Skip to content
This repository was archived by the owner on May 20, 2025. It is now read-only.

Conversation

@richardhuaaa
Copy link
Contributor

(Merging into 'breaking' branch)

A faster, more secure, and simpler login process using the access-key as a bearer token with every request instead of exchanging it for a session identifier cookie. Also, a significant amount of simplifying refactoring work, especially to the SDK for future external consumption.

Additional SDK changes:

  1. Remove the concepts of 'logging in' and 'logging out' as the server now maintains no session state. The SDK is initialized with an access-key and that is sent with every request. Simply let the SDK object be garbage collected if you are done (and optionally delete the access-key on the server).
  2. Remove the 'ConnectionInfo' type and the concept of a base 64-encoded 'Access Token' from the SDK. The SDK should only care about the access-key, with the other stuff being CLI-specific.
  3. Use the 'Accept' header to indicate the desired server API version.
  4. Tidy up exposed public members and constructor interface.

Note that the external OAuth provider login/registration process is not currently covered in the SDK - the CLI has always independently launched an external browser session. I may do future investigative work to see if there are simplifications we can make here for external consumption.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you think about making this the default export?

@lostintangent
Copy link
Member

I deleted my two other comments since they're not necessary, but it would be cool if we made the AccountManager the default export. Other than that, this LGTM! Awesome job dude. This is so much cleaner than before :D

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With existing helper methods, you can simplify lines 518-523 to:

var decoded: string = tryBase64Decode(accessToken);
var connectionInfo: ILegacyLoginConnectionInfo|ILoginConnectionInfo = tryJSON(decoded);

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lines 878 and 883 can be deduplicated by moving after the if...else block. Might also be able to deduplicate the JSON.stringify(...) call like so:

var connectionInfo: IStandardLoginConnectionInfo | IAccessKeyLoginConnectionInfo = tryJSON(json);

if (connectionInfo) {
    connectionInfo.serverUrl = serverUrl;
} else {
    connectionInfo = { serverUrl: serverUrl, accessKey: accessToken };
}

json = JSON.stringify(connectionInfo);
fs.writeFileSync(configFilePath, json, { encoding: "utf8" });

@dtivel
Copy link
Member

dtivel commented Jan 14, 2016

Looks good.

1 similar comment
@shishirx34
Copy link
Contributor

Looks good.

@richardhuaaa
Copy link
Contributor Author

The default export thing is actually a surprisingly hard change to make considering that we need to handle exporting both TypeScript interfaces and a default JavaScript object, manage .d.ts generation, and handle inter-op between CommonJS and ES6. I've talked to Jonathan about this and I'll be doing this as part of a later PR to prepare the SDK for external usage.

richardhuaaa pushed a commit that referenced this pull request Jan 20, 2016
Cookieless header-based authentication
@richardhuaaa richardhuaaa merged commit 7b83bce into breaking Jan 20, 2016
@richardhuaaa richardhuaaa deleted the breaking-authentication-fix branch January 20, 2016 21:55
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants