Merge #1989

1989: Extend API keys r=curquiza a=ManyTheFish

# Pull Request

## What does this PR do?

- Add API keys in snapshots
- Add API keys in dumps
- fix QA #1979

fix #1979
fix #1995
fix #2001
fix #2003

related to #1890

Co-authored-by: many <maxime@meilisearch.com>

meilisearch-http/src/extractors/authentication/mod.rs

@@ -32,7 +32,7 @@ impl<T, D> Deref for GuardedData<T, D> {
 }
 
 impl<P: Policy + 'static, D: 'static + Clone> FromRequest for GuardedData<P, D> {
-    type Config = AuthConfig;
+    type Config = ();
 
     type Error = ResponseError;
 
@@ -42,49 +42,44 @@ impl<P: Policy + 'static, D: 'static + Clone> FromRequest for GuardedData<P, D>
         req: &actix_web::HttpRequest,
         _payload: &mut actix_web::dev::Payload,
     ) -> Self::Future {
-        match req.app_data::<Self::Config>() {
-            Some(config) => match config {
-                AuthConfig::NoAuth => match req.app_data::<D>().cloned() {
-                    Some(data) => ok(Self {
-                        data,
-                        filters: AuthFilter::default(),
-                        _marker: PhantomData,
-                    }),
-                    None => err(AuthenticationError::IrretrievableState.into()),
+        match req.app_data::<AuthController>().cloned() {
+            Some(auth) => match req
+                .headers()
+                .get("Authorization")
+                .map(|type_token| type_token.to_str().unwrap_or_default().splitn(2, ' '))
+            {
+                Some(mut type_token) => match type_token.next() {
+                    Some("Bearer") => {
+                        // TODO: find a less hardcoded way?
+                        let index = req.match_info().get("index_uid");
+                        let token = type_token.next().unwrap_or("unknown");
+                        match P::authenticate(auth, token, index) {
+                            Some(filters) => match req.app_data::<D>().cloned() {
+                                Some(data) => ok(Self {
+                                    data,
+                                    filters,
+                                    _marker: PhantomData,
+                                }),
+                                None => err(AuthenticationError::IrretrievableState.into()),
+                            },
+                            None => {
+                                let token = token.to_string();
+                                err(AuthenticationError::InvalidToken(token).into())
+                            }
+                        }
+                    }
+                    _otherwise => err(AuthenticationError::MissingAuthorizationHeader.into()),
                 },
-                AuthConfig::Auth => match req.app_data::<AuthController>().cloned() {
-                    Some(auth) => match req
-                        .headers()
-                        .get("Authorization")
-                        .map(|type_token| type_token.to_str().unwrap_or_default().splitn(2, ' '))
-                    {
-                        Some(mut type_token) => match type_token.next() {
-                            Some("Bearer") => {
-                                // TODO: find a less hardcoded way?
-                                let index = req.match_info().get("index_uid");
-                                let token = type_token.next().unwrap_or("unknown");
-                                match P::authenticate(auth, token, index) {
-                                    Some(filters) => match req.app_data::<D>().cloned() {
-                                        Some(data) => ok(Self {
-                                            data,
-                                            filters,
-                                            _marker: PhantomData,
-                                        }),
-                                        None => err(AuthenticationError::IrretrievableState.into()),
-                                    },
-                                    None => {
-                                        let token = token.to_string();
-                                        err(AuthenticationError::InvalidToken(token).into())
-                                    }
-                                }
-                            }
-                            _otherwise => {
-                                err(AuthenticationError::MissingAuthorizationHeader.into())
-                            }
-                        },
-                        None => err(AuthenticationError::MissingAuthorizationHeader.into()),
+                None => match P::authenticate(auth, "", None) {
+                    Some(filters) => match req.app_data::<D>().cloned() {
+                        Some(data) => ok(Self {
+                            data,
+                            filters,
+                            _marker: PhantomData,
+                        }),
+                        None => err(AuthenticationError::IrretrievableState.into()),
                     },
-                    None => err(AuthenticationError::IrretrievableState.into()),
+                    None => err(AuthenticationError::MissingAuthorizationHeader.into()),
                 },
             },
             None => err(AuthenticationError::IrretrievableState.into()),
@@ -129,10 +124,8 @@ pub mod policies {
             index: Option<&str>,
         ) -> Option<AuthFilter> {
             // authenticate if token is the master key.
-            if let Some(master_key) = auth.get_master_key() {
-                if master_key == token {
-                    return Some(AuthFilter::default());
-                }
+            if auth.get_master_key().map_or(true, |mk| mk == token) {
+                return Some(AuthFilter::default());
             }
 
