Add OAuth PKCE auth for Apps uploads #393
+1,631
−19
There are no files selected for viewing
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -57,6 +57,7 @@ export const validateOptions = (options: Options = {}): OptionsWithDefaults => { | |
| const envSite = resolveSite(envRaw, 'DATADOG_SITE/DD_SITE', errors); | ||
|
|
||
| const auth: AuthOptionsWithDefaults = { | ||
| method: options.auth?.method, | ||
| site: envSite ?? resolveSite(options.auth?.site, 'auth.site', errors) ?? DEFAULT_SITE, | ||
| }; | ||
|
|
||
|
|
@@ -75,6 +76,11 @@ export const validateOptions = (options: Options = {}): OptionsWithDefaults => { | |
| enumerable: false, | ||
| }); | ||
|
|
||
| Object.defineProperty(auth, 'accessToken', { | ||
| value: options.auth?.accessToken, | ||
| enumerable: false, | ||
| }); | ||
|
|
||
| return { | ||
| enableGit: true, | ||
| logLevel: 'warn', | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -18,13 +18,21 @@ A plugin to upload assets to Datadog's storage | |
| - [apps.dryRun](#appsdryrun) | ||
| - [apps.enable](#appsenable) | ||
| - [apps.include](#appsinclude) | ||
| - [auth.method](#authmethod) | ||
| - [apps.identifier](#appsidentifier) | ||
| - [apps.name](#appsname) | ||
| <!-- #toc --> | ||
|
|
||
| ## Configuration | ||
|
|
||
| ```ts | ||
| auth?: { | ||
| method?: 'apiKey' | 'oauth'; | ||
| apiKey?: string; | ||
| appKey?: string; | ||
| site?: string; | ||
| } | ||
|
|
||
| apps?: { | ||
| dryRun?: boolean; | ||
| enable?: boolean; | ||
|
|
@@ -66,6 +74,22 @@ Must be a boolean. Non-boolean values are coerced today but will be rejected in | |
|
|
||
| Additional glob patterns (relative to the project root) to include in the uploaded archive. The bundler output directory is always included. | ||
|
|
||
| ### auth.method | ||
|
|
||
| > default: `apiKey` | ||
|
|
||
| Authentication method for uploading app bundles. | ||
|
|
||
| Use `apiKey` to send `DD_API_KEY`/`DD_APP_KEY` credentials. Use `oauth` to complete a local Authorization Code + PKCE flow and upload with a short-lived bearer token instead. | ||
|
|
||
| You can also set `DATADOG_AUTH_METHOD=oauth` or `DD_AUTH_METHOD=oauth`. | ||
|
|
||
| When `auth.method` is `oauth`, the plugin derives OAuth client settings from the resolved Datadog site. The plugin reads tokens from the OS credential store, refreshes expired access tokens when a refresh token is available, and only starts browser authorization when no usable stored token exists. | ||
|
|
||
| For first-time authorization, the plugin starts a temporary local HTTP callback server, opens Datadog authorization in the browser, exchanges the authorization code with PKCE, and saves the returned token response for later uploads. | ||
|
|
||
| OAuth token and authorization URLs are site-based. The `datad0g.com` site uses the internal Datadog Apps OAuth client; all other sites use the default Datadog Apps OAuth client. | ||
|
|
||
| ### apps.identifier | ||
|
|
||
| > default: an internal computation between the `name` and `repository` fields in `package.json` or from the `git` plugin. | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -31,10 +31,12 @@ | |
| }, | ||
| "dependencies": { | ||
| "@dd/core": "workspace:*", | ||
| "@napi-rs/keyring": "1.3.0", | ||
| "chalk": "2.3.1", | ||
| "eslint-scope": "7.2.2", | ||
| "glob": "11.1.0", | ||
| "jszip": "3.10.1", | ||
| "oauth4webapi": "3.8.6", | ||
| "pretty-bytes": "5.6.0" | ||
| }, | ||
