Skip to content
This repository was archived by the owner on Sep 30, 2024. It is now read-only.

feat/dotcom: add Enterprise Portal auth proxy#63652

Merged
bobheadxi merged 8 commits into
mainfrom
07-04-feat_dotcom_add_enterprise_portal_proxy
Jul 9, 2024
Merged

feat/dotcom: add Enterprise Portal auth proxy#63652
bobheadxi merged 8 commits into
mainfrom
07-04-feat_dotcom_add_enterprise_portal_proxy

Conversation

@bobheadxi

@bobheadxi bobheadxi commented Jul 4, 2024

Copy link
Copy Markdown
Member

Part of https://linear.app/sourcegraph/issue/CORE-211

This introduces authenticated proxies that allow dotcom site admins access to dev and production Enterprise Portal instances, authenticated with client credentials issued to the dotcom instance. The medium-term goal is to use this proxy so that we can use the existing subscriptions UI, backed by the new Enteprise Portal deployments (e.g. https://github.com/sourcegraph/sourcegraph/pull/63653, tracking issue: https://linear.app/sourcegraph/issue/CORE-100/enterprise-portal-migrate-away-from-dotcom-db-as-source-of-truth), until we have a dedicated UI for Enterprise Portal (https://linear.app/sourcegraph/project/kr-p-enterprise-portal-user-interface-dadd5ff28bd8)

This is required until we ship https://linear.app/sourcegraph/project/kr-p1-streamlined-role-assignment-via-sams-and-entitle-2f118b3f9d4c/overview, which will allow SAMS to be the source-of-truth for who is a site admin in Sourcegraph.com. Once we have that information, we can use the user's SAMS session directly in Enterprise Portal to authorize access to Enterprise Portal data.

Test plan

Set up dev-private with dev credentials: https://github.com/sourcegraph/dev-private/pull/101

sg start dotcom, create a personal access token, and try to make ConnectRPC requests matching the spec to the new endpoints:

# Local
curl --header "Content-Type: application/json" --header "authorization: token sgp_local_..." --data '{"filters":[{"filter":{"is_archived":false}}]}' -v  \
    https://sourcegraph.test:3443/.api/enterpriseportal/local/enterpriseportal.subscriptions.v1.SubscriptionsService/ListEnterpriseSubscriptions
# Dev
curl --header "Content-Type: application/json" --header "authorization: token sgp_local_..." --data '{"filters":[{"filter":{"is_archived":false}}]}' -v  \
    https://sourcegraph.test:3443/.api/enterpriseportal/dev/enterpriseportal.subscriptions.v1.SubscriptionsService/ListEnterpriseSubscriptions

Note that the URL path after /.api/enterpriseportal/dev/, i.e. /enterpriseportal.subscriptions.v1.SubscriptionsService/ListEnterpriseSubscriptions, and the shape of the parameters, are all the same as if you curl'd the Enterprise Portal API directly, per the Connect protocol: https://connectrpc.com/docs/protocol/

Both local and dev reach out to the existing SAMS dev deployment for credentials, so the dev-private credentials work OOTB for both.

@cla-bot cla-bot Bot added the cla-signed label Jul 4, 2024

Copy link
Copy Markdown
Member Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @bobheadxi and the rest of your teammates on Graphite Graphite

Comment on lines 121 to 155

Check notice

Code scanning / Semgrep OSS

Semgrep Finding: security-semgrep-rules.semgrep-rules.generic.comment-tagging-rule

