feat: add new directive to validate auth token with feature flag #138

Rudge · 2023-11-14T23:25:15Z

What problem is this solving?

Enable the auth token validation for insecure operations. Previously, we put the directive @auditAccess and now we add the directive @checkAccessWithFeatureFlag.

How to test it?

Configure the feature flag in masterdata

curl --location 'https://tokenvalidation--b2bsuite.vtexcommercestable.com.br/api/dataentities/auth_validation_config/documents' \
--header 'VtexIdclientAutCookie: {{TOKEN}}' \
--header 'Content-Type: application/json' \
--data '{
    "id": "b2b-organizations-graphql",
    "enable": false
 }
'

Update the config

curl --location --request PATCH 'https://tokenvalidation--b2bsuite.vtexcommercestable.com.br/api/dataentities/auth_validation_config/documents/b2b-organizations-graphql' \
--header 'VtexIdclientAutCookie: {{token}}' \
--header 'Content-Type: application/json' \
--data '{
    "enable": true
 }
'

Call an operation that has the new directive.
We called the getOrganizationByIdStorefront in the performance test and the difference between them was 100 ms for average, 90 ms for mediana, and 160 ms for P95.

scenarios: (100.00%) 1 scenario, 2 max VUs, 45s max duration (incl. graceful stop):
* default: 2 looping VUs for 15s (gracefulStop: 30s)
Performance test without querying masterdata to get the feature flag:

 checks.........................: 100.00% ✓ 68       ✗ 0
 data_received..................: 104 kB  6.8 kB/s
 data_sent......................: 281 kB  18 kB/s
 http_req_blocked...............: avg=1.39ms   min=0s       med=0s       max=48.89ms p(90)=1µs      p(95)=1µs
 http_req_connecting............: avg=199.76µs min=0s       med=0s       max=6.79ms  p(90)=0s       p(95)=0s
 http_req_duration..............: avg=447.16ms min=283.85ms med=334.7ms  max=2.01s   p(90)=678.68ms p(95)=846.22ms
   { expected_response:true }...: avg=447.16ms min=283.85ms med=334.7ms  max=2.01s   p(90)=678.68ms p(95)=846.22ms
 http_req_failed................: 0.00%   ✓ 0        ✗ 68
 http_req_receiving.............: avg=78.76µs  min=36µs     med=57.5µs   max=440µs   p(90)=126.9µs  p(95)=164.69µs
 http_req_sending...............: avg=159.45µs min=94µs     med=126µs    max=827µs   p(90)=269.1µs  p(95)=310.29µs
 http_req_tls_handshaking.......: avg=853.38µs min=0s       med=0s       max=30.62ms p(90)=0s       p(95)=0s
 http_req_waiting...............: avg=446.92ms min=283.48ms med=334.41ms max=2.01s   p(90)=678.5ms  p(95)=846.04ms
 http_reqs......................: 68      4.449138/s
 iteration_duration.............: avg=448.76ms min=284.06ms med=334.94ms max=2.01s   p(90)=691.53ms p(95)=846.38ms
 iterations.....................: 68      4.449138/s
 vus............................: 2       min=2      max=2
 vus_max........................: 2       min=2      max=2

Performance test with querying masterdata to get the feature flag:

checks.........................: 100.00% ✓ 55       ✗ 0
 data_received..................: 87 kB   5.7 kB/s
 data_sent......................: 227 kB  15 kB/s
 http_req_blocked...............: avg=6.07ms   min=0s       med=1µs      max=167.95ms p(90)=1µs      p(95)=1µs
 http_req_connecting............: avg=300.87µs min=0s       med=0s       max=8.4ms    p(90)=0s       p(95)=0s
 http_req_duration..............: avg=542.62ms min=359.82ms med=424.6ms  max=2.16s    p(90)=793.51ms p(95)=1.03s
   { expected_response:true }...: avg=542.62ms min=359.82ms med=424.6ms  max=2.16s    p(90)=793.51ms p(95)=1.03s
 http_req_failed................: 0.00%   ✓ 0        ✗ 55
 http_req_receiving.............: avg=67.05µs  min=47µs     med=60µs     max=156µs    p(90)=90.6µs   p(95)=101.09µs
 http_req_sending...............: avg=165.09µs min=97µs     med=128µs    max=1.36ms   p(90)=195.2µs  p(95)=264.49µs
 http_req_tls_handshaking.......: avg=1.01ms   min=0s       med=0s       max=29.21ms  p(90)=0s       p(95)=0s
 http_req_waiting...............: avg=542.39ms min=359.55ms med=424.38ms max=2.16s    p(90)=793.3ms  p(95)=1.03s
 http_reqs......................: 55      3.633857/s
 iteration_duration.............: avg=548.92ms min=360.1ms  med=424.77ms max=2.32s    p(90)=808.77ms p(95)=1.06s
 iterations.....................: 55      3.633857/s
 vus............................: 2       min=2      max=2
 vus_max........................: 2       min=2      max=2

