Code

[WIP] API Key auth#9869

Code

Closed

kevinansfield wants to merge 38 commits intomasterTryGhost/Ghost:masterfrom api-key-authTryGhost/Ghost:api-key-authCopy head branch name to clipboard

+2,887-159

Commits

Commits on Sep 25, 2018

• integrations & api_keys tables, and 'Admin API Client' role migration

  kevinansfield

  committed
  9770439

  Copy full SHA for 9770439

• bump secret column length for hex-formatted 512bit secrets

  kevinansfield

  committed
  cf26130

  Copy full SHA for cf26130

• fix integrity spec

  kevinansfield

  committed
  437e895

  Copy full SHA for 437e895

• add empty integration and api-key models

  kevinansfield

  committed
  96479d2

  Copy full SHA for 96479d2

• role_id should be nullable for Content API keys

  kevinansfield

  committed
  25aa68c

  Copy full SHA for 25aa68c

• secret min-length should be 128 chars

  kevinansfield

  committed
  7de9115

  Copy full SHA for 7de9115

• generate secret by default when adding an API Key

  kevinansfield

  committed
  7c2b2d8

  Copy full SHA for 7c2b2d8

• match column lengths to match #7932

  kevinansfield

  committed
  4078318

  Copy full SHA for 4078318

• enforce Administrator/null roles for admin/content api keys

  kevinansfield

  committed
  7f05458

  Copy full SHA for 7f05458

• add jsonwebtoken dependency

  kevinansfield

  committed
  bbe8ec0

  Copy full SHA for bbe8ec0

• cleanup unused requires in unit/models/api_key_spec

  kevinansfield

  committed
  34fa0e4

  Copy full SHA for 34fa0e4

• WIP: API key authentication middleware

  kevinansfield

  committed
  02b450b

  Copy full SHA for 02b450b

• default to Admin API Client role for admin keys not Administrator

  kevinansfield

  committed
  63651e0

  Copy full SHA for 63651e0

• fixed unreachable error mismatched API Key type

  kevinansfield

  committed
  8069fb4

  Copy full SHA for 8069fb4

• explicit error messages for admin auth

  kevinansfield

  committed
  3274771

  Copy full SHA for 3274771

• stub api-key auth middleware tests

  kevinansfield

  committed
  20d092a

  Copy full SHA for 20d092a

• remove accidentally committed file

  kevinansfield

  committed
  625af71

  Copy full SHA for 625af71

• fixed require paths in unit tests

  kevinansfield

  committed
  33091f6

  Copy full SHA for 33091f6

• remove eslint TODO

  kevinansfield

  committed
  e6cdccd

  Copy full SHA for e6cdccd

• get api_key id from decoded token, use buffer for secret, verify audience claim

  kevinansfield

  committed
  2de7df4

  Copy full SHA for 2de7df4

• admin key auth specs

  kevinansfield

  committed
  58918e1

  Copy full SHA for 58918e1

• use valid hex value in tests

  kevinansfield

  committed
  009c39b

  Copy full SHA for 009c39b

• remove key ID from content auth query param

  kevinansfield

  committed
  4f33d8e

  Copy full SHA for 4f33d8e

• start wiring up client auth for new v2 admin endpoints

  kevinansfield

  committed
  f1c8272

  Copy full SHA for f1c8272

• WIP: adapt posts route tests for v2 Admin API w/client auth

  kevinansfield

  committed
  81a869c

  Copy full SHA for 81a869c

• finish setup for running route tests

  kevinansfield

  committed
  84b21aa

  Copy full SHA for 84b21aa

• add apiKey to permissions providers

  kevinansfield

  committed
  78d8f4a

  Copy full SHA for 78d8f4a

• add some todos for dealing with api key requests vs user requests

  kevinansfield

  committed
  b03eddb

  Copy full SHA for b03eddb

• wire up can-this and permissible functions for context.api_key

  kevinansfield

  committed
  79f0665

  Copy full SHA for 79f0665

• return 422 BadRequestError for invalid JWT instead of 500

  kevinansfield

  committed
  b08fb1f

  Copy full SHA for b08fb1f

• stick to common.errors.* rather than destructuring

  kevinansfield

  committed
  ad6467e

  Copy full SHA for ad6467e

• fixed incorrect response code in invalid accesstoken request

  kevinansfield

  committed
  4f60c22

  Copy full SHA for 4f60c22

• API Key requests must specify post authors

  kevinansfield

  committed
  aa52860

  Copy full SHA for aa52860

• replace API with Api in method names for consistency

  kevinansfield

  committed
  5621483

  Copy full SHA for 5621483

• fix post.permissible tests

  kevinansfield

  committed
  14007d0

  Copy full SHA for 14007d0

• fix handlePublicPermissions tests

  kevinansfield

  committed
  6036f09

  Copy full SHA for 6036f09

• fix user.permissible tests

  kevinansfield

  committed
  66f16f8

  Copy full SHA for 66f16f8

• send invites as owner if added via an admin api key

  kevinansfield

  committed
  f63963d

  Copy full SHA for f63963d