[PATCH 1/4] Add a api_login field

[Pierre-Yves Chibon]

Discussing with Seth it appears that the desired behavior would be
to have a different login username when using the API vs the website.
This commit implements a api_login which is only valid to use the API
and won't be on the website.
---
 copr_cli/README.rst                                |    2 +-
 .../versions/2a75f0a06d90_add_a_api_login_fiel.py  |   25 ++++++++++++++++++++
 coprs_frontend/coprs/models.py                     |    1 +
 coprs_frontend/coprs/templates/api.html            |    1 +
 coprs_frontend/coprs/views/api_ns/api_general.py   |    4 +++
 coprs_frontend/coprs/views/misc.py                 |    6 +++-
 6 files changed, 36 insertions(+), 3 deletions(-)
 create mode 100644 coprs_frontend/alembic/versions/2a75f0a06d90_add_a_api_login_fiel.py

diff --git a/copr_cli/README.rst b/copr_cli/README.rst
index 962076b..e46f5ff 100644
--- a/copr_cli/README.rst
+++ b/copr_cli/README.rst
@@ -40,7 +40,7 @@ Usage:
 ::
 
  [copr-cli]
- username = <insert here your username>
+ username = <insert here your API login>
  token = <insert here your API token>
 
 
diff --git a/coprs_frontend/alembic/versions/2a75f0a06d90_add_a_api_login_fiel.py
b/coprs_frontend/alembic/versions/2a75f0a06d90_add_a_api_login_fiel.py
new file mode 100644
index 0000000..bf1bb8f
--- /dev/null
+++ b/coprs_frontend/alembic/versions/2a75f0a06d90_add_a_api_login_fiel.py
@@ -0,0 +1,25 @@
+"""Add a api_login field to user
+
+Revision ID: 2a75f0a06d90
+Revises: 544873aa3ba1
+Create Date: 2013-03-10 10:01:16.820499
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = '2a75f0a06d90'
+down_revision = '544873aa3ba1'
+
+from alembic import op
+import sqlalchemy as sa
+
+
+def upgrade():
+    """ Add the colum 'api_login' to the table user.
"""
+    op.add_column('user', sa.Column('api_login', sa.String(40),
+        nullable=False, server_default='default_token'))
+
+
+def downgrade():
+    """ Drop the column 'api_login' from the table user.
"""
+    op.drop_column('user', 'api_login')
diff --git a/coprs_frontend/coprs/models.py b/coprs_frontend/coprs/models.py
index 8c20f86..957b80e 100644
--- a/coprs_frontend/coprs/models.py
+++ b/coprs_frontend/coprs/models.py
@@ -60,6 +60,7 @@ class User(db.Model, Serializer):
     mail = db.Column(db.String(150), nullable = False)
     proven = db.Column(db.Boolean, default = False)
     admin = db.Column(db.Boolean, default = False)
+    api_login = db.Column(db.String(40), nullable = False, default = 'abc')
     api_token = db.Column(db.String(40), nullable = False, default = 'abc')
     api_token_expiration = db.Column(db.Date, nullable = False, default =
datetime.date(2000, 1, 1))
 
