waiverdb

#88 waiverdb CLI for creating new waivers
Merged by mjia. Opened by mjia.
mjia/waiverdb cli2  into  master

Download 88.patch

This is to address #issue82.

Ah, for one, the comment in the value in the example conf messes things up when I copied it verbatim:

diff --git a/conf/client.conf.example b/conf/client.conf.example
index 91b6d7e..c22fa41 100644
--- a/conf/client.conf.example
+++ b/conf/client.conf.example
@@ -1,5 +1,6 @@
 [waiverdb]
-auth_method=OIDC # Specify OIDC or Kerberos for authentication
+# Specify OIDC or Kerberos for authentication
+auth_method=OIDC
 api_url=http://localhost:5004/api/v1.0
 oidc_id_provider=https://id.stg.fedoraproject.org/openidc/
 oidc_client_id=waiverdb

After a few more changes, I think this may work.

Try it on waiverdb staging. I get a new Internal Server Error there, but it is unrelated to the client.

diff --git a/conf/client.conf.example b/conf/client.conf.example
index 91b6d7e..f58bf4f 100644
--- a/conf/client.conf.example
+++ b/conf/client.conf.example
@@ -1,8 +1,10 @@
 [waiverdb]
-auth_method=OIDC # Specify OIDC or Kerberos for authentication
-api_url=http://localhost:5004/api/v1.0
+# Specify OIDC or Kerberos for authentication
+auth_method=OIDC
+api_url=https://waiverdb-web-waiverdb.app.os.stg.fedoraproject.org/api/v1.0
 oidc_id_provider=https://id.stg.fedoraproject.org/openidc/
-oidc_client_id=waiverdb
+oidc_client_id=waiverdb-authorizer
+oidc_client_secret=notsecret
 oidc_scopes=
     openid
     https://waiverdb.fedoraproject.org/oidc/create-waiver
diff --git a/waiverdb/cli.py b/waiverdb/cli.py
index 8386c9b..022c648 100644
--- a/waiverdb/cli.py
+++ b/waiverdb/cli.py
@@ -84,6 +84,12 @@ def cli(comment, waived, product_version, result_id, config_file):
         {'Token': 'Token', 'Authorization': 'Authorization'},
         config.get('waiverdb', 'oidc_client_id'),
         oidc_client_secret)
+        scopes = config.get('waiverdb', 'oidc_scopes').strip().splitlines()
+        try:
+            token = oidc.get_token(scopes, new_token=True)
+        except requests.exceptions.HTTPError as e:
+            raise
+
     for result_id in result_ids:
         data = {
         'result_id': result_id,
@@ -92,20 +98,21 @@ def cli(comment, waived, product_version, result_id, config_file):
         'comment': comment
         }
         api_url = config.get('waiverdb', 'api_url')
-            scopes = config.get('waiverdb', 'oidc_scopes').strip().splitlines()
-            resp = oidc.send_request(
-                scopes=scopes,
+            resp = requests.post(
         url='{0}/waivers/'.format(api_url.rstrip('/')),
         data=json.dumps(data),
-                headers={'Content-Type': 'application/json'},
-                timeout=60)
+                timeout=60,
+                headers={
+                    'Content-Type': 'application/json',
+                    'Authorization': 'Bearer %s' % token,
+                })
         if not resp.ok:
         try:
             error_msg = resp.json()['message']
         except (ValueError, KeyError):
             error_msg = resp.text
         raise click.ClickException(
-                    'Faied to create waiver for result {0}:\n{1}'
+                    'Failed to create waiver for result {0}:\n{1}'
             .format(result_id, error_msg))
         click.echo('Created waiver {0} for result {1}'.format(
         resp.json()['id'], result_id))

Yeah - cool. With the above patch, I was able to submit a waiver to stg: https://waiverdb-web-waiverdb.app.os.stg.fedoraproject.org/api/v1.0/waivers/

@ralph, thanks for reviewing. I'm surprised to see that oidc.send_request(...) did not work. It should work since I'm following the same way as rhpkg

https://pagure.io/rpkg/blob/master/f/pyrpkg/init.py#_3003

I'll dig it more.

You were right! I guess I got a little overzealous with my changes.

It seems the only really necessary parts were the oidc_client_id and oidc_client_secret. FWIW, the client secret really isn't a secret. It can be published publicly (for this waiverdb-authorizer/notsecret pair).

diff --git a/conf/client.conf.example b/conf/client.conf.example
index 91b6d7e..f58bf4f 100644
--- a/conf/client.conf.example
+++ b/conf/client.conf.example
@@ -1,8 +1,10 @@
 [waiverdb]
-auth_method=OIDC # Specify OIDC or Kerberos for authentication
-api_url=http://localhost:5004/api/v1.0
+# Specify OIDC or Kerberos for authentication
+auth_method=OIDC
+api_url=https://waiverdb-web-waiverdb.app.os.stg.fedoraproject.org/api/v1.0
 oidc_id_provider=https://id.stg.fedoraproject.org/openidc/
-oidc_client_id=waiverdb
+oidc_client_id=waiverdb-authorizer
+oidc_client_secret=notsecret
 oidc_scopes=
     openid
     https://waiverdb.fedoraproject.org/oidc/create-waiver
diff --git a/waiverdb/cli.py b/waiverdb/cli.py
index 8386c9b..ab683ca 100644
--- a/waiverdb/cli.py
+++ b/waiverdb/cli.py
@@ -105,7 +105,7 @@ def cli(comment, waived, product_version, result_id, config_file):
         except (ValueError, KeyError):
             error_msg = resp.text
         raise click.ClickException(
-                    'Faied to create waiver for result {0}:\n{1}'
+                    'Failed to create waiver for result {0}:\n{1}'
             .format(result_id, error_msg))
         click.echo('Created waiver {0} for result {1}'.format(
         resp.json()['id'], result_id))

Anyways, :+1: to merge from me with the above patch (the spelling fix and the conf change).

rebased onto 4cf193271a9392185de27372bdc6f4b20960e6ee

Rebased to address feedback and fix flake8 errors.

Hmm, it sucks that this oidc stuff makes you use a totally separate "Client" object, instead of just the normal requests.post() with an auth handler... :disappointed:

:+1:

rebased onto 65863decab264bd7f080aca5fbfb019599c009df

Pull-Request has been merged by mjia
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.