1430801 - Check that the client creator resets expiry when resetting the access token

Status: RESOLVED FIXED

(Taskcluster :: UI, enhancement)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

I suspect that right now we only reset the access token on a client, and don't extend its expiry.  Thus we might reset an access token on an expired client.

Comment 1

[Aki Sasaki (not active)]

Semi-related, I don't think the "Delete on Expiration" checkbox does what it says it does :)

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

It *should* work:

  handleResetAccessToken = async () => {
    this.setState({ loading: true }, async () => {
      try {
        const description =
          this.state.query.description ||
          `Client created ${new Date()} for ${this.state.query.callback_url}`;
        const scopes = toArray(this.state.query.scope);

        await this.props.auth.updateClient(this.state.client.clientId, {
          description,
          expires: fromNow(this.state.query.expires || '3 days'),
          scopes: scopeIntersection(this.state.client.scopes, scopes),
          deleteOnExpiration: true
        });

        const client = await this.props.auth.resetAccessToken(
          this.state.client.clientId
        );

I can see lots of clients that have not been deleted, though.  In fact, the Auth service does not have the Scheduler add-on enabled.  I wonder if that got deleted somehow??

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

I ran the purgeExpiredClients task. It needs a little attention to make sure it terminates, but it worked.

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

I can confirm the expiration and scopes are updated when "reset access token" is clicked.

Comment 5

[Dustin J. Mitchell [:dustin] (he/him)]

Hm, maybe scopes aren't updated?

dustin@jemison ~ $ ~/go/src/github.com/taskcluster/taskcluster-cli/taskcluster signin --scope 'auth:create-role:*' --scope 'auth:update-role:*'
...
dustin@jemison ~ $ ~/go/src/github.com/taskcluster/taskcluster-cli/taskcluster signin 
...

left me with a client with the first set of scopes.  Maybe it's limiting scopes to the client's current scopes?

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

https://github.com/taskcluster/taskcluster-tools/pull/434

Comment 7

[[github robot]]

Commit pushed to master at https://github.com/taskcluster/taskcluster-tools

https://github.com/taskcluster/taskcluster-tools/commit/d4ea63f24b0bf6c84d14733d2515167fd2bdc900
Bug 1430801 - intersect requested scopes with current scopes