Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

hackweek: wip id token exchange support #76454

Open
wants to merge 5 commits into
base: hackweek/gha-oidc
Choose a base branch
from
Open

hackweek: wip id token exchange support #76454

wants to merge 5 commits into from

Conversation

mdtro
Copy link
Member

@mdtro mdtro commented Aug 21, 2024 •
edited
Loading

Initial support for exchanging an ID token minted by GitHub Actions for an Org Auth Token.

TODO:

  • Verify claims on ID token

@mdtro mdtro requested a review from a team as a code owner August 21, 2024 15:55
@github-actions github-actions bot added the Scope: Backend Automatically applied to PRs that change backend components label Aug 21, 2024
@codecov Codecov
Copy link

codecov bot commented Aug 21, 2024 •
edited
Loading

❌ 24 Tests Failed:

Tests completed Failed Passed Skipped
21654 24 21630 202
View the top 3 failed tests by shortest run time 
tests.sentry.web.frontend.test_oauth_token.OAuthTokenTest test_missing_grant_type
Stack Traces | 0.424s run time 
#x1B[1m#x1B[.../web/frontend/test_oauth_token.py#x1B[0m:29: in test_missing_grant_type
    resp = self.client.post(self.path, {"client_id": "abcd", "client_secret": "abcd"})
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:1070: in post
    response = super().post(
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:490: in post
    return self.generic(
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:617: in generic
    return self.request(**r)
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:1013: in request
    self.check_exception(response)
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:743: in check_exception
    raise exc_value
#x1B[1m#x1B[31m.venv/lib/python3.11.../core/handlers/exception.py#x1B[0m:55: in inner
    response = get_response(request)
#x1B[1m#x1B[31m.venv/lib/python3.11.../core/handlers/base.py#x1B[0m:197: in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/generic/base.py#x1B[0m:104: in view
    return self.dispatch(request, *args, **kwargs)
#x1B[1m#x1B[.../sentry/silo/base.py#x1B[0m:148: in override
    return original_method(*args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/decorators/csrf.py#x1B[0m:65: in _view_wrapper
    return view_func(request, *args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/utils/decorators.py#x1B[0m:48: in _wrapper
    return bound_method(*args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/decorators/cache.py#x1B[0m:80: in _view_wrapper
    response = view_func(request, *args, **kwargs)
#x1B[1m#x1B[.../web/frontend/oauth_token.py#x1B[0m:33: in dispatch
    return super().dispatch(request, *args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/generic/base.py#x1B[0m:143: in dispatch
    return handler(request, *args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/utils/decorators.py#x1B[0m:48: in _wrapper
    return bound_method(*args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/decorators/cache.py#x1B[0m:80: in _view_wrapper
    response = view_func(request, *args, **kwargs)
#x1B[1m#x1B[.../web/frontend/oauth_token.py#x1B[0m:222: in post
    logger.error(f"-----------------REQUEST BODY------------: {request.body}")
#x1B[1m#x1B[31mE   BytesWarning: str() on a bytes instance#x1B[0m