diff --git a/coprs_frontend/coprs/templates/api.html
b/coprs_frontend/coprs/templates/api.html
index 0de97b2..cb77a23 100644
--- a/coprs_frontend/coprs/templates/api.html
+++ b/coprs_frontend/coprs/templates/api.html
@@ -20,6 +20,7 @@
     {% if g.user %}
     <p>Your information:</p>
     <pre style="font-size:120%">
+    API login       :   {{ g.user.api_login }}
     API token       :   {{ g.user.api_token }}
     Expiration date :   {{ g.user.api_token_expiration }}
     </pre>
diff --git a/coprs_frontend/coprs/views/api_ns/api_general.py
b/coprs_frontend/coprs/views/api_ns/api_general.py
index 081aceb..d69013b 100644
--- a/coprs_frontend/coprs/views/api_ns/api_general.py
+++ b/coprs_frontend/coprs/views/api_ns/api_general.py
@@ -30,6 +30,10 @@ def api_new_token():
     """ Method use to generate a new API token for the current user.
     """
     user = flask.g.user
+    copr64 = base64.b64encode('copr') + '##'
+    api_login = helpers.generate_api_token(
+        flask.current_app.config['API_TOKEN_LENGTH'] - len(copr64))
+    user.api_login = api_login
     user.api_token = helpers.generate_api_token(
         flask.current_app.config['API_TOKEN_LENGTH'])
     user.api_token_expiration = datetime.date.today() \
diff --git a/coprs_frontend/coprs/views/misc.py b/coprs_frontend/coprs/views/misc.py
index 383b832..12072e7 100644
--- a/coprs_frontend/coprs/views/misc.py
+++ b/coprs_frontend/coprs/views/misc.py
@@ -57,7 +57,10 @@ def create_or_login(resp):
     if not user: # create if not created already
         expiration_date_token = datetime.date.today() \
             + datetime.timedelta(days=30)
+        copr64 = base64.b64encode('copr') + '##'
         user = models.User(openid_name = resp.identity_url, mail = resp.email,
+            api_login = copr64 + helpers.generate_api_token(
+                app.config['API_TOKEN_LENGTH'] - len(copr64)),
             api_token =
helpers.generate_api_token(app.config['API_TOKEN_LENGTH']),
             api_token_expiration = expiration_date_token)
         db.session.add(user)
@@ -90,8 +93,7 @@ def login_required(f):
         token_auth = False
         if token and username:
             user = models.User.query.filter(
-                models.User.openid_name == models.User.openidize_name(username)
-                ).first()
+                models.User.api_login == username).first()
             if user \
                 and user.api_token == token \
                 and user.api_token_expiration >= datetime.date.today():
-- 
1.7.1

[PATCH2/4]SeparateAPIloginfromUIlogin

[Pierre-Yves Chibon]

The idea here is to prevent someone from login in via the API mechanism
and performs action which are outside of the API.
---
 coprs_frontend/coprs/views/api_ns/api_general.py |    9 +++++----
 coprs_frontend/coprs/views/misc.py               |   18 ++++++++++++++----
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/coprs_frontend/coprs/views/api_ns/api_general.py
b/coprs_frontend/coprs/views/api_ns/api_general.py
index d69013b..a51bad6 100644
--- a/coprs_frontend/coprs/views/api_ns/api_general.py
+++ b/coprs_frontend/coprs/views/api_ns/api_general.py
@@ -1,6 +1,7 @@
 import datetime
 import time
 
+import base64
 import flask
 
 from coprs import db
@@ -8,7 +9,7 @@ from coprs import exceptions
 from coprs import forms
 from coprs import helpers
 
-from coprs.views.misc import login_required
+from coprs.views.misc import login_required, api_login_required
 
 from coprs.views.api_ns import api_ns
 
@@ -31,7 +32,7 @@ def api_new_token():
     """
     user = flask.g.user
     copr64 = base64.b64encode('copr') + '##'
-    api_login = helpers.generate_api_token(
+    api_login = copr64 + helpers.generate_api_token(
         flask.current_app.config['API_TOKEN_LENGTH'] - len(copr64))
     user.api_login = api_login
     user.api_token = helpers.generate_api_token(
@@ -44,7 +45,7 @@ def api_new_token():
 
 
 @api_ns.route('/copr/new/', methods=['POST'])
-@login_required
+@api_login_required
 def api_new_copr():
     """ Receive information from the user on how to create its new copr,
     check their validity and create the corresponding copr.
@@ -134,7 +135,7 @@ def api_coprs_by_owner(username=None):
 
