1375492 - Only reset the root accessToken if the env var is present

Status: RESOLVED WONTFIX

(Taskcluster :: Services, enhancement)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

Currently, this accessToken is reset on every auth startup, which means that the value must be present in the heroku config.  But it is only useful on initial install of the service, which happened long, long ago.  Removing it from the heroku config would be one less place this very powerful credential appears.

Comment 1

[Shreya]

Hi! could you provide more info about this issue?

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

Sure -- the service in question is https://github.com/taskcluster/taskcluster-auth

At https://github.com/taskcluster/taskcluster-auth/blob/44dc61eafc3454c145ec45b5b3201a76b4d2589f/config.yml#L23 it defines a rootAccessToken.  This is important the *first* time the service starts up, as it's the only way to start creating other clients.  But the current implementation sets the accessToken for the "root" client every time it starts up.

So the work to do on this bug is to change the implementation so that it only uses this configuration value if the "root" client doesn't already exist.

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

Before you get started, though, please finish up bug 1303225.  We have a lot of applicants looking for bugs to work on, so I want to make sure we distribute them fairly!

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

Oh, sorry, I totally mixed that up.  Yes, please go ahead with this bug! :)

Comment 5

[Shreya]

great:)

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

Shreya, how is this going?

Comment 7

[Shreya]

Hi, yarn test stills gives an error

~/Desktop/taskcluster-auth$ yarn test
yarn run v1.5.1
$ yarn lint
$ eslint src/*.js test/*.js
$ mocha test/*_test.js
Skip tests for due to missing pulse credentials; create user-config.yml
error An unexpected error occurred: "Command failed.
Exit code: 1
Command: sh
Arguments: -c mocha test/*_test.js
Directory: /home/shweta/Desktop/taskcluster-auth
Output:
".
info If you think this is a bug, please open a bug report with the information provided in "/home/shweta/Desktop/taskcluster-auth/yarn-error.log".
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

Comment 8

[Dustin J. Mitchell [:dustin] (he/him)]

Hm, this service is particularly difficult to get the tests running for.  Do you want to work on bug 1443015 instead?  It's still about testing, but doesn't require getting the auth tests running :)

Comment 9

[Dustin J. Mitchell [:dustin] (he/him)]

This is going to end up getting replaced with static clients, which should always enforce.  So I don't think this needs to be done anymore!