Page MenuHomePhabricator

[keyserver] Handle invalid CSAT for Identity RPCs
ClosedPublic

Authored by bartek on Nov 24 2024, 11:33 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Jan 8, 10:37 AM
Unknown Object (File)
Wed, Jan 8, 10:37 AM
Unknown Object (File)
Tue, Jan 7, 12:27 AM
Unknown Object (File)
Mon, Jan 6, 4:53 PM
Unknown Object (File)
Thu, Dec 19, 6:13 AM
Unknown Object (File)
Wed, Dec 18, 4:15 PM
Unknown Object (File)
Mon, Dec 16, 11:32 AM
Unknown Object (File)
Sun, Dec 15, 7:39 AM
Subscribers

Details

Summary

Address ENG-6544
Similiar to D13992 but for keyserver

Only authenticated RPC calls are wrapped (from auth.proto). Unauth RPC calls are left unchanged

Depends on D13992, D14028

Test Plan

Malformed token stored in the metadata table. When an auth RPC was called, the value was cleared. Subsequent service calls caused new login attempt and recreated the metadata values

Diff Detail

Repository
rCOMM Comm
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

bartek held this revision as a draft.
bartek published this revision for review.Nov 25 2024, 2:07 AM

Worth adding to the Summary or Test Plan that this includes all RPC (all usages of getRustAPI) other than unath RPCs.

Ideally, I would see this improved and have this typed like IdentityServiceClient, and to be lazy initialized when we e.g. call getRustAPI only once, I think those stateless functions are hard to maintain, but this is not feedback to this diff, we can create a follow-up task to consider this if you agree.

keyserver/src/utils/identity-utils.js
22–24 ↗(On Diff #45983)

shouldn't we use include()?

This revision is now accepted and ready to land.Nov 25 2024, 4:47 AM

Worth adding to the Summary or Test Plan that this includes all RPC (all usages of getRustAPI) other than unath RPCs.

Good point, this might not be immediately obvious.

Ideally, I would see this improved and have this typed like IdentityServiceClient, and to be lazy initialized when we e.g. call getRustAPI only once, I think those stateless functions are hard to maintain, but this is not feedback to this diff, we can create a follow-up task to consider this if you agree.

I have drafted an implementation that proxies RustAPI object and wraps every promise call within a try-catch. Finally I considered it an overkill but that would solve your concern

keyserver/src/utils/identity-utils.js
22–24 ↗(On Diff #45983)

For Identity RPCs we have the Display trait implemented (derived) on Rust side which exactly displays the error code. I used includes() only for Tunnelbroker error traits because their Display is implemented more implicitly and also shared between client and server, so more likely to change in the future. Using includes there made sense to make it more future-proof. Here, the Display trait is right in rust-node-addon, so there's no need.

bartek edited the test plan for this revision. (Show Details)