 @api_ns.route('/coprs/detail/<username>/<coprname>/new_build/',
     methods=["POST"])
-@login_required
+@api_login_required
 def copr_new_build(username, coprname):
     form = forms.BuildForm(csrf_enabled=False)
     copr = coprs_logic.CoprsLogic.get(flask.g.user, username,
diff --git a/coprs_frontend/coprs/views/misc.py b/coprs_frontend/coprs/views/misc.py
index 12072e7..f4b6fc0 100644
--- a/coprs_frontend/coprs/views/misc.py
+++ b/coprs_frontend/coprs/views/misc.py
@@ -79,8 +79,7 @@ def logout():
     flask.flash(u'You were signed out')
     return flask.redirect(oid.get_next_url())
 
-
-def login_required(f):
+def api_login_required(f):
     @functools.wraps(f)
     def decorated_function(*args, **kwargs):
         token = None
@@ -98,8 +97,19 @@ def login_required(f):
                 and user.api_token == token \
                 and user.api_token_expiration >= datetime.date.today():
                 token_auth = True
-                flask.g.user = user
-        if not token_auth and flask.g.user is None:
+        if not token_auth:
+            output = {'output': 'notok', 'error': 'Login
invalid/expired'}
+            jsonout = flask.jsonify(output)
+            jsonout.status_code = 500
+            return jsonout
+        return f(*args, **kwargs)
+    return decorated_function
+
+
+def login_required(f):
+    @functools.wraps(f)
+    def decorated_function(*args, **kwargs):
+        if flask.g.user is None:
             return flask.redirect(flask.url_for('misc.login',
                 next = flask.request.url))
         return f(*args, **kwargs)
-- 
1.7.1

[PATCH3/4]UpdateAPIdocumentation

[Pierre-Yves Chibon]

---
 coprs_frontend/coprs/templates/api.html |   10 ++++------
 1 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/coprs_frontend/coprs/templates/api.html
b/coprs_frontend/coprs/templates/api.html
index cb77a23..0ea30b2 100644
--- a/coprs_frontend/coprs/templates/api.html
+++ b/coprs_frontend/coprs/templates/api.html
@@ -43,9 +43,9 @@
                 copr of.</td>
         </tr>
     </table>
-    <p>URL will therefore look like:</p>
+    <p>URL is:</p>
     <pre style="font-size:120%">
-    /list/&lt;username&gt;/
+    /api/owned/&lt;username&gt;/
     </pre>
 
     <h4>Add a new copr</h4>
@@ -68,11 +68,9 @@
         </tr>
     </table>
 
-    <p>URL will therefore look like:</p>
+    <p>URL is:</p>
     <pre style="font-size:120%">
-    /add/&lt;name&gt;/&lt;chroots&gt;/
-    /add/&lt;name&gt;/&lt;chroots&gt;/&lt;repos&gt;/
-   
/add/&lt;name&gt;/&lt;chroots&gt;/&lt;repos&gt;/&lt;initial_pkgs&gt;/
+    /api/copr/new/
     </pre>
 
 
-- 
1.7.1

[PATCH4/4]Testonthevariablenotastring

[Pierre-Yves Chibon]

---
 coprs_frontend/coprs/views/api_ns/api_general.py |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/coprs_frontend/coprs/views/api_ns/api_general.py
b/coprs_frontend/coprs/views/api_ns/api_general.py
index a51bad6..23cf911 100644
--- a/coprs_frontend/coprs/views/api_ns/api_general.py
+++ b/coprs_frontend/coprs/views/api_ns/api_general.py
@@ -114,7 +114,7 @@ def api_coprs_by_owner(username=None):
     """
     username = flask.request.args.get('username', None) or username
     httpcode = 200
-    if 'username':
+    if username:
         query = coprs_logic.CoprsLogic.get_multiple(flask.g.user,
             user_relation='owned', username=username)
         repos = query.all()
-- 
1.7.1

[PATCH2/4]SeparateAPIloginfromUIlogin

[Pierre-Yves Chibon]