Code that highlight SECURITY in comment has changed. Please review the code for changes. The changes might be sensitive.
@bobheadxi bobheadxi force-pushed the 07-04-feat_dotcom_add_enterprise_portal_proxy branch 4 times, most recently from ec1affc to e924bdb Compare July 5, 2024 19:11
@bobheadxi bobheadxi changed the title feat/dotcom: add Enterprise Portal proxy feat/dotcom: add Enterprise Portal auth proxy Jul 5, 2024
@bobheadxi bobheadxi force-pushed the 07-04-feat_dotcom_add_enterprise_portal_proxy branch from b780497 to 68e4937 Compare July 5, 2024 22:45
@bobheadxi bobheadxi marked this pull request as ready for review July 5, 2024 22:50
@bobheadxi bobheadxi requested review from a team, andreeleuterio and evict July 5, 2024 22:50
@bobheadxi bobheadxi force-pushed the 07-04-feat_dotcom_add_enterprise_portal_proxy branch from b28ad2a to 6f62c8a Compare July 8, 2024 19:09
@bobheadxi bobheadxi force-pushed the 07-04-feat_dotcom_add_enterprise_portal_proxy branch from 82ec79f to dd04155 Compare July 9, 2024 01:34
Co-authored-by: Andre Eleuterio <andreeleuterio@users.noreply.github.com>
Comment thread cmd/frontend/internal/enterpriseportal/enterpriseportal_proxy.go Outdated
@bobheadxi bobheadxi merged commit d7ab268 into main Jul 9, 2024
@bobheadxi bobheadxi deleted the 07-04-feat_dotcom_add_enterprise_portal_proxy branch July 9, 2024 20:47
bobheadxi referenced this pull request Jul 10, 2024
Closes https://linear.app/sourcegraph/issue/CORE-211

See https://linear.app/sourcegraph/issue/CORE-100 for a higher-level
view - this is the first proof-of-concept for achieving our migration
strategy to extract Enterprise subscription data out of dotcom while
retaining the existing UI until a future project ships a dedicated
Enterprise Portal UI
(https://linear.app/sourcegraph/project/kr-p-enterprise-portal-user-interface-dadd5ff28bd8).

The integration uses generated ConnectRPC client code + `react-query`,
the latter of which has already been used elsewhere for SSC
integrations. This is partly supported by
https://github.com/connectrpc/connect-query-es which offers
mostly-first-class integration with `react-query`, but I had to do some
fenangling to provide the query clients directly as I can't get the
React provider thing to work. The ConnectRPC clients point to the
proxies introduced in
https://github.com/sourcegraph/sourcegraph/pull/63652 which
authenticates the requests for Enterprise Portal, until we ship
https://linear.app/sourcegraph/project/kr-p1-streamlined-role-assignment-via-sams-and-entitle-2f118b3f9d4c/overview

## Test plan

### Local

First, `sg start dotcom`

Choose a subscription you have locally. Use `psql -d sourcegraph` to
connect to local database, then:

```
sourcegraph=# delete from product_licenses where product_subscription_id = '<local subscription ID>';
DELETE 1
sourcegraph=# update product_subscriptions set id = '58b95c21-c2d0-4b4b-8b15-bf1b926d3557' where id = '<local subscription ID>';
UPDATE 1
```

Now annoyingly the UI will break because there is no license, we need:

```gql
query getGraphQLID {
  dotcom {
    productSubscription(uuid:"58b95c21-c2d0-4b4b-8b15-bf1b926d3557") {
      id # graphQL ID
    }
  }
}

mutation createLicense {
  dotcom {
    generateProductLicenseForSubscription(productSubscriptionID:"<graphQLID>", license:{
      tags:["dev"]
      userCount:100
      expiresAt:1814815397
    }) {
      id
    }
  }
}
```

This effectively lets us have a "pretend S2" subscription locally.
Visiting the subscription page now at
https://sourcegraph.test:3443/site-admin/dotcom/product/subscriptions/58b95c21-c2d0-4b4b-8b15-bf1b926d3557


![image](https://github.com/sourcegraph/sourcegraph/assets/23356519/1e77d77d-8032-436b-ab1d-393b34e8e4b5)

The data matches the "real" data currently at
https://sourcegraph.com/site-admin/dotcom/product/subscriptions/58b95c21-c2d0-4b4b-8b15-bf1b926d3557

### Against dotcom

```
sg start web-standalone
```

follow
https://www.loom.com/share/6cb3b3ca475b4b9392aa4b11938e76e6?sid=6cd1a689-d75d-4133-bcff-b0c7d25b23f1
and then check out some product subscriptions
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants