[SQSERVICES-1885] [OAUTH] Scopes with regard to calendar integration by battermann · Pull Request #3046 · wireapp/wire-server

battermann · 2023-02-01T16:23:49Z

Checklist

Add a new entry in an appropriate subdirectory of changelog.d
Read and follow the PR guidelines

…ntation (#3039)

#3037) * charts: Mark all test resources to be only created while running tests * Use patched helm to ensure it doesn't try to get logs of configmaps * ciImage,devSetup: Add awk * ciImage: Add cfssl

Co-authored-by: Sebastian Willenborg <sebastian.willenborg@wire.com>

Add security response about wire.com DoS and HTML injection

* change helm hook type of test resources which are not Pods * changelog adjustment

- change liveness and readyness probes to start querying more quickly to see if cassandra is up. Instead of 90 - 120 seconds, if cassandra is up earlier that should manifest itself in the setup time of 'make kube-integration-setup' - change helmfile for wire-server to wait for databases-ephemeral to be up before launching pods: cassandra-migration needs to have a working cassandra anyway - the crashloop-backoff strategy leads to a lot of waiting in between restarts; so it should be faster to wait for cassandra to be up before attempting schema migrations

example case where this test failed: https://concourse.ops.zinfra.io/teams/main/pipelines/staging/jobs/test/builds/342 output of failing test: ``` metrics prometheus: OK (0.02s) work: FAIL (1.06s) Error message: /login was called twice expected: 2 but got: 3 CallStack (from HasCallStack): assertFailure, called at ./Test/Tasty/HUnit/Orig.hs:86:32 in tasty-hunit-0.10.0.3-KJER1RJhmod6e0raY4U8z6:Test.Tasty.HUnit.Orig assertEqual, called at test/integration/API/Metrics.hs:78:12 in main:API.Metrics Use -p '(!/turn/&&!/user.auth.cookies.limit/)&&/metrics.work/' to rerun this test only. ```

…#3045) * Extend the docs on the federation error type

* Test helper SQSWatcher: use purgeQueue The previous logic of emptying the queue by reading all messages and deleting them assumes there is no other process writing anything into the queue, which might not be the case (in case of parallel brig/galley/spar tests). Instead, use purgeQueue to empty the queue, which should be faster and more reliable. * Hi CI

… to flaky tests) for parallel helm test executions. (#3040) 1. Allow running helm tests in parallel if desired, using `HELM_PARALLELISM=6` (disabled for now until we have fixed some flaky tests which fail more often when tests run in parallel) 2. rework integration test output: logs from test runs will only show if there are any failed tests. Also, the bottom of the output will have a summary of what failed and what didn't; as well as only the failed test lines with a context of +- 10 lines. This should hopefully make it easier to see what went wrong: just scroll to the bottom. The summary looks like this: ``` === tail cargohold: === All 21 tests passed (8.45s) === tail gundeck: === All 33 tests passed (56.60s) === tail federator: === Finished in 0.6576 seconds 9 examples, 0 failures === tail spar: === Finished in 397.2779 seconds 553 examples, 0 failures, 65 pending === tail brig: === 2 out of 449 tests failed (123.07s) === tail galley: === 1 out of 414 tests failed (136.33s) cargohold-integration passed ✅. gundeck-integration passed ✅. federator-integration passed ✅. spar-integration passed ✅. brig-integration FAILED ❌. pfff... galley-integration FAILED ❌. pfff... Tests failed. ```

naming

…-integration' of github.com:wireapp/wire-server into SQSERVICES-1885-be-oauth-scopes-with-regard-to-calendar-integration

fisx · 2023-02-08T08:39:52Z

.gitignore

+services/nginz/third_party/headers-more-nginx-module
+services/nginz/third_party/nginx-module-vts


Suggested change

services/nginz/third_party/headers-more-nginx-module

services/nginz/third_party/nginx-module-vts

/services/nginz/third_party/headers-more-nginx-module

/services/nginz/third_party/nginx-module-vts

fisx · 2023-02-08T08:40:40Z

Makefile

 nginx-ingress-controller nginx-ingress-services reaper sftd restund coturn		\
 inbucket k8ssandra-test-cluster
 KIND_CLUSTER_NAME     := wire-server
+HELM_PARALLELISM      ?= 1 # 1 for sequential tests; 6 for all-parallel tests


I think that should go to a separate PR, no?

fisx · 2023-02-08T08:41:26Z

changelog.d/5-internal/deflake-metrics

@@ -0,0 +1 @@
+Deflake integration test: metrics


same here. am i reading the wrong diff?

fisx

not saying this is done, but the new develop-merge into the sub-PR messes with the diff, and also i'm generally confuseda about the state of things. we should probably wrap it up here and move back to #2989?

fisx · 2023-02-08T08:52:06Z

libs/wire-api/src/Wire/API/Routes/Public.hs

+          }
+
+      addScopeDescription :: Swagger -> Swagger
+      addScopeDescription = allOperations . description %~ Just . (<> "OAuth scope(s): " <> showOAuthScopeList @scopes) . fold


swagger: scopes are there (cool!), but the other security information is not visible in swagger-ui, or at least i can't find it. also, it's not even converted completely into swagger.json, or am i reading this wrong?

smatting and others added 5 commits January 31, 2023 12:09

Fix flaky tests, add debugging to others (#3041)

fa2bdda

Streamline team feature ExposeInvitationURLsToTeamAdminConfig impleme…

f959352

…ntation (#3039)

charts: Mark all test resources to be only created while running tests (

0a8d0a4

#3037) * charts: Mark all test resources to be only created while running tests * Use patched helm to ensure it doesn't try to get logs of configmaps * ciImage,devSetup: Add awk * ciImage: Add cfssl