On Sun, 2013-03-10 at 10:55 +0100, Pierre-Yves Chibon wrote:
>  The idea here is to prevent someone from login in via the API
>  mechanism and performs action which are outside of the API. 
This one is actually pretty important. At the moment using curl and the
right arguments I can change my API token, with this commit I cannot
anymore :)

Pierre

[PATCH2/4]SeparateAPIloginfromUIlogin

[Pierre-Yves Chibon]

The idea here is to prevent someone from login in via the API mechanism
and performs action which are outside of the API.
---
 coprs_frontend/coprs/views/api_ns/api_general.py |    9 +++++----
 coprs_frontend/coprs/views/misc.py               |   17 ++++++++++++++---
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/coprs_frontend/coprs/views/api_ns/api_general.py
b/coprs_frontend/coprs/views/api_ns/api_general.py
index d69013b..a51bad6 100644
--- a/coprs_frontend/coprs/views/api_ns/api_general.py
+++ b/coprs_frontend/coprs/views/api_ns/api_general.py
@@ -1,6 +1,7 @@
 import datetime
 import time
 
+import base64
 import flask
 
 from coprs import db
@@ -8,7 +9,7 @@ from coprs import exceptions
 from coprs import forms
 from coprs import helpers
 
-from coprs.views.misc import login_required
+from coprs.views.misc import login_required, api_login_required
 
 from coprs.views.api_ns import api_ns
 
@@ -31,7 +32,7 @@ def api_new_token():
     """
     user = flask.g.user
     copr64 = base64.b64encode('copr') + '##'
-    api_login = helpers.generate_api_token(
+    api_login = copr64 + helpers.generate_api_token(
         flask.current_app.config['API_TOKEN_LENGTH'] - len(copr64))
     user.api_login = api_login
     user.api_token = helpers.generate_api_token(
@@ -44,7 +45,7 @@ def api_new_token():
 
 
 @api_ns.route('/copr/new/', methods=['POST'])
-@login_required
+@api_login_required
 def api_new_copr():
     """ Receive information from the user on how to create its new copr,
     check their validity and create the corresponding copr.
@@ -134,7 +135,7 @@ def api_coprs_by_owner(username=None):
 
 @api_ns.route('/coprs/detail/<username>/<coprname>/new_build/',
     methods=["POST"])
-@login_required
+@api_login_required
 def copr_new_build(username, coprname):
     form = forms.BuildForm(csrf_enabled=False)
     copr = coprs_logic.CoprsLogic.get(flask.g.user, username,
diff --git a/coprs_frontend/coprs/views/misc.py b/coprs_frontend/coprs/views/misc.py
index 12072e7..1c5a47c 100644
--- a/coprs_frontend/coprs/views/misc.py
+++ b/coprs_frontend/coprs/views/misc.py
@@ -79,8 +79,7 @@ def logout():
     flask.flash(u'You were signed out')
     return flask.redirect(oid.get_next_url())
 
-
-def login_required(f):
+def api_login_required(f):
     @functools.wraps(f)
     def decorated_function(*args, **kwargs):
         token = None
@@ -99,7 +98,19 @@ def login_required(f):
                 and user.api_token_expiration >= datetime.date.today():
                 token_auth = True
                 flask.g.user = user
-        if not token_auth and flask.g.user is None:
+        if not token_auth:
+            output = {'output': 'notok', 'error': 'Login
invalid/expired'}
+            jsonout = flask.jsonify(output)
+            jsonout.status_code = 500
+            return jsonout
+        return f(*args, **kwargs)
+    return decorated_function
+
+
+def login_required(f):
+    @functools.wraps(f)
+    def decorated_function(*args, **kwargs):
+        if flask.g.user is None:
             return flask.redirect(flask.url_for('misc.login',
                 next = flask.request.url))
         return f(*args, **kwargs)
-- 
1.7.1

[PATCH2/4]SeparateAPIloginfromUIlogin

[Pierre-Yves Chibon]

