Do not validate bitbucket server token scopes #706
Conversation
|
/retest |
|
From my understanding, if we won't validate scopes, then user might occur issue while using token with git operations. |
We generate Oauth tokens with predefined list of scopes: so there is no way user can have an Oauth token with another scopes. As for PATs, we do not validate scopes for BitBucket Server at all. |
|
Verified on Eclipse Che with |
| // Token is added manually by a user without token id. Validate only by requesting user info. | ||
| if (isNullOrEmpty(params.getScmTokenId())) { | ||
| BitbucketUser user = bitbucketServerApiClient.getUser(params.getToken()); | ||
| return Optional.of(Pair.of(Boolean.TRUE, user.getName())); | ||
| } | ||
| // Token is added by OAuth. Token id is available. | ||
| BitbucketPersonalAccessToken bitbucketPersonalAccessToken = | ||
| bitbucketServerApiClient.getPersonalAccessToken( | ||
| params.getScmTokenId(), params.getToken()); | ||
| return Optional.of( | ||
| Pair.of( | ||
| DEFAULT_TOKEN_SCOPE.equals(bitbucketPersonalAccessToken.getPermissions()) | ||
| ? Boolean.TRUE | ||
| : Boolean.FALSE, | ||
| bitbucketPersonalAccessToken.getUser().getName())); |
There was a problem hiding this comment.
@vinokurig could BitBucket OAuth be affected by this change? why scope validation was in place before?
There was a problem hiding this comment.
could BitBucket OAuth be affected by this change?
I do not think so because the commit just simplifies the check, it does not add new requests or stuff like that.
why scope validation was in place before?
I believe this was copied from the GitHub token fetcher:
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: artaleks9, ibuziuk, vinokurig The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Build 3.16 :: server_3.x/351: Console, Changes, Git Data |
|
Build 3.16 :: server_3.x/352: Console, Changes, Git Data |
|
Build 3.16 :: sync-to-downstream_3.x/7327: Console, Changes, Git Data |
|
Build 3.16 :: sync-to-downstream_3.x/7328: Console, Changes, Git Data |
|
Build 3.16 :: push-latest-container-to-quay_3.x/4804: Console, Changes, Git Data |
|
Build 3.16 :: push-latest-container-to-quay_3.x/4805: Console, Changes, Git Data |
|
Build 3.16 :: get-sources-rhpkg-container-build_3.x/7311: server : 3.x :: Build 62945526 : quay.io/devspaces/server-rhel8:3.16-10 |
|
Build 3.16 :: server_3.x/351: Upstream sync done; /DS_CI/sync-to-downstream_3.x/7327 triggered |
|
Build 3.16 :: get-sources-rhpkg-container-build_3.x/7312: server : 3.x :: Build 62945529 : quay.io/devspaces/server-rhel8:3.16-11 |
|
Build 3.16 :: update-digests_3.x/7172: Console, Changes, Git Data |
|
Build 3.16 :: server_3.x/352: Upstream sync done; /DS_CI/sync-to-downstream_3.x/7328 triggered |
|
Build 3.16 :: operator-bundle_3.x/3365: Console, Changes, Git Data |
|
Build 3.16 :: sync-to-downstream_3.x/7331: Console, Changes, Git Data |
|
Build 3.16 :: push-latest-container-to-quay_3.x/4808: Console, Changes, Git Data |
|
Build 3.16 :: copyIIBsToQuay/2724: Console, Changes, Git Data |
|
Build 3.16 :: sync-to-downstream_3.x/7331: Build container: devspaces-operator-bundle synced; /DS_CI/get-sources-rhpkg-container-build_3.x/7315 triggered; /job/DS_CI/job/dsc_3.x triggered; |
|
Build 3.16 :: operator-bundle_3.x/3365: Upstream sync done; /DS_CI/sync-to-downstream_3.x/7331 triggered |
|
Build 3.16 :: dsc_3.x/1962: Console, Changes, Git Data |
|
Build 3.16 :: update-digests_3.x/7172: Detected new images: rebuild operator-bundle |
|
Build 3.16 :: update-digests_3.x/7173: Console, Changes, Git Data |
|
Build 3.16 :: update-digests_3.x/7173: No new images detected: nothing to do! |
|
Build 3.16 :: dsc_3.x/1962: 3.16.0-CI |
|
Build 3.16 :: copyIIBsToQuay/2724: 3.16 |
What does this PR do?
BitBucket Server
get token()API method does not work with PAT token. It returns unauthorised exception. Omit the BitBucket Server token skopes check because there is not other way to get the token scopes.Screenshot/screencast of this PR
What issues does this PR fix or reference?
https://issues.redhat.com/browse/CRW-4560
How to test this PR?
See workspace starts successfully, a new Personal Access Token item is created in the dashboard user preferences page.
PR Checklist
As the author of this Pull Request I made sure that:
What issues does this PR fix or referenceandHow to test this PRcompletedReviewers
Reviewers, please comment how you tested the PR when approving it.