| "devDependencies": { | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,6 +5,7 @@ | |
| import * as archive from '@dd/apps-plugin/archive'; | ||
| import * as assets from '@dd/apps-plugin/assets'; | ||
| import * as identifier from '@dd/apps-plugin/identifier'; | ||
| import * as oauth from '@dd/apps-plugin/oauth'; | ||
| import * as uploader from '@dd/apps-plugin/upload'; | ||
| import { getPlugins } from '@dd/apps-plugin'; | ||
| import { DEFAULT_SITE } from '@dd/core/constants'; | ||
|
|
@@ -24,6 +25,8 @@ import path from 'path'; | |
| import { parseAst } from 'rollup/parseAst'; | ||
|
|
||
| import { APPS_API_PATH } from './constants'; | ||
| import type { AppsOptionsWithDefaults } from './types'; | ||
| import { handleUpload } from './vite/handle-upload'; | ||
|
|
||
| /** Extract and assert closeBundle from the first plugin's vite hooks. */ | ||
| function extractCloseBundle(plugins: PluginOptions[]) { | ||
|
|
@@ -211,8 +214,9 @@ describe('Apps Plugin - getPlugins', () => { | |
| expect(uploader.uploadArchive).toHaveBeenCalledWith( | ||
| expect.objectContaining({ archivePath: '/tmp/dd-apps-123/datadog-apps-assets.zip' }), | ||
| { | ||
| accessToken: undefined, | ||
| apiKey: undefined, | ||
| appKey: undefined, | ||
| bundlerName: 'vite', | ||
| dryRun: true, | ||
| identifier: 'repo:app', | ||
|
|
@@ -230,6 +234,109 @@ describe('Apps Plugin - getPlugins', () => { | |
| expect(fsHelpers.rm).toHaveBeenCalledWith(expect.stringContaining('dd-apps-manifest-')); | ||
| }); | ||
|
|
||
| test('Should authorize with OAuth before uploading assets when configured', async () => { | ||
| jest.spyOn(identifier, 'resolveIdentifier').mockReturnValue({ | ||
| identifier: 'repo:app', | ||
| name: 'test-app', | ||
| }); | ||
| jest.spyOn(assets, 'collectAssets').mockResolvedValue([ | ||
| { absolutePath: '/project/dist/index.js', relativePath: 'dist/index.js' }, | ||
| ]); | ||
| jest.spyOn(fsHelpers, 'rm').mockResolvedValue(undefined); | ||
| jest.spyOn(archive, 'createArchive').mockResolvedValue({ | ||
| archivePath: '/tmp/dd-apps-123/datadog-apps-assets.zip', | ||
| assets: [], | ||
| size: 10, | ||
| }); | ||
| jest.spyOn(oauth, 'getOAuthToken').mockResolvedValue({ | ||
| accessToken: 'oauth-token', | ||
| site: 'datadoghq.eu', | ||
| }); | ||
| jest.spyOn(uploader, 'uploadArchive').mockResolvedValue({ errors: [], warnings: [] }); | ||
|
|
||
| const closeBundle = extractCloseBundle( | ||
| getPlugins( | ||
| getGetPluginsArg( | ||
| { | ||
| auth: { | ||
| method: 'oauth', | ||
| site: DEFAULT_SITE, | ||
| }, | ||
| apps: { | ||
| dryRun: false, | ||
| }, | ||
| }, | ||
| { | ||
| bundler: { ...getMockBundler({ name: 'vite' }), outDir }, | ||
| buildRoot, | ||
| git: getRepositoryDataMock({ remote: 'git@github.com:org/repo.git' }), | ||
| }, | ||
| ), | ||
| ), | ||
| ); | ||
| await closeBundle(); | ||
|
|
||
| expect(oauth.getOAuthToken).toHaveBeenCalledWith( | ||
| DEFAULT_SITE, | ||
| expect.objectContaining({ | ||
| authorizationUrl: `https://api.${DEFAULT_SITE}/oauth2/v1/authorize`, | ||
| tokenUrl: `https://api.${DEFAULT_SITE}/oauth2/v1/token`, | ||
| }), | ||
| expect.anything(), | ||
| ); | ||
| expect(uploader.uploadArchive).toHaveBeenCalledWith( | ||
| expect.objectContaining({ archivePath: '/tmp/dd-apps-123/datadog-apps-assets.zip' }), | ||
| expect.objectContaining({ | ||
| accessToken: 'oauth-token', | ||
| apiKey: undefined, | ||
| appKey: undefined, | ||
