hypothesis / h
70%
master: 97%

LAST BUILD BRANCH: realtime-update-v1-h-only-1
DEFAULT BRANCH: master
Repo Added
Files 34
Badge
Embed â–¾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH BPA1eZ9O-add-developer-api-tokens
branch: BPA1eZ9O-add-developer-api-tokens
CHANGE BRANCH
x

10259

push

travis-ci

seanh 
Add simple, long-lived API tokens

Add a /profile/developer/ page where users can generate and re-generate
their API token. This token can be used as a Bearer token in the
Authorization header in API requests instead of using one of the more
complex and short-lived JWT tokens that the client uses to authenticate
API requests.

The tokens are just randomly generated opaque strings, each one
associated with one user account. There's 0 or 1 token per user, and the
user can regenerate their token at any time. The tokens are stored in a
`token` table in the db that just maps token values to userids.

Notes:

- Our authentication policy now calls the new API token validator first
  for API requests. If this validator does not accept the token, then it
  passes it to the legacy JWT validator (which is still used by our
  client).

  The idea is that if we add more types of API token in the future, the
  authentication policy will have a list of different validator
  functions for different token types, and will try each validator in
  turn until either one of them accepts the token or it runs out of
  validators.

  The use of a type prefix string at the beginning of tokens means that
  validators can usually reject tokens without a db lookup, so we won't
  end up with one db lookup per validator.

- The new tokens always start with u"6879-". If a token sent by a user
  doesn't start with this prefix then the token validator can reject it
  out of hand, without doing a database lookup.

  An opaque number is used for this prefix because we want users to
  treat API tokens as opaque, rather than using a human-readable prefix
  that makes it obvious what type of token you're looking at. (But the type
  of the token is not "secret" in any real sense.)

  In the future it's intended that we'll have different types of tokens
  identified by different prefixes, and different types of token might
  (for example) give access to different capabilities.

- The legacy ... (continued)

2740 of 3896 relevant lines covered (70.33%)

0.7 hits per line

Relevant lines Covered
3896 RELEVANT LINES 2740 COVERED LINES
0.7 HITS PER LINE
Source Files on BPA1eZ9O-add-developer-api-tokens
Detailed source file information is not available for this build.

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
10259 BPA1eZ9O-add-developer-api-tokens Add simple, long-lived API tokens Add a /profile/developer/ page where users can generate and re-generate their API token. This token can be used as a Bearer token in the Authorization header in API requests instead of using one of the more compl... push seanh travis-ci pending completion  
10255 BPA1eZ9O-add-developer-api-tokens Add simple, long-lived API tokens Add a /profile/developer/ page where users can generate and re-generate their API token. This token can be used as a Bearer token in the Authorization header in API requests instead of using one of the more compl... push seanh travis-ci pending completion  
10253 BPA1eZ9O-add-developer-api-tokens Add simple, long-lived API tokens Add a /profile/developer/ page where users can generate and re-generate their API token. This token can be used as a Bearer token in the Authorization header in API requests instead of using one of the more compl... push seanh travis-ci pending completion  
10251 BPA1eZ9O-add-developer-api-tokens Add simple, long-lived API tokens Add a /profile/developer/ page where users can generate and re-generate their API token. This token can be used as a Bearer token in the Authorization header in API requests instead of using one of the more compl... push seanh travis-ci pending completion  
10249 BPA1eZ9O-add-developer-api-tokens Add simple, long-lived API tokens Add a /profile/developer/ page where users can generate and re-generate their API token. This token can be used as a Bearer token in the Authorization header in API requests instead of using one of the more compl... push seanh travis-ci pending completion  
10247 BPA1eZ9O-add-developer-api-tokens Add simple, long-lived API tokens Add a /profile/developer/ page where users can generate and re-generate their API token. This token can be used as a Bearer token in the Authorization header in API requests instead of using one of the more compl... push seanh travis-ci pending completion  
10242 BPA1eZ9O-add-developer-api-tokens DB migration push seanh travis-ci pending completion  
10241 BPA1eZ9O-add-developer-api-tokens Add created and updated to Token model push seanh travis-ci pending completion  
10238 BPA1eZ9O-add-developer-api-tokens Rename generate_bearer_token() -> generate_jwt() push seanh travis-ci pending completion  
10237 BPA1eZ9O-add-developer-api-tokens Make all API tokens require "Bearer " prefix And strip "Bearer " prefix in auth policy, not in h.api.auth. - userid_from_bearer_token() -> userid_from_jwt(), and accepts token as first param instead of reading it from Authorization header. - ... push seanh travis-ci pending completion  
See All Builds (3935)