API Keys

[aleclevy]

API Keys should be able to be generated on DirtViz, with a single key being generated per signed in user. They should be able to regenerate a new api key, automatically invalidating the old api key.

API key generation should be introduce on the ENTS Backend api and have an interface for said generation on DirtViz, that can be replicated on future frontend applications of the ENTS backend api.

Later issue will be made to introduce rate limiting.

[jmadden173]

Adding some context to this issue:

Database
For now lets just add another column to the users table that stores the API key. A 64 character string should be sufficient. We can have it NULLable for users that don't want to use the key. We're essentially storing a plaintext password to be used with the website. For now we wont' worry about it since this is more of a proof of concept.

See

ENTS-backend/backend/api/models/user.py

Lines 8 to 18 in 74ea7ce

	class User(db.Model):
	__tablename__ = "user"
	id = db.Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
	first_name: str = db.Column(db.String(255))
	last_name: str = db.Column(db.String(255))
	email: str = db.Column(db.String(255), unique=True)
	password: str = db.Column(db.String(72), nullable=False)
	cells = db.relationship(
	"Cell", secondary=Cell_User.__table__, back_populates="users"
	)

Endpoint
New endpoint (I would just call it /apikey/) that has an authguard and the following info
GET: Get the current API key
POST: Create a new key (have this fail if the field is not NULL, requiring a DELETE call to prevent accidental deletion.
DELETE: Remove/invalidate the key

Backend modifications

Other api endpoints will need to be modified to allow for the use of API keys. Ideally the API key would be passed as an HTTP param so that plaintext "password" aren't stored in logs.

Current how its done for auth

ENTS-backend/backend/api/auth/auth.py

Lines 27 to 28 in 74ea7ce

	def authenticate(f):
	"""Decorator for protecting resources from invalid/missing jwt tokens"""

Example on how its used for an endpoint

ENTS-backend/backend/api/resources/cell.py

Lines 16 to 21 in 74ea7ce

	class Cell(Resource):
	method_decorators = {
	"get": [authenticate],
	"put": [authenticate],
	"delete": [authenticate],
	}

Frontend

Kinda thinking something like this on the account page.

[dvdthr5]

#762

(api key already invalidated)