tests.sentry.web.frontend.test_oauth_token.OAuthTokenCodeTest test_invalid_redirect_uri
Stack Traces | 0.445s run time 
#x1B[1m#x1B[.../web/frontend/test_oauth_token.py#x1B[0m:209: in test_invalid_redirect_uri
    resp = self.client.post(
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:1070: in post
    response = super().post(
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:490: in post
    return self.generic(
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:617: in generic
    return self.request(**r)
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:1013: in request
    self.check_exception(response)
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:743: in check_exception
    raise exc_value
#x1B[1m#x1B[31m.venv/lib/python3.11.../core/handlers/exception.py#x1B[0m:55: in inner
    response = get_response(request)
#x1B[1m#x1B[31m.venv/lib/python3.11.../core/handlers/base.py#x1B[0m:197: in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/generic/base.py#x1B[0m:104: in view
    return self.dispatch(request, *args, **kwargs)
#x1B[1m#x1B[.../sentry/silo/base.py#x1B[0m:148: in override
    return original_method(*args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/decorators/csrf.py#x1B[0m:65: in _view_wrapper
    return view_func(request, *args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/utils/decorators.py#x1B[0m:48: in _wrapper
    return bound_method(*args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/decorators/cache.py#x1B[0m:80: in _view_wrapper
    response = view_func(request, *args, **kwargs)
#x1B[1m#x1B[.../web/frontend/oauth_token.py#x1B[0m:33: in dispatch
    return super().dispatch(request, *args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/generic/base.py#x1B[0m:143: in dispatch
    return handler(request, *args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/utils/decorators.py#x1B[0m:48: in _wrapper
    return bound_method(*args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/decorators/cache.py#x1B[0m:80: in _view_wrapper
    response = view_func(request, *args, **kwargs)
#x1B[1m#x1B[.../web/frontend/oauth_token.py#x1B[0m:222: in post
    logger.error(f"-----------------REQUEST BODY------------: {request.body}")
#x1B[1m#x1B[31mE   BytesWarning: str() on a bytes instance#x1B[0m

tests.sentry.web.frontend.test_oauth_token.OAuthTokenCodeTest test_no_open_id_token
Stack Traces | 0.445s run time 
#x1B[1m#x1B[.../web/frontend/test_oauth_token.py#x1B[0m:228: in test_no_open_id_token
    resp = self.client.post(
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:1070: in post
    response = super().post(
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:490: in post
    return self.generic(
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:617: in generic
    return self.request(**r)
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:1013: in request
    self.check_exception(response)
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/test/client.py#x1B[0m:743: in check_exception
    raise exc_value
#x1B[1m#x1B[31m.venv/lib/python3.11.../core/handlers/exception.py#x1B[0m:55: in inner
    response = get_response(request)
#x1B[1m#x1B[31m.venv/lib/python3.11.../core/handlers/base.py#x1B[0m:197: in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/generic/base.py#x1B[0m:104: in view
    return self.dispatch(request, *args, **kwargs)
#x1B[1m#x1B[.../sentry/silo/base.py#x1B[0m:148: in override
    return original_method(*args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/decorators/csrf.py#x1B[0m:65: in _view_wrapper
    return view_func(request, *args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/utils/decorators.py#x1B[0m:48: in _wrapper
    return bound_method(*args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/decorators/cache.py#x1B[0m:80: in _view_wrapper
    response = view_func(request, *args, **kwargs)
#x1B[1m#x1B[.../web/frontend/oauth_token.py#x1B[0m:33: in dispatch
    return super().dispatch(request, *args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/generic/base.py#x1B[0m:143: in dispatch
    return handler(request, *args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../django/utils/decorators.py#x1B[0m:48: in _wrapper
    return bound_method(*args, **kwargs)
#x1B[1m#x1B[31m.venv/lib/python3.11.../views/decorators/cache.py#x1B[0m:80: in _view_wrapper
    response = view_func(request, *args, **kwargs)
#x1B[1m#x1B[.../web/frontend/oauth_token.py#x1B[0m:222: in post
    logger.error(f"-----------------REQUEST BODY------------: {request.body}")
#x1B[1m#x1B[31mE   BytesWarning: str() on a bytes instance#x1B[0m

To view individual test run time comparison to the main branch, go to the Test Analytics Dashboard

@mdtro mdtro changed the title wip: id token exchange support hackweek: wip id token exchange support Aug 21, 2024
@mdtro mdtro requested review from a team as code owners August 22, 2024 18:17
@armenzg armenzg removed the request for review from a team August 28, 2024 18:39
@getsantry
Copy link
Contributor

getsantry bot commented Sep 19, 2024

This pull request has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you add the label WIP, I will leave it alone unless WIP is removed ... forever!

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

@getsantry getsantry bot added Stale and removed Stale labels Sep 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
Scope: Backend Automatically applied to PRs that change backend components
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@mdtro