Workspace

jira: B2BTEAM-1486

vtex-io-ci-cd · 2023-11-14T23:25:17Z

Hi! I'm VTEX IO CI/CD Bot and I'll be helping you to publish your app! 🤖

Please select which version do you want to release:

Patch (backwards-compatible bug fixes)
Minor (backwards-compatible functionality)
Major (incompatible API changes)

And then you just need to merge your PR when you are ready! There is no need to create a release commit/tag.

No thanks, I would rather do it manually 😞

vtex-io-docs-bot · 2023-11-14T23:25:23Z

Beep boop 🤖

I noticed you didn't make any changes at the docs/ folder

There's nothing new to document 🤔
I'll do it later 😞

In order to keep track, I'll create an issue if you decide now is not a good time

I just updated 🎉🎉

github-actions · 2023-11-14T23:25:58Z

	Messages
📖	❤️ Thanks!
📖	🎉 PR additions = `141`, PR deletions = `55`

Generated by 🚫 dangerJS against 9326eb4

sonarqubecloud · 2023-11-15T20:20:43Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

3.4% Coverage
0.0% Duplication

The version of Java (11.0.17) you have used to run this analysis is deprecated and we will stop accepting it soon. Please update to at least Java 17.
Read more here

enzomerca

Could you add a comment on this PR explaining why some operations do not have the new @checkAccessWithFeatureFlag directive? e.g. getOrganizationByIdStorefront has but getCostCentersByOrganizationIdStorefront does not.

enzomerca · 2023-11-16T11:46:13Z

node/utils/metrics/metrics.ts

@@ -1,6 +1,7 @@
 import axios from 'axios'

-const ANALYTICS_URL = 'https://rc.vtex.com/api/analytics/schemaless-events'
+const ANALYTICS_URL =
+  'https://analytics.vtex.com/api/analytics/schemaless-events'


why did this change? What is the difference between rc and analytics urls?

I found some issues with using rc and the documentation suggests using analytics.

"This can be done by sending events to the following endpoint: https://analytics.vtex.com/api/analytics/schemaless-events (For applications on the VTEX Network) or to https://rc.vtex.com/api/analytics/schemaless-events (For applications outside the VTEX Network, such as Front End Applications)"

mairatma

Hey @Rudge , before merging can you take a look at my comment on the other similar PR here?

Rudge · 2023-11-16T13:40:16Z

getCostCentersByOrganizationIdStorefront

Good point,

Could you add a comment on this PR explaining why some operations do not have the new @checkAccessWithFeatureFlag directive? e.g. getOrganizationByIdStorefront has but getCostCentersByOrganizationIdStorefront does not.

Good point. I added in getOrganizationByIdStorefront but not mapped getCostCentersByOrganizationIdStorefront previously. I will add and review based on B2BTEAM-1285.

enzomerca · 2023-11-23T16:53:38Z

graphql/schema.graphql

@@ -78,26 +88,29 @@ type Query {
  getPaymentTerms: [PaymentTerm]
    @cacheControl(scope: PUBLIC, maxAge: SHORT)
    @auditAccess
-
+    @checkAccessWithFeatureFlag
  getOrganizationsByEmail(email: String): [B2BOrganization]
    @checkUserAccess
    @cacheControl(scope: PRIVATE)
    @auditAccess


getOrganizationsByEmail is on https://vtex-dev.atlassian.net/browse/B2BTEAM-1285 but we did not add the @checkAccessWithFeatureFlag for it

It is not necessary because there is already a directive @checkUserAccess. I am removing it from the task.

mairatma · 2023-11-28T13:21:45Z

node/resolvers/directives/checkUserAccess.ts

+        error: err,
+        message: `CheckUserAccess: Invalid admin token for ${operation}`,
+        operation,
+        token,


This PR is just missing the changes you made on that other similar for storefront-permissions, where you removed the token field from the logs and also removed operation from the log messages.

mairatma

Leaving this approved, but don't forget the log adjustments, ok?

