Dev jwks auth - #31
Conversation
|
This branch still needs two things before it's ready to merge:
Note that switching to this auth scheme and still using TLS will give "untrusted CA" errors unless a) clients add our CA, or b) we obtain a server cert. from SLAC. |
|
This PR is "working" but the CurrentUser-protected routes can't be tested without modifying the test client to inject a user token. Some TODO-s remain for making this branch cleaner:
|
| "--exclusive": "" | ||
|
|
||
| forwarder: | ||
| ip: "134.79.23.42" |
There was a problem hiding this comment.
maybe not good to put real IPs here?
| raise HTTPException(status_code=404, detail="Transfer is not active.") | ||
|
|
||
| if entry.user != user: | ||
| raise HTTPException(status_code=404, detail="Transfer is not active.") |
There was a problem hiding this comment.
i see 404 here to hide this, but maybe we could do "Transfer not found" instead?
| from fastapi_jwks.models.types import JWTHeader | ||
|
|
||
| # FIXME: config. loading for jwks currently uses $VIRTUAL_ENV | ||
| # due to module-level definitions in auth.py |
There was a problem hiding this comment.
do you mean we should avoid creating a global?
| # assert payload.iss == _oidc.issuer_url | ||
|
|
||
| def test_config_aud(): | ||
| """ Parsing the audiences field is apparently difficult for the lclstream-api config. |
| unverified_claims = jwt.decode(my_token, options={"verify_signature": False}) | ||
|
|
||
| #kid = unverified_header.get("kid") | ||
| #alg = unverified_header.get("alg") |
| "lclstream @ git+https://github.com/lclstream/lclstream.git", | ||
| "psik>=3.1.0", | ||
| "pydantic>=2.13.4", | ||
| "pydantic-settings>=2.0", |
There was a problem hiding this comment.
in this PR you are not using pydantic settings ight?
|
|
||
| # --- App (LCLSTREAM_APP_*) ------------------------------------------------- | ||
| # External path prefix the app is mounted under (FastAPI root_path). Must match | ||
| # the gateway's PathPrefix; override per env (e.g. /api/dev). |
There was a problem hiding this comment.
are we using this dotenv yet?
2 participants
Adopts the OIDC portion of branch apiv2-persist-durable.