             // authenticate if token is allowed.
@@ -147,13 +140,3 @@ pub mod policies {
         }
     }
 }
-pub enum AuthConfig {
-    NoAuth,
-    Auth,
-}
-
-impl Default for AuthConfig {
-    fn default() -> Self {
-        Self::NoAuth
-    }
-}

meilisearch-http/src/lib.rs

@@ -13,7 +13,6 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use crate::error::MeilisearchHttpError;
-use crate::extractors::authentication::AuthConfig;
 use actix_web::error::JsonPayloadError;
 use analytics::Analytics;
 use error::PayloadError;
@@ -25,31 +24,6 @@ use actix_web::{web, HttpRequest};
 use extractors::payload::PayloadConfig;
 use meilisearch_auth::AuthController;
 use meilisearch_lib::MeiliSearch;
-use sha2::Digest;
-
-#[derive(Clone)]
-pub struct ApiKeys {
-    pub public: Option<String>,
-    pub private: Option<String>,
-    pub master: Option<String>,
-}
-
-impl ApiKeys {
-    pub fn generate_missing_api_keys(&mut self) {
-        if let Some(master_key) = &self.master {
-            if self.private.is_none() {
-                let key = format!("{}-private", master_key);
-                let sha = sha2::Sha256::digest(key.as_bytes());
-                self.private = Some(format!("{:x}", sha));
-            }
-            if self.public.is_none() {
-                let key = format!("{}-public", master_key);
-                let sha = sha2::Sha256::digest(key.as_bytes());
-                self.public = Some(format!("{:x}", sha));
-            }
-        }
-    }
-}
 
 pub fn setup_meilisearch(opt: &Opt) -> anyhow::Result<MeiliSearch> {
     let mut meilisearch = MeiliSearch::builder();
@@ -113,16 +87,6 @@ pub fn configure_data(
         );
 }
 
-pub fn configure_auth(config: &mut web::ServiceConfig, opts: &Opt) {
-    let auth_config = if opts.master_key.is_some() {
-        AuthConfig::Auth
-    } else {
-        AuthConfig::NoAuth
-    };
-
-    config.app_data(auth_config);
-}
-
 #[cfg(feature = "mini-dashboard")]
 pub fn dashboard(config: &mut web::ServiceConfig, enable_frontend: bool) {
     use actix_web::HttpResponse;
@@ -170,17 +134,15 @@ macro_rules! create_app {
         use meilisearch_error::ResponseError;
         use meilisearch_http::error::MeilisearchHttpError;
         use meilisearch_http::routes;
-        use meilisearch_http::{configure_auth, configure_data, dashboard};
+        use meilisearch_http::{configure_data, dashboard};
 
