1443704 - Users can provide credentials to see and land confidential revisions

Status: RESOLVED FIXED

(Conduit :: General, enhancement)

Description

[Mark Côté [:mcote]]

In order to both view and land confidential revisions, users must authenticate somehow to Phabricator.

Comment 1

[Israel Madueme [:imadueme]]

If possible, may I be CC'd on Bug 1372931 since this bug depends on it?

Comment 2

[Israel Madueme [:imadueme]]

^

Comment 3

[Piotr Zalewa [:zalun]]

Attachment: landing: Add an ability to see and land secure revisions.

The user is providing the Phabricator API Token manually in the Navbar modal.
The browser is storing its value in the cookie.
Lando UI backend is passing the token to the Lando API in request's header.
`PHABRICATOR_URL` config is added with a default value set to
`https://phabricator.services.mozilla.com/`.

Fixed Nits:
I've removed the `npm install` line. "no such command."
Please make sure this is not needed before accepting.

Comment 4

[Piotr Zalewa [:zalun]]

Phabricator API endpoints require a token to authenticate the user.

Currently, we use a default unprivileged token for all the requests. It gives us access to public revisions.
To be able to view and land secure revisions, Lando needs to use a token generated by the Phabricator user.
Each user can generate multiple permanent API tokens.
A user authenticates in Phabricator using BMO Auth.

Lando UI will have a way for the authenticated (Auth0) user to provide the token (copy & paste using the browser). It would then store it and pass to the Lando API as the X-Phabricator-API-Key header in every request. The token should be removed from Lando onon user's demand or if the user is logged out. Reusing the same token next time is possible.

Storing the token in a session is not suitable for us (see discussion here [1])

One solution would be to store the token in a secure, HttpOnly cookie. The cookie will be deleted on log out.
Implementation would require sending the token to the server with a CSRF protected POST request.

[1] https://phabricator.services.mozilla.com/D2561#55271

Comment 5

[Israel Madueme [:imadueme]]

Comment on attachment 8996279 [details]
landing: Add an ability to see and land secure revisions.

Israel Madueme [:imadueme] has approved the revision.

Comment 6

[Steven MacLeod [:smacleod]]

Comment on attachment 8996279 [details]
landing: Add an ability to see and land secure revisions.

Steven MacLeod [:smacleod] has approved the revision.

Comment 7

[Steven MacLeod [:smacleod]]

This has landed, should go out with the next deploy.