Mint frontend_token with explicit expiry - #21
Conversation
📝 WalkthroughWalkthroughThe frontend token generation flow now reads expiration settings from environment variables and passes them explicitly when minting the API token, with defaults of ChangesFrontend token lifetime
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ckanext/sse/action.py`:
- Around line 526-527: Implement and ship the frontend_token renewal consumer
alongside the token lifetime change: update the frontend session flow referenced
by the comment so it detects impending frontend_token expiry and re-mints the
token before expiration, then uses the renewed token for subsequent API calls.
Ensure this behavior is enabled for newly created sessions and preserves the
existing long-lived NextAuth session.
- Around line 528-533: Update the frontend token rotation flow around
frontend_token_expires_in and frontend_token_unit to parse and validate both
configuration values before revoking the existing frontend_token. Reject empty,
malformed, or non-positive values with a clear configuration error, and only
proceed to token revocation and replacement after validation succeeds.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| # The frontend (ssen-portal) re-mints this token on expiry, so a short | ||
| # lifetime here does not break the long-lived NextAuth session. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Files containing sse/action.py:"
git ls-files | grep -F 'ckanext/sse/action.py' || true
echo
echo "Line count:"
wc -l ckanext/sse/action.py
echo
echo "Relevant generate_token section:"
sed -n '480,570p' ckanext/sse/action.py
echo
echo "Search frontend token env vars/usages:"
rg -n 'FRONTEND_TOKEN|frontend_token|NextAuth|CKANEXT__SSE|DEFAULT|expires_in' ckanext .github docker-compose* compose* -S || trueRepository: datopian/ckanext-sse
Length of output: 6172
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Diff stat:"
git diff --stat
echo
echo "Context around changed token action maybe:"
git diff ckanext/sse/action.py | sed -n '1,220p' || true
echo
echo "Search exact env var definitions/documentation:"
rg -n 'CKANEXT__SSE__FRONTEND_TOKEN_(UNIT|EXPIRES_IN_UNIT)|FRONTEND_TOKEN_UNIT|FRONTEND_TOKEN_EXPIRES_IN_UNIT' . -S || trueRepository: datopian/ckanext-sse
Length of output: 360
Ship frontend_token renewal with this change.
The default payload is expires_in=1, unit=3600, so new frontend sessions get 3,600-second tokens. If the NextAuth/backend deployment goes live without a frontend renewal consumer that re-mints frontend_token before expiry, API calls will stop while the user session is still valid.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ckanext/sse/action.py` around lines 526 - 527, Implement and ship the
frontend_token renewal consumer alongside the token lifetime change: update the
frontend session flow referenced by the comment so it detects impending
frontend_token expiry and re-mints the token before expiration, then uses the
renewed token for subsequent API calls. Ensure this behavior is enabled for
newly created sessions and preserves the existing long-lived NextAuth session.
| frontend_token_expires_in = int( | ||
| os.environ.get("CKANEXT__SSE__FRONTEND_TOKEN_EXPIRES_IN", 1) | ||
| ) | ||
| frontend_token_unit = int( | ||
| os.environ.get("CKANEXT__SSE__FRONTEND_TOKEN_UNIT", 3600) | ||
| ) |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file excerpt =="
sed -n '480,555p' ckanext/sse/action.py
echo
echo "== related error handling/search =="
rg -n "frontend_token|revoc|token_expires|CKANEXT__SSE__FRONTEND|ValueError|expires" ckanext/sse/action.py ckanext/sse -S || true
echo
echo "== git diff stat/name status if available =="
git diff --stat || true
git diff -- ckanext/sse/action.py | sed -n '1,220p' || trueRepository: datopian/ckanext-sse
Length of output: 5204
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== call graph / action callers =="
rg -n "_generate_token|_login_frontend_token|frontend_token|_check_auth|api_token_create|api_token_revoke" ckanext/sse/action.py ckanext/sse -S || true
echo
echo "== validators excerpt =="
sed -n '150,205p' ckanext/sse/validators.py
echo
echo "== behavior probe: int parsing order/exception behavior =="
python3 - <<'PY'
class RevokeOnce:
def __init__(self):
self.revoked = False
def revoke(self):
self.revoked = True
return object()
class BadInt:
def __str__(self):
return "bad"
def __int__(self):
raise ValueError("bad lifetime")
def __bool__(self):
return False
r = RevokeOnce()
old_token = r.revoke()
tokens = [{"name": "frontend_token", "id": "old"}]
front = tokens[0]["name"] == "frontend_token"
if front:
r.revoke() # existing token revoked
try:
frontend_token_expires_in = int(BadInt())
except Exception as e:
exc = e
print("revoked_before_parse=", r.revoked, type(exc).__name__, str(exc) if exc else None)
PYRepository: datopian/ckanext-sse
Length of output: 4387
Validate lifetime configuration before revoking the old token.
Empty or malformed CKANEXT__SSE__FRONTEND_TOKEN_EXPIRES_IN / CKANEXT__SSE__FRONTEND_TOKEN_UNIT values raise during int() parsing after any existing frontend_token has already been revoked. Since the except Exception branch leaves user["frontend_token"] as None, a bad deployment value can remove the working token without creating a replacement. Parse and validate these values before revocation, reject non-positive values, and return a clear configuration error.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ckanext/sse/action.py` around lines 528 - 533, Update the frontend token
rotation flow around frontend_token_expires_in and frontend_token_unit to parse
and validate both configuration values before revoking the existing
frontend_token. Reject empty, malformed, or non-positive values with a clear
configuration error, and only proceed to token revocation and replacement after
validation succeeds.
2 participants
What
Mint the CKAN
frontend_tokenin_generate_tokenwith an explicitexpires_in/unit(default 1h, env-overridable viaCKANEXT__SSE__FRONTEND_TOKEN_EXPIRES_IN/_UNIT) instead of relying on the plugin default.Why
Threat Model Remediation issue #324, Row 8 — "Enable CKAN token expiry". The
expire_api_tokenplugin exists but was disabled. Enabling it makesexpires_in/unitrequired at mint time; this sets them explicitly so the lifetime is a deliberate policy value rather than the implicit 3600s default.Coordinated changes
Merge order: this + helm PRs together, frontend before/with rollout.
Summary by CodeRabbit