         App::new()
             .configure(|s| configure_data(s, $data.clone(), $auth.clone(), &$opt, $analytics))
-            .configure(|s| configure_auth(s, &$opt))
             .configure(routes::configure)
             .configure(|s| dashboard(s, $enable_frontend))
             .wrap(
                 Cors::default()
                     .send_wildcard()
-                    .allowed_headers(vec!["content-type", "x-meili-api-key"])
                     .allow_any_origin()
                     .allow_any_method()
                     .max_age(86_400), // 24h

meilisearch-http/src/routes/api_key.rs

@@ -1,7 +1,7 @@
 use std::str;
 
 use actix_web::{web, HttpRequest, HttpResponse};
-use chrono::{DateTime, Utc};
+use chrono::SecondsFormat;
 use log::debug;
 use meilisearch_auth::{generate_key, Action, AuthController, Key};
 use serde::{Deserialize, Serialize};
@@ -84,7 +84,7 @@ pub async fn delete_api_key(
     // keep 8 first characters that are the ID of the API key.
     auth_controller.delete_key(&path.api_key).await?;
 
-    Ok(HttpResponse::NoContent().json(()))
+    Ok(HttpResponse::NoContent().finish())
 }
 
 #[derive(Deserialize)]
@@ -95,14 +95,13 @@ pub struct AuthParam {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 struct KeyView {
-    #[serde(skip_serializing_if = "Option::is_none")]
     description: Option<String>,
     key: String,
     actions: Vec<Action>,
     indexes: Vec<String>,
-    expires_at: Option<DateTime<Utc>>,
-    created_at: DateTime<Utc>,
-    updated_at: DateTime<Utc>,
+    expires_at: Option<String>,
+    created_at: String,
+    updated_at: String,
 }
 
 impl KeyView {
@@ -118,9 +117,11 @@ impl KeyView {
             key: generated_key,
             actions: key.actions,
             indexes: key.indexes,
-            expires_at: key.expires_at,
-            created_at: key.created_at,
-            updated_at: key.updated_at,
+            expires_at: key
+                .expires_at
+                .map(|dt| dt.to_rfc3339_opts(SecondsFormat::Secs, true)),
+            created_at: key.created_at.to_rfc3339_opts(SecondsFormat::Secs, true),
+            updated_at: key.updated_at.to_rfc3339_opts(SecondsFormat::Secs, true),
         }
     }
 }

meilisearch-http/src/routes/indexes/mod.rs

@@ -62,7 +62,7 @@ pub struct IndexCreateRequest {
 }
 
 pub async fn create_index(
-    meilisearch: GuardedData<ActionPolicy<{ actions::INDEXES_ADD }>, MeiliSearch>,
+    meilisearch: GuardedData<ActionPolicy<{ actions::INDEXES_CREATE }>, MeiliSearch>,
     body: web::Json<IndexCreateRequest>,
     req: HttpRequest,
     analytics: web::Data<dyn Analytics>,

meilisearch-http/src/routes/tasks.rs

@@ -1,6 +1,7 @@
 use actix_web::{web, HttpRequest, HttpResponse};
 use meilisearch_error::ResponseError;
 use meilisearch_lib::tasks::task::TaskId;
+use meilisearch_lib::tasks::TaskFilter;
 use meilisearch_lib::MeiliSearch;
 use serde_json::json;
 
@@ -24,8 +25,16 @@ async fn get_tasks(
         Some(&req),
     );
 
+    let filters = meilisearch.filters().indexes.as_ref().map(|indexes| {
+        let mut filters = TaskFilter::default();
+        for index in indexes {
+            filters.filter_index(index.to_string());
+        }
+        filters
+    });
+
     let tasks: TaskListView = meilisearch
-        .list_tasks(None, None, None)
+        .list_tasks(filters, None, None)
         .await?
         .into_iter()
         .map(TaskView::from)
@@ -47,8 +56,16 @@ async fn get_task(
         Some(&req),
     );
 
+    let filters = meilisearch.filters().indexes.as_ref().map(|indexes| {
+        let mut filters = TaskFilter::default();
+        for index in indexes {
+            filters.filter_index(index.to_string());
+        }
+        filters
+    });
+
     let task: TaskView = meilisearch
-        .get_task(task_id.into_inner(), None)
+        .get_task(task_id.into_inner(), filters)
         .await?
         .into();