Rudge · 2023-12-19T14:50:03Z

We deployed the version without a feature flag and it doesn’t need to deploy this one.

Rudge added 2 commits November 14, 2023 10:54

build: upgrade vtex/api version

6db09d3

feat: add directive to validate auth token and feature flag

e65892f

jira: B2BTEAM-1486

Rudge added 4 commits November 14, 2023 20:45

chore: update changelog

1101d2e

refactor: remove duplicated code to validate access tokens

576db3f

feat: remove feature flag from operation with checkUser

e0bd2ab

fix: adjust auth metrics

2a0cdb5

Rudge requested a review from a team November 15, 2023 17:59

Rudge added 3 commits November 15, 2023 15:21

feat: use feature flag id by app to configure multiples

cf9f0c0

feat: add directive checkAccessWithFeatureFlag for impersonateB2BUser

e8cdfb2

feat: log operation when occur an error to validate auth token

9326eb4

enzomerca reviewed Nov 16, 2023

View reviewed changes

mairatma reviewed Nov 16, 2023

View reviewed changes

Rudge requested review from mairatma and enzomerca November 23, 2023 15:04

enzomerca reviewed Nov 23, 2023

View reviewed changes

Rudge requested a review from enzomerca November 27, 2023 17:22

enzomerca approved these changes Nov 27, 2023

View reviewed changes

mairatma reviewed Nov 28, 2023

View reviewed changes

mairatma approved these changes Nov 28, 2023

View reviewed changes

Rudge changed the title ~~feat: add new directive to validate auth token~~ feat: add new directive to validate auth token with feature flag Nov 30, 2023

Rudge closed this Dec 19, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add new directive to validate auth token with feature flag #138

feat: add new directive to validate auth token with feature flag #138

Rudge commented Nov 14, 2023 •

edited

Loading

vtex-io-ci-cd bot commented Nov 14, 2023 •

edited by Rudge

Loading

vtex-io-docs-bot bot commented Nov 14, 2023

github-actions bot commented Nov 14, 2023 •

edited

Loading

sonarqubecloud bot commented Nov 15, 2023

enzomerca left a comment

enzomerca Nov 16, 2023

Rudge Nov 16, 2023 •

edited

Loading

mairatma left a comment

Rudge commented Nov 16, 2023 •

edited by jira bot

Loading

enzomerca Nov 23, 2023 •

edited

Loading

Rudge Nov 27, 2023 •

edited

Loading

mairatma Nov 28, 2023

mairatma left a comment

Rudge commented Dec 19, 2023

feat: add new directive to validate auth token with feature flag #138

feat: add new directive to validate auth token with feature flag #138

Conversation

Rudge commented Nov 14, 2023 • edited Loading

What problem is this solving?

How to test it?

vtex-io-ci-cd bot commented Nov 14, 2023 • edited by Rudge Loading

vtex-io-docs-bot bot commented Nov 14, 2023

github-actions bot commented Nov 14, 2023 • edited Loading

sonarqubecloud bot commented Nov 15, 2023

enzomerca left a comment

Choose a reason for hiding this comment

enzomerca Nov 16, 2023

Choose a reason for hiding this comment

Rudge Nov 16, 2023 • edited Loading

Choose a reason for hiding this comment

mairatma left a comment

Choose a reason for hiding this comment

Rudge commented Nov 16, 2023 • edited by jira bot Loading

enzomerca Nov 23, 2023 • edited Loading

Choose a reason for hiding this comment

Rudge Nov 27, 2023 • edited Loading

Choose a reason for hiding this comment

mairatma Nov 28, 2023

Choose a reason for hiding this comment

mairatma left a comment

Choose a reason for hiding this comment

Rudge commented Dec 19, 2023

Rudge commented Nov 14, 2023 •

edited

Loading

vtex-io-ci-cd bot commented Nov 14, 2023 •

edited by Rudge

Loading

github-actions bot commented Nov 14, 2023 •

edited

Loading

Rudge Nov 16, 2023 •

edited

Loading

Rudge commented Nov 16, 2023 •

edited by jira bot

Loading

enzomerca Nov 23, 2023 •

edited

Loading

Rudge Nov 27, 2023 •

edited

Loading