Baip 315/jwt token does not contain any accessible tenants#32
Conversation
THe previous version expected the extracted payload to contain item 'payload' - this is not the case, that decoded object contains directly the 'group' item.
WalkthroughThis update refactors JWT payload handling for tenant information in the Fleet Management API. It replaces JSON string parsing with direct dictionary access, updates the payload structure, and removes related utility functions. The constants are revised, and unused imports are cleaned up. The API version is incremented to 4.1.1 in relevant metadata files. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant API
participant JWT
Client->>API: Request with JWT token
API->>JWT: Decode JWT token
JWT-->>API: Return payload (dict with "group" key)
API->>API: Check for "group" in payload
alt "group" key present
API->>API: Extract tenant names from "group" list
API-->>Client: Return accessible tenants
else "group" key missing
API-->>Client: Return error (NoAccessibleTenants)
end
sequenceDiagram
participant API
participant JWT
API->>API: Prepare tenant list as list of strings
API->>JWT: Encode JWT with payload {"group": [...], "iss": "test", "aud": "account"}
JWT-->>API: Return JWT token
Tip ⚡️ Faster reviews with caching
Enjoy the performance boost—your workflow just got faster. ✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
fleet_management_api/app.py (1)
48-48: Typo in error message.There's a typo in the error message: "JWsT" instead of "JWT".
- _log_error(f"Failed to encode JWsT token: {str(e)}") + _log_error(f"Failed to encode JWT token: {str(e)}")
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (8)
fleet_management_api/api_impl/constants.py(1 hunks)fleet_management_api/api_impl/tenants.py(2 hunks)fleet_management_api/app.py(2 hunks)fleet_management_api/openapi/openapi.yaml(1 hunks)openapi/openapi.yaml(1 hunks)pyproject.toml(1 hunks)tests/controllers/car/test_car_controller.py(2 hunks)tests/security/test_tenants_from_jwt.py(0 hunks)
💤 Files with no reviewable changes (1)
- tests/security/test_tenants_from_jwt.py
🧰 Additional context used
🧬 Code Graph Analysis (1)
tests/controllers/car/test_car_controller.py (1)
tests/_utils/setup_utils.py (4)
create_stops(35-50)create_platform_hws(21-32)create_route(53-63)TenantFromTokenMock(9-18)
🔇 Additional comments (11)
pyproject.toml (1)
3-3: Version bump is consistent
The version has been updated from4.1.0to4.1.1to align with API changes.openapi/openapi.yaml (1)
5-5: OpenAPI version updated
Theinfo.versionfield has been incremented to4.1.1, matching the project version inpyproject.toml.fleet_management_api/openapi/openapi.yaml (1)
12-12: OpenAPI version updated
Theinfo.versionfield has been bumped to4.1.1, ensuring consistency across OpenAPI specs.fleet_management_api/api_impl/constants.py (1)
1-1: Add module docstring
The module-level docstring clarifies the purpose of these constants for tenant-related logic.tests/controllers/car/test_car_controller.py (2)
2-2: Blank line inserted for readability; no action needed.
16-21: Consolidate imports fromtests._utils.setup_utils
Groupingcreate_stops,create_platform_hws,create_route, andTenantFromTokenMockunder one import improves organization and reflects updated utilities.fleet_management_api/app.py (2)
35-35: Improved tenant path handling.The change to create a list of tenant paths using a list comprehension is a good improvement that makes the code more explicit and aligns with the expected JWT payload structure.
37-39: JWT payload structure correctly updated.The payload structure now correctly includes the
groupfield containing tenant paths, along with standard JWT fields (issandaud). This aligns with the updated tenant extraction logic intenants.py.fleet_management_api/api_impl/tenants.py (3)
171-175: Improved error handling with detailed messages.Adding the specific error message from the exception provides better context for debugging when tenant extraction fails.
233-237: Core fix: Direct JWT payload handling.This is the key change that addresses the issue described in the PR. Instead of assuming a nested structure with a 'payload' field, the code now correctly:
- Directly uses the decoded JWT payload returned by
jwt.decode- Checks for the presence of the 'group' key
- Extracts the tenant information directly from the payload
This change simplifies the code and fixes the tenant extraction issue.
240-240: Clearer error message.The updated error message more clearly explains the issue when no tenants are found in the token.
1 participant
Fix the tenant extraction from the JWT token.
THe previous version expected the extracted payload to contain item 'payload' - this is not the case, that decoded object contains directly the 'group' item.
Summary by CodeRabbit
New Features
Bug Fixes
Refactor