| site: 'datadoghq.eu', | ||
| }), | ||
| expect.anything(), | ||
| ); | ||
| }); | ||
|
|
||
| test('Should use API credentials when upload method is not specified', async () => { | ||
| jest.spyOn(identifier, 'resolveIdentifier').mockReturnValue({ | ||
| identifier: 'repo:app', | ||
| name: 'test-app', | ||
| }); | ||
| jest.spyOn(assets, 'collectAssets').mockResolvedValue([ | ||
| { absolutePath: '/project/dist/index.js', relativePath: 'dist/index.js' }, | ||
| ]); | ||
| jest.spyOn(fsHelpers, 'rm').mockResolvedValue(undefined); | ||
| jest.spyOn(archive, 'createArchive').mockResolvedValue({ | ||
| archivePath: '/tmp/dd-apps-123/datadog-apps-assets.zip', | ||
| assets: [], | ||
| size: 10, | ||
| }); | ||
| jest.spyOn(uploader, 'uploadArchive').mockResolvedValue({ errors: [], warnings: [] }); | ||
| const getOAuthTokenSpy = jest.spyOn(oauth, 'getOAuthToken'); | ||
|
|
||
| await handleUpload({ | ||
| backendFunctions: [], | ||
| backendOutputs: new Map(), | ||
| context: getArgs().context, | ||
| options: { | ||
| dryRun: false, | ||
| include: [], | ||
| oauth: oauth.getOAuthConfig(DEFAULT_SITE), | ||
| } as unknown as AppsOptionsWithDefaults, | ||
| }); | ||
|
|
||
| expect(getOAuthTokenSpy).not.toHaveBeenCalled(); | ||
| expect(uploader.uploadArchive).toHaveBeenCalledWith( | ||
| expect.objectContaining({ archivePath: '/tmp/dd-apps-123/datadog-apps-assets.zip' }), | ||
| expect.objectContaining({ | ||
| accessToken: undefined, | ||
| apiKey: '123', | ||
| appKey: '123', | ||
| site: DEFAULT_SITE, | ||
| }), | ||
| expect.anything(), | ||
| ); | ||
| }); | ||
|
|
||
| test('Should emit root manifest.json with backend function connection allowlists', async () => { | ||
| jest.spyOn(identifier, 'resolveIdentifier').mockReturnValue({ | ||
| identifier: 'repo:app', | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| // Unless explicitly stated otherwise all files in this repository are licensed under the MIT License. | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). | ||
| // Copyright 2019-Present Datadog, Inc. | ||
|
|
||
| export type OAuthAuthorizationServer = import('oauth4webapi').AuthorizationServer; | ||
| export type OAuthClient = import('oauth4webapi').Client; | ||
| export type OAuthModule = typeof import('oauth4webapi'); | ||
| export type OAuthTokenEndpointResponse = import('oauth4webapi').TokenEndpointResponse; | ||
|
|
||
| type KeyringModule = typeof import('@napi-rs/keyring'); | ||
|
|
||
| const OAUTH_PACKAGE_NAME = 'oauth4webapi'; | ||
| const KEYRING_PACKAGE_NAME = '@napi-rs/keyring'; | ||
|
|
||
| const memoizeAsync = <Value>(load: () => Promise<Value>) => { | ||
| let promise: Promise<Value> | undefined; | ||
|
|
||
| return () => { | ||
| if (!promise) { | ||
| promise = load().catch((error) => { | ||
| promise = undefined; | ||
| throw error; | ||
| }); | ||
| } | ||
| return promise; | ||
| }; | ||
| }; | ||
|
|
||
| export const loadOauth = memoizeAsync(() => import(OAUTH_PACKAGE_NAME) as Promise<OAuthModule>); | ||
|
|
||
| // `@napi-rs/keyring` has a CommonJS entry. Load it lazily so API-key uploads | ||
| // do not initialize the native credential binding. | ||
| export const loadKeyring = memoizeAsync( | ||
| () => import(KEYRING_PACKAGE_NAME) as Promise<KeyringModule>, | ||
| ); |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why's this user facing? Not sure I understand the need for it, from the user's perspective.