Repository navigation
feat: Issue CSP temporary credentials from the user menu, require tokens on API proxy routes - #114
Merged
Merged
Conversation
- ProxyAuthMiddleware 추가: IAM 모드는 mc-iam-manager /api/auth/certs(JWKS)로 RS256 서명·만료 검증, 로컬 모드는 HS256+세션 검증 - 프록시(/api/:subsystem/:operationId), /api/admin, disklookup, getapihosts, async-requests, /api/test/* 에 적용 - Authorization 헤더는 Bearer와 토큰 원문(front ApiCaller 형식) 모두 허용 - README에 API(3000)가 공개 API이며 모든 라우트에 access_token이 필요함을 명시
fix: API 서브시스템 프록시·BFF 라우트 보완
- Add "Get CSP Credential" to the Node / NodeGroup node detail. It issues temporary credentials for the node's CSP (provider, region) through mc-iam-manager POST /api/workspaces/temporary-credentials with the logged-in user's token (new api.yaml action GetTemporaryCredentials). - Show the result in a shared secret modal: values masked by default, Show/Hide, per-field Copy, "Copy as environment variables" (AWS, GCP, Alibaba, Tencent), expiration and time left, scope notice (CSP role mapped to the workspace role, not the node) and a possible-account-mismatch notice. 403 "no CSP role mapping" is shown as an actionable message. - Fix the Keypair badge: it called a non-existent infra_api.getsshkey; use sshkey_api.get and the shared modal (masked, Copy, "Not available"). - commonAPIPost: add `sensitive` (do not log request/response bodies) and `silentErrors` (caller shows every HTTP error itself) options. - Secrets live only in modal memory, are cleared on close, and late responses after close are ignored.
- Mask by kind: identifiers show the first/last 4 characters
(e.g. ASIA••••••••WXYZ, fully masked when 8 characters or fewer), secrets
show only their length ("•••••• (N chars)"), PEM private keys show the
header line plus length.
- Per-field Show/Hide next to Copy, plus a consistent Show all / Hide all.
- Keep rows for expected fields without a value as "Not provided" with Copy
and Show disabled. Expected fields are defined per CSP (AWS, Alibaba,
Tencent, GCP); fields of other CSPs are not shown. Keypair shows Private
Key, Public Key and Username.
…ce role - Determine issuable CSPs from my workspace role (GET /api/users/me/workspace-roles, new api.yaml action GetMyWorkspaceRoles) and its CSP role mappings (Getrolescsproles): status "created" with IdP and IAM identifiers set. - Show the CSP Credential row on Node / NodeGroup detail only when the node's provider is in that set; hide it while loading, on lookup failure or when no role is found. - Cache the result per workspace (re-queried when the workspace changes); failures are not cached. Lookups use sensitive / silentErrors / no loader. - This is a "configured" check, not a guarantee; errors after clicking are still shown in the modal. To be replaced when the IAM readiness API lands.
…odal
Temporary credentials are issued for the CSP role mapped to the user's role
in the current workspace, not for a node, so the entry point moves from the
node detail to the navbar user menu ("CSP Credentials").
- Request step: shows the current workspace and the user's console role
(the mapped CSP role is not shown; it is managed in role management),
lists only CSPs mapped for that role, and a region picker built from
connection configs (region is required; AWS AssumeRole fails without it).
- Result step in the same modal: expiration, time left and one block of
CLI/SDK environment variables per CSP, hidden by default, with Show/Hide,
Copy (actual values) and Back. Values are cleared when the modal closes.
- Separate from the keypair modal (#secretModal), which stays on the
Infra Workloads page for SSH keys.
- Remove the node detail "Get CSP Credential" row and its visibility logic.
- csp_credential_api: getCspCredentialAccess returns the user's workspace
role names and issuable CSP types.
feat: 사용자 메뉴에서 CSP 임시 자격 증명(STS) 발급 + Node 상세 Keypair 모달 수정
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's Changed
CSP Credentials — issue temporary credentials from the user menu
Temporary credentials are issued for the CSP role mapped to the user's role in the current workspace (direct assignment first, then group). Because this does not depend on a node, the entry point is the navbar user menu: CSP Credentials.
GET /api/users/me/workspace-roles→GET /api/roles/csp-roles/id/{roleId},status=createdwith IdP/IAM identifiers set). Region is required (AWS AssumeRole fails without it); the choices come from the connection configs of the selected CSP, andap-northeast-2is the default when availableAWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_SESSION_TOKEN,AWS_DEFAULT_REGION; Alibaba, Tencent and GCP equivalents). Values are hidden by default; Show/Hide, Copy (copies the actual values) and Back are available. Values live only in memory and are cleared when the modal closesconf/api.yaml:GetTemporaryCredentials(POST /api/workspaces/temporary-credentials) andGetMyWorkspaceRoles(GET /api/users/me/workspace-roles)commonAPIPostoptions:sensitive(request/response bodies are not logged) andsilentErrors(the caller shows every HTTP error itself)Node detail — Keypair badge
The Keypair badge on the Node / NodeGroup detail called a function that does not exist (
infra_api.getsshkey), so nothing happened. It now usessshkey_api.getand a secret modal: the private key is hidden (PEM header and length only), with Show/Hide and Copy.API proxy and BFF routes — token verification
ProxyAuthMiddleware. WithMC_WEB_CONSOLE_USE_IAM=true, it verifies the RS256 signature and expiry with mc-iam-manager JWKS (/api/auth/certs; public keys cached bykid, an unknownkidis re-fetched at most every 30 seconds). Withfalse, it keeps the existing HS256 + DB session checkAuthorization: Bearer <token>and the raw token (the format the front ApiCaller sends).roleis not set in the context, so how the proxy choosesx-credential-holderdoes not change/api/auth/login, and every route requires a tokenRequires mc-iam-manager 0.7.1 or later (
/api/users/me/workspace-roles,/api/workspaces/temporary-credentials). mc-admin-cli mounts its own copy of the web APIconf/; the new service actions are in MZC-CSC/mc-admin-cli#106 (restart mc-web-console-api after applying).