On Sun, 2013-03-10 at 11:29 +0100, Pierre-Yves Chibon wrote:
>  The idea here is to prevent someone from login in via the API
>  mechanism and performs action which are outside of the API. 
Arf, sorry I mixed up the reference email, this one has a fix rather
important:
+                 flask.g.user = user

It kind of doesn't work without this :)

Pierre

[Bohuslav Kabrda]

----- Original Message -----
>  Discussing with Seth it appears that the desired behavior would be
>  to have a different login username when using the API vs the website.
>  This commit implements a api_login which is only valid to use the API
>  and won't be on the website.
>  ---
>   copr_cli/README.rst                                |    2 +-
>   .../versions/2a75f0a06d90_add_a_api_login_fiel.py  |   25
>   ++++++++++++++++++++
>   coprs_frontend/coprs/models.py                     |    1 +
>   coprs_frontend/coprs/templates/api.html            |    1 +
>   coprs_frontend/coprs/views/api_ns/api_general.py   |    4 +++
>   coprs_frontend/coprs/views/misc.py                 |    6 +++-
>   6 files changed, 36 insertions(+), 3 deletions(-)
>   create mode 100644
>   coprs_frontend/alembic/versions/2a75f0a06d90_add_a_api_login_fiel.py
>  
>  diff --git a/copr_cli/README.rst b/copr_cli/README.rst
>  index 962076b..e46f5ff 100644
>  --- a/copr_cli/README.rst
>  +++ b/copr_cli/README.rst
>  @@ -40,7 +40,7 @@ Usage:
>   ::
>   
>    [copr-cli]
>  - username = <insert here your username>
>  + username = <insert here your API login>
>    token = <insert here your API token>
>   
>   
>  diff --git
>  a/coprs_frontend/alembic/versions/2a75f0a06d90_add_a_api_login_fiel.py
>  b/coprs_frontend/alembic/versions/2a75f0a06d90_add_a_api_login_fiel.py
>  new file mode 100644
>  index 0000000..bf1bb8f
>  --- /dev/null
>  +++
>  b/coprs_frontend/alembic/versions/2a75f0a06d90_add_a_api_login_fiel.py
>  @@ -0,0 +1,25 @@
>  +"""Add a api_login field to user
>  +
>  +Revision ID: 2a75f0a06d90
>  +Revises: 544873aa3ba1
>  +Create Date: 2013-03-10 10:01:16.820499
>  +
>  +"""
>  +
>  +# revision identifiers, used by Alembic.
>  +revision = '2a75f0a06d90'
>  +down_revision = '544873aa3ba1'
>  +
>  +from alembic import op
>  +import sqlalchemy as sa
>  +
>  +
>  +def upgrade():
>  +    """ Add the colum 'api_login' to the table user.
> """
>  +    op.add_column('user', sa.Column('api_login', sa.String(40),
>  +        nullable=False, server_default='default_token'))
>  +
>  +
>  +def downgrade():
>  +    """ Drop the column 'api_login' from the table user.
> """
>  +    op.drop_column('user', 'api_login')
>  diff --git a/coprs_frontend/coprs/models.py
>  b/coprs_frontend/coprs/models.py
>  index 8c20f86..957b80e 100644
>  --- a/coprs_frontend/coprs/models.py
>  +++ b/coprs_frontend/coprs/models.py
>  @@ -60,6 +60,7 @@ class User(db.Model, Serializer):
>       mail = db.Column(db.String(150), nullable = False)
>       proven = db.Column(db.Boolean, default = False)
>       admin = db.Column(db.Boolean, default = False)
>  +    api_login = db.Column(db.String(40), nullable = False, default =
>  'abc')