Update searchability documentation (#3044)

17b6e3a

play with hasserver instance

a54578a

zebot added the ok-to-test Approved for running tests in CI, overrides not-ok-to-test if both labels exist label Feb 1, 2023

sanojwr and others added 23 commits February 1, 2023 17:32

Add security response about wire.com DoS and HTML injection

b30fe2d

Update docs/src/security-responses/2023-01-19_html_injection.md

3373794

Co-authored-by: Sebastian Willenborg <sebastian.willenborg@wire.com>

Update docs/src/security-responses/2023-01-19_html_injection.md

d01cbb2

Co-authored-by: Sebastian Willenborg <sebastian.willenborg@wire.com>

Merge pull request #3050 from wireapp/sanojwr/security_responses

15cfd83

Add security response about wire.com DoS and HTML injection

.gitignore: Add third party modules of nginz

e8408bf

...

70aa9a7

...

afdbe5c

...

d58d78a

...

5087280

...

a721f44

spar tests deflake: do an ES refresh, not reindex (#3048)

633cfae

Helm hook type (#3049)

443f741

* change helm hook type of test resources which are not Pods * changelog adjustment

WIP: attempt to use checkType in OAuth logic

6ac782b

...

58b2955

[FS-1075] Extend the Swagger documentation for federation error types (…

be524fa

…#3045) * Extend the docs on the federation error type

wip

e7724d7

clean up

3d7d9b2

more clear comments

95dde99

clean up

e4b69e8

naming

battermann force-pushed the SQSERVICES-1885-be-oauth-scopes-with-regard-to-calendar-integration branch from 0ecb2ed to e4b69e8 Compare February 3, 2023 10:35

battermann and others added 13 commits February 6, 2023 08:09

Merge branch 'SQSERVICES-1885-be-oauth-scopes-with-regard-to-calendar…

1a6e02a

…-integration' of github.com:wireapp/wire-server into SQSERVICES-1885-be-oauth-scopes-with-regard-to-calendar-integration

support lenient, optional zoauth combinators.

3407a2f

Merge branch 'SQSERVICES-1885-be-oauth-scopes-with-regard-to-calendar…

d7be8cc

…-integration' of github.com:wireapp/wire-server into SQSERVICES-1885-be-oauth-scopes-with-regard-to-calendar-integration

Fixup

fea0a27

make oauth work with swagger

8ad2b3f

show scope(s) for each endpoint in swagger

15015d0

Merge branch 'SQSERVICES-1885-be-oauth-scopes-with-regard-to-calendar…

4eece1d

…-integration' of github.com:wireapp/wire-server into SQSERVICES-1885-be-oauth-scopes-with-regard-to-calendar-integration

fix

8192d7e

fix 2

0003255

grammar

a9f4d3e

make JWK available in galley

389fa39

oauth access to conversation create works

fa47d21

jwk effect shared

26e75c5

battermann force-pushed the SQSERVICES-1885-be-oauth-scopes-with-regard-to-calendar-integration branch from c992bb4 to c666e69 Compare February 7, 2023 13:26

battermann added 2 commits February 7, 2023 13:45

generated local nix packages

54a7cb2

setup config for secret for staging

501a96f

battermann force-pushed the SQSERVICES-1885-be-oauth-scopes-with-regard-to-calendar-integration branch from c666e69 to 501a96f Compare February 7, 2023 13:51

battermann added 4 commits February 7, 2023 14:22

fix tests

62da199

enable oauth for post conversations

87e6dd8

renaming

9d5f5e3

fix

737ba2b

fisx reviewed Feb 8, 2023

View reviewed changes

fisx approved these changes Feb 8, 2023

View reviewed changes

battermann added 4 commits February 8, 2023 09:23

oauth scope for feature-configs

8d61c29

wip

5047395

clean up

fdff6a6

update comment

0c14cca

battermann merged commit a58362e into SQSERVICES-1825-be-oauth-refresh-token-generation Feb 8, 2023

battermann deleted the SQSERVICES-1885-be-oauth-scopes-with-regard-to-calendar-integration branch February 8, 2023 10:46

battermann mentioned this pull request Feb 8, 2023

OAuth #2989

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

[SQSERVICES-1885] [OAUTH] Scopes with regard to calendar integration#3046

[SQSERVICES-1885] [OAUTH] Scopes with regard to calendar integration#3046
battermann merged 62 commits intoSQSERVICES-1825-be-oauth-refresh-token-generationfrom
SQSERVICES-1885-be-oauth-scopes-with-regard-to-calendar-integration

battermann commented Feb 1, 2023

Uh oh!

fisx Feb 8, 2023

Uh oh!

fisx Feb 8, 2023

Uh oh!

fisx Feb 8, 2023

Uh oh!

fisx left a comment

Uh oh!

fisx Feb 8, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

		services/nginz/third_party/headers-more-nginx-module
		services/nginz/third_party/nginx-module-vts

Comments

Conversation

battermann commented Feb 1, 2023

Checklist

Uh oh!

fisx Feb 8, 2023

Choose a reason for hiding this comment

Uh oh!

fisx Feb 8, 2023

Choose a reason for hiding this comment

Uh oh!

fisx Feb 8, 2023

Choose a reason for hiding this comment

Uh oh!

fisx left a comment

Choose a reason for hiding this comment

Uh oh!

fisx Feb 8, 2023

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants