-pushed
the
feature/use-github-webhooks
branch
from
6f0fd81 to
0ed3848
Compare
danlivings-dxw
force-pushed
the
feature/use-auth
branch
from
4f8638a to
289a884
Compare
danlivings-dxw
force-pushed
the
feature/use-github-webhooks
branch
from
0ed3848 to
25aeb2a
Compare
danlivings-dxw
force-pushed
the
feature/use-auth
branch
from
289a884 to
90bb4a6
Compare
|
Apologies, I've had trouble finishing this review today, but I thought I'd offer one thing. Suggestion: I'd highly recommend using Express rather than writing your own routing implementation here. |
shuldt
reviewed
Oct 31, 2024
routes/handlers.js
Outdated
There was a problem hiding this comment.
Do we want testing for the logout flow also?
danlivings-dxw
force-pushed
the
feature/use-github-webhooks
branch
from
5627127 to
ceaaed0
Compare
danlivings-dxw
force-pushed
the
feature/use-auth
branch
3 times, most recently
from
88b8466 to
daaab62
Compare
danlivings-dxw
force-pushed
the
feature/use-auth
branch
2 times, most recently
from
48f80e8 to
91d2391
Compare
This defines the `REDIRECT_URL_BASE` environment variable which can be used to configure which callback URL Towtruck provides when using the OAuth authentication flow. Octokit already provides as part of its middleware the ability to authenticate as a GitHub user, so Towtruck just needs to be able to hook into this process.
danlivings-dxw
force-pushed
the
feature/use-auth
branch
from
91d2391 to
87ce203
Compare
Towtruck should expose a login page rather than immediately redirecting to the GitHub auth page, both to avoid surprising the user and also to provide a landing area if more login methods are supported in the future. To make sure that this login page looks the same as the index page, `index.njk` has been split: - `base.njk` contains the `<head>` and outer body to the `.container` - `index.njk` contains the content found inside the `.container` A `login.njk` page has also been introduced that provides a link to the GitHub login webhook.
User tokens are stored as a cookie. If no valid token is presented, the user is shown the login page, which allows them to authorise Towtruck to access their account. This then redirects to the Towtruck callback URL, which generates the token and instructs the browser to store it before redirecting to the index page.
This allows basic path parameter recognition in the form of
`/path/{with}/{parameters}` as well as verbatim paths.
This will allow for things such as redirecting to a dedicated login
route, or presenting dashboards for specific organisations.
This now saves repository-scoped data with the `name` being of the format `org/reponame`. This allows for a method like `getAllRepositoriesForOrg`, which provides two benefits: 1. Towtruck can provide per-organisation dashboards. 2. Towtruck can restrict access to organisations for which the logged in user should not have access.
The root path `/` now displays a list of organisations using Towtruck
that the user is a member of. Items in the list link to
organisation-specific dashboards available at `/{org}`. Users that
aren't members of an organisation will be redirected back to the root
path, preventing the unauthorised access to information about private
repositories.
A link in the header is provided to logged in users. The `/logout` endpoint instructs the browser to delete the Token cookie and redirects the user to the root page.
danlivings-dxw
force-pushed
the
feature/use-auth
branch
3 times, most recently
from
1309d80 to
d54cecc
Compare
The `GH_TOKEN` environment variable can be used both locally and in CI to avoid testing the GitHub OAuth flow (which is provided by the Octokit library and can therefore be assumed to be well tested). In local development the token can be retrieved by logging into Towtruck and then copying the value of the `Token` cookie. In CI, the correct value is automatically populated by GitHub Actions into a secret.
danlivings-dxw
force-pushed
the
feature/use-auth
branch
from
d54cecc to
0e7a69c
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR implements the GitHub OAuth authentication mechanism to allow Towtruck to identify who is using the app. This provides two main benefits:
Together, these prevent the potential leaking of information about private repositories to unauthorised users of the Towtruck application.
When using the Towtruck application for the first time, a user will be prompted to login using GitHub:
This will redirect to the GitHub App authorisation page:
Upon granting access to Towtruck, the user is redirected to the organisation index (the root path
/):Each organisation's name is a link to the organisation-specific dashboard, which is now available at the
/{org}path. Attempting to access an organisation for which the user is not a member will redirect to the index.Additionally, a "Logout" link is provided in the header, and the application title is now also a link to the index page.