>       api_token = db.Column(db.String(40), nullable = False, default =
>       'abc')
>       api_token_expiration = db.Column(db.Date, nullable = False,
>       default = datetime.date(2000, 1, 1))
>   
>  diff --git a/coprs_frontend/coprs/templates/api.html
>  b/coprs_frontend/coprs/templates/api.html
>  index 0de97b2..cb77a23 100644
>  --- a/coprs_frontend/coprs/templates/api.html
>  +++ b/coprs_frontend/coprs/templates/api.html
>  @@ -20,6 +20,7 @@
>       {% if g.user %}
>       <p>Your information:</p>
>       <pre style="font-size:120%">
>  +    API login       :   {{ g.user.api_login }}
>       API token       :   {{ g.user.api_token }}
>       Expiration date :   {{ g.user.api_token_expiration }}
>       </pre>
>  diff --git a/coprs_frontend/coprs/views/api_ns/api_general.py
>  b/coprs_frontend/coprs/views/api_ns/api_general.py
>  index 081aceb..d69013b 100644
>  --- a/coprs_frontend/coprs/views/api_ns/api_general.py
>  +++ b/coprs_frontend/coprs/views/api_ns/api_general.py
>  @@ -30,6 +30,10 @@ def api_new_token():
>       """ Method use to generate a new API token for the current user.
>       """
>       user = flask.g.user
>  +    copr64 = base64.b64encode('copr') + '##'
>  +    api_login = helpers.generate_api_token(
>  +        flask.current_app.config['API_TOKEN_LENGTH'] - len(copr64))
>  +    user.api_login = api_login
>       user.api_token = helpers.generate_api_token(
>           flask.current_app.config['API_TOKEN_LENGTH'])
>       user.api_token_expiration = datetime.date.today() \
>  diff --git a/coprs_frontend/coprs/views/misc.py
>  b/coprs_frontend/coprs/views/misc.py
>  index 383b832..12072e7 100644
>  --- a/coprs_frontend/coprs/views/misc.py
>  +++ b/coprs_frontend/coprs/views/misc.py
>  @@ -57,7 +57,10 @@ def create_or_login(resp):
>       if not user: # create if not created already
>           expiration_date_token = datetime.date.today() \
>               + datetime.timedelta(days=30)
>  +        copr64 = base64.b64encode('copr') + '##'
>           user = models.User(openid_name = resp.identity_url, mail =
>           resp.email,
>  +            api_login = copr64 + helpers.generate_api_token(
>  +                app.config['API_TOKEN_LENGTH'] - len(copr64)),
>               api_token =
>               helpers.generate_api_token(app.config['API_TOKEN_LENGTH']),
>               api_token_expiration = expiration_date_token)
>           db.session.add(user)
>  @@ -90,8 +93,7 @@ def login_required(f):
>           token_auth = False
>           if token and username:
>               user = models.User.query.filter(
>  -                models.User.openid_name ==
>  models.User.openidize_name(username)
>  -                ).first()
>  +                models.User.api_login == username).first()
>               if user \
>                   and user.api_token == token \
>                   and user.api_token_expiration >=
>                   datetime.date.today():
>  --
>  1.7.1 
A question for this series. If I understand it correctly, the api_login is just another
random generated string, right? Would you please elaborate a bit more on why having
separate logins is good?

