fix: stop verifying token on ingore cmd #5793
Conversation
|
825a88a to
c1bf1a7
Compare
src/cli/commands/ignore.ts
Outdated
| } | ||
| throw err; | ||
| } | ||
| }) | ||
| .then(() => { | ||
| return authorization.actionAllowed('cliIgnore', options); | ||
| }) |
There was a problem hiding this comment.
suggestion: this might need a catch in case of authentication failures. The actionAllowed returns am object, that should return an auth error (AuthFailedError).
There was a problem hiding this comment.
That is true before this change as well, right? I believe this to be handled by the thing using the promise 🤔
There was a problem hiding this comment.
Yes. I was just thinking that the API call to check the cliIgnoreAuthorization seem to not care about the status codes (neither does the verify function call), which seems like a bad idea.
I would say this is the last thing to be taken care of for this PR, just to make sure there's some better error messages for the users. Happy to pair on this if you want to, feel free to book a time in my calendar.
LE: this also needs a rebase to fix some vulnerabilities that came up.
|
The acceptance tests seem to also need an update: |
@CatalinSnyk, do you happen to know what needs updating? |
|
I think the tests might not actually need updating. The promise that was previously used was not resolving at all, so the command was not doing anything. Should be solved with the commit I made. |
3cae0a6 to
b486945
Compare
Ignore command is the sole command (auth aside) that verifies against Snyk platform that a token is valid. This is redundant as an invalid token would be identified as invalid on any requests performed against the platform with a 401 status code. This change refactors the code to only perform local validation, verifying that the token is set appropriately either via configuration or environment variable.
b486945 to
14c5679
Compare
Pull Request Submission Checklist
What does this PR do?
Ignore command is the sole command (auth aside) that verifies against Snyk platform that a token is valid.
This is redundant as an invalid token would be identified as invalid on any requests performed against the platform with a 401 status code.
This change refactors the code to only perform local validation, verifying that the token is set appropriately either via configuration or environment variable.
Background
In preparation of enhanced API keys, a clean-up of the Snyk clients codebase to facilitate their integration is being done.