Merge ~andersson123/autopkgtest-cloud:browse-cgi-api-key into autopkgtest-cloud:master

[Tim Andersson]

[Tim Andersson (andersson123)]

(Needs testing)

[Tim Andersson (andersson123)]

(Needs work first actually)

[Tim Andersson (andersson123)]

Testing this in staging rn

[Skia (hyask)]

Awesome to see that! Couple of inline comments, but nothing too big.

review: Needs Fixing

[Tim Andersson (andersson123)]

todo: add documentation on this

[Tim Andersson (andersson123)]

more todo:
- run api key check in constant time to avoid brute force
- decide on cookie name

[Tim Andersson (andersson123)]

rename the api key to X-Api-Key
use sha1 and hmac.compare_digest to compare the sha1's of the keys

[Skia (hyask)]

Taking a good shape! :-)

review: Needs Fixing

[Tim Andersson (andersson123)]

amended again, please re-review

[Skia (hyask)]

Last one!

review: Needs Fixing

[Tim Andersson (andersson123)]

Ah, good catch, ty, amended, please re-review

[Skia (hyask)]

Awesome!

review: Approve

diff --git a/charms/focal/autopkgtest-web/config.yaml b/charms/focal/autopkgtest-web/config.yaml
index 50606ac..8fcc1e5 100644
--- a/charms/focal/autopkgtest-web/config.yaml
+++ b/charms/focal/autopkgtest-web/config.yaml
@@ -16,6 +16,11 @@ options:
     default:
     description: "projectname → shared secret \
                   JSON mapping for github test requests"
+  external-web-requests-api-keys:
+    type: string
+    default:
+    description: "user/project → api key \
+                  JSON mapping for non-github automated test requests"
   github-status-credentials:
     type: string
     default:
diff --git a/charms/focal/autopkgtest-web/reactive/autopkgtest_web.py b/charms/focal/autopkgtest-web/reactive/autopkgtest_web.py
index c6e0533..e8b94c9 100644
--- a/charms/focal/autopkgtest-web/reactive/autopkgtest_web.py
+++ b/charms/focal/autopkgtest-web/reactive/autopkgtest_web.py
@@ -1,4 +1,5 @@
 import glob
+import json
 import os
 import pathlib
 import shutil
@@ -25,6 +26,7 @@ GITHUB_STATUS_CREDENTIALS_PATH = os.path.expanduser(
 SWIFT_WEB_CREDENTIALS_PATH = os.path.expanduser(
     "~ubuntu/swift-web-credentials.conf"
 )
+API_KEYS_PATH = "/home/ubuntu/external-web-requests-api-keys.json"
 
 PUBLIC_SWIFT_CREDS_PATH = os.path.expanduser("~ubuntu/public-swift-creds")
 
@@ -262,6 +264,23 @@ def write_github_secrets():
     status.maintenance("Done writing github secrets")
 
 
+@when_all(
+    "config.changed.external-web-requests-api-keys",
+    "config.set.external-web-requests-api-keys",
+)
+def write_api_keys():
+    status.maintenance("Writing api keys")
+    api_keys = config().get("external-web-requests-api-keys.json")
+    try:
+        _ = json.loads(api_keys)
+    except json.JSONDecodeError as e:
+        status.maintenance("api keys have invalid json format: %s" % api_keys)
+        raise e
+    with open(API_KEYS_PATH, "w") as f:
+        f.write(api_keys)
+    status.maintenance("api keys written")
+
+
 @when_not("config.set.github-secrets")
 def clear_github_secrets():
     status.maintenance("Clearing github secrets")
diff --git a/charms/focal/autopkgtest-web/webcontrol/request/app.py b/charms/focal/autopkgtest-web/webcontrol/request/app.py
index 23750e6..c58cf7f 100644
--- a/charms/focal/autopkgtest-web/webcontrol/request/app.py
+++ b/charms/focal/autopkgtest-web/webcontrol/request/app.py
@@ -3,6 +3,7 @@ import hmac
 import json
 import logging
 import os
+import pathlib
 from collections import ChainMap
 from html import escape as _escape
 
@@ -54,6 +55,21 @@ SUCCESS = """
 </dl>
 """
 
+# API keys is a json file like this:
+# {
+#     "user1": "user1s-apikey",
+#     "user2": "user2s-apikey",
+# }
+try:
+    API_KEYS = json.loads(
+        pathlib.Path(
+            "/home/ubuntu/external-web-requests-api-keys.json"
+        ).read_text()
+    )
+except Exception as e:
+    logging.warning("Failed to read API keys: %s", e)
+    API_KEYS = {}
+
 
 def check_github_sig(request):
     """Validate github signature of request.
@@ -134,6 +150,18 @@ def index_root():
     session.permanent = True
     session["next"] = maybe_escape(request.url)
     nick = maybe_escape(session.get("nickname"))
+    if "X-Api-Key" in request.cookies:
+        key_user, api_key = request.cookies.get("X-Api-Key").split(":")
+        request_creds_sha1 = hmac.new(
+            key_user.encode(), api_key.encode(), "sha1"
+        ).hexdigest()
+        for user, user_key in API_KEYS.items():
+            iter_creds_sha1 = hmac.new(
+                user.encode(), user_key.encode(), "sha1"
+            ).hexdigest()
+            if hmac.compare_digest(request_creds_sha1, iter_creds_sha1):
+                nick = key_user
+                session.update(nickname=key_user)
 
     params = {
         maybe_escape(k): maybe_escape(v) for k, v in request.args.items()
diff --git a/docs/administration.rst b/docs/administration.rst
index e29cf58..adb27b9 100644
--- a/docs/administration.rst
+++ b/docs/administration.rst
@@ -205,6 +205,18 @@ Once those steps are done then the rows can be deleted from the database.
 * ``sqlite3 -header -column autopkgtest.db "DELETE FROM test WHERE test.release='impish';"``
 * ``sqlite3 -header -column autopkgtest.db "vacuum;"``
 
+API Key Integration
+-------------------
+
+Requests can be requested by using an API key instead of authenticating using SSO.
+To do so, attach a cookie to whatever script is making the test request, with the name
+"X-Api-Key". The value should look like this:
+
+.. code-block::
+  user:api-key
+
+Where the user and api-key fields are provided by the Ubuntu Release Management team.
+
 
 Integration with GitHub and GitLab pull/merge requests
 ------------------------------------------------------
diff --git a/mojo/service-bundle b/mojo/service-bundle
index e6b6a1f..7946db1 100644
--- a/mojo/service-bundle
+++ b/mojo/service-bundle
@@ -199,6 +199,7 @@ applications:
             github-status-credentials: include-file://{{local_dir}}/github-status-credentials.txt
             swift-web-credentials: include-file://{{local_dir}}/swift-web-credentials.conf
             public-swift-creds: include-file://{{local_dir}}/public-swift-creds
+            external-web-requests-api-keys: include-file://{local_dir}}/external-web-requests-api-keys.json
             https-proxy: {{ https_proxy }}
             no-proxy: {{ no_proxy }}
             cookies: S0 S1