Thanks.

-- 
Regards,
Bohuslav "Slavek" Kabrda.

[Pierre-Yves Chibon]

On Tue, 2013-03-12 at 03:07 -0400, Bohuslav Kabrda wrote:
>  A question for this series. If I understand it correctly, the
> api_login is just another random generated string, right? Would you please elaborate a bit
> more on why having separate logins is good? 
Yes it is, (with the addition that that the part before '##' is a
based64 of 'copr').
I think the basic idea here is to reduce even more the possibility of
brute force since one would have to do it for both the api token and the
username. Seth, do you see another interest for it?

It also seems to be the approach taken by cloud plateform and by oauth
system (if my understanding is correct).

Pierre

[Pierre-Yves Chibon]

On Tue, 2013-03-12 at 03:07 -0400, Bohuslav Kabrda wrote:
>  
>  A question for this series. If I understand it correctly, the
>  api_login is just another random generated string, right? Would you
>  please elaborate a bit more on why having separate logins is good? 
Regarding the other patchs?
2, 3 and 4 are actually independent from 1. I can reorder them if you
like and keep 1 for later.

Pierre

[Bohuslav Kabrda]

----- Original Message -----
>  On Tue, 2013-03-12 at 03:07 -0400, Bohuslav Kabrda wrote:
>  > 
>  > A question for this series. If I understand it correctly, the
>  > api_login is just another random generated string, right? Would you
>  > please elaborate a bit more on why having separate logins is good?
>  
>  Regarding the other patchs?
>  2, 3 and 4 are actually independent from 1. I can reorder them if you
>  like and keep 1 for later.
>  
>  Pierre 
Yes, please go ahead with 2,3 and 4. I'm not generally against 1, I'd just like to
hear the reason behind that first.

Thanks.

-- 
Regards,
Bohuslav "Slavek" Kabrda.

[Seth Vidal]

On Tue, 12 Mar 2013 08:10:21 +0100
Pierre-Yves Chibon <pingou(a)pingoured.fr&gt; wrote:

>  On Tue, 2013-03-12 at 03:07 -0400, Bohuslav Kabrda wrote:
>  > A question for this series. If I understand it correctly, the
>  > api_login is just another random generated string, right? Would you
>  > please elaborate a bit more on why having separate logins is good?
>  
>  Yes it is, (with the addition that that the part before '##' is a
>  based64 of 'copr').
>  I think the basic idea here is to reduce even more the possibility of
>  brute force since one would have to do it for both the api token and
>  the username. Seth, do you see another interest for it?
>  
>  It also seems to be the approach taken by cloud plateform and by oauth
>  system (if my understanding is correct).
>   
That's correct. I think the idea is that if someone discovers your
token they don't discover who owns it but if we find someone using that
token username somewhere else - we can trace back what app it came from.

-sv

[Pierre-Yves Chibon]

On Wed, 2013-03-20 at 02:13 -0400, seth vidal wrote:
>  On Tue, 12 Mar 2013 08:10:21 +0100
>  Pierre-Yves Chibon <pingou(a)pingoured.fr&gt; wrote:
>  
>  > On Tue, 2013-03-12 at 03:07 -0400, Bohuslav Kabrda wrote:
>  > > A question for this series. If I understand it correctly, the
>  > > api_login is just another random generated string, right? Would you
>  > > please elaborate a bit more on why having separate logins is good?
>  > 
>  > Yes it is, (with the addition that that the part before '##' is a
>  > based64 of 'copr').
>  > I think the basic idea here is to reduce even more the possibility of
>  > brute force since one would have to do it for both the api token and
>  > the username. Seth, do you see another interest for it?
>  > 
>  > It also seems to be the approach taken by cloud plateform and by oauth
>  > system (if my understanding is correct).
>  > 
>  
>  That's correct. I think the idea is that if someone discovers your
>  token they don't discover who owns it but if we find someone using that
>  token username somewhere else - we can trace back what app it came from. 
Then I'm wondering if it's interesting to have the base64 of 'copr' in
the token itself.
In a way I think, no otherwise if someone finds your token it can find
out where to use it. On the other side, we already save the token in a
rather explicit place ~/.config/copr so in that respect it doesn't
really matter.

Pierre

[Seth Vidal]

On Wed, 20 Mar 2013 07:19:27 +0100
Pierre-Yves Chibon <pingou(a)pingoured.fr&gt; wrote:

>  On Wed, 2013-03-20 at 02:13 -0400, seth vidal wrote:
>  > On Tue, 12 Mar 2013 08:10:21 +0100
>  > Pierre-Yves Chibon <pingou(a)pingoured.fr&gt; wrote:
>  > 
>  > > On Tue, 2013-03-12 at 03:07 -0400, Bohuslav Kabrda wrote:
>  > > > A question for this series. If I understand it correctly, the
>  > > > api_login is just another random generated string, right? Would
>  > > > you please elaborate a bit more on why having separate logins
>  > > > is good?
>  > > 
>  > > Yes it is, (with the addition that that the part before '##' is a
>  > > based64 of 'copr').
>  > > I think the basic idea here is to reduce even more the
>  > > possibility of brute force since one would have to do it for both
>  > > the api token and the username. Seth, do you see another interest
>  > > for it?
>  > > 
>  > > It also seems to be the approach taken by cloud plateform and by
>  > > oauth system (if my understanding is correct).
>  > > 
>  > 
>  > That's correct. I think the idea is that if someone discovers your
>  > token they don't discover who owns it but if we find someone using
>  > that token username somewhere else - we can trace back what app it
>  > came from.
>  
>  Then I'm wondering if it's interesting to have the base64 of 'copr' in
>  the token itself.
>  In a way I think, no otherwise if someone finds your token it can find
>  out where to use it. On the other side, we already save the token in a
>  rather explicit place ~/.config/copr so in that respect it doesn't
>  really matter.
>   
yah - I'm not really sure. I'd rather plan for the case where we need
to figure out where something is from and less for trying to hide it
from a theoretical attacker.

So encoding copr in there helps us.

If the attacker can figure it out well, then - that's fine - but I just
want to know we can, too.

-sv

[Bohuslav Kabrda]

----- Original Message -----
>  On Wed, 20 Mar 2013 07:19:27 +0100
>  Pierre-Yves Chibon <pingou(a)pingoured.fr&gt; wrote:
>  
>  > On Wed, 2013-03-20 at 02:13 -0400, seth vidal wrote:
>  > > On Tue, 12 Mar 2013 08:10:21 +0100
>  > > Pierre-Yves Chibon <pingou(a)pingoured.fr&gt; wrote:
>  > > 
>  > > > On Tue, 2013-03-12 at 03:07 -0400, Bohuslav Kabrda wrote:
>  > > > > A question for this series. If I understand it correctly, the
>  > > > > api_login is just another random generated string, right?
>  > > > > Would
>  > > > > you please elaborate a bit more on why having separate logins
>  > > > > is good?
>  > > > 
>  > > > Yes it is, (with the addition that that the part before '##' is
>  > > > a
>  > > > based64 of 'copr').
>  > > > I think the basic idea here is to reduce even more the
>  > > > possibility of brute force since one would have to do it for
>  > > > both
>  > > > the api token and the username. Seth, do you see another
>  > > > interest
>  > > > for it?
>  > > > 
>  > > > It also seems to be the approach taken by cloud plateform and
>  > > > by
>  > > > oauth system (if my understanding is correct).
>  > > > 
>  > > 
>  > > That's correct. I think the idea is that if someone discovers
>  > > your
>  > > token they don't discover who owns it but if we find someone
>  > > using
>  > > that token username somewhere else - we can trace back what app
>  > > it
>  > > came from.
>  > 
>  > Then I'm wondering if it's interesting to have the base64 of 'copr'
>  > in
>  > the token itself.
>  > In a way I think, no otherwise if someone finds your token it can
>  > find
>  > out where to use it. On the other side, we already save the token
>  > in a
>  > rather explicit place ~/.config/copr so in that respect it doesn't
>  > really matter.
>  > 
>  
>  yah - I'm not really sure. I'd rather plan for the case where we need
>  to figure out where something is from and less for trying to hide it
>  from a theoretical attacker.
>  
>  So encoding copr in there helps us.
>  
>  If the attacker can figure it out well, then - that's fine - but I
>  just
>  want to know we can, too.
>  
>  -sv 
Thanks for the explanation guys, now I'm finally +1 for the commit :) Please go on and
commit.

Slavek.

-- 
Regards,
Bohuslav "Slavek" Kabrda.