feat(preprod): Add objectstore auth tokens for frontend image requests#113030
Draft
lcian wants to merge 2 commits intolcian/preprod-remove-image-proxy-endpointfrom
Draft
feat(preprod): Add objectstore auth tokens for frontend image requests#113030lcian wants to merge 2 commits intolcian/preprod-remove-image-proxy-endpointfrom
lcian wants to merge 2 commits intolcian/preprod-remove-image-proxy-endpointfrom
Conversation
Mint short-lived, read-only objectstore tokens in the build-details and snapshot-details API responses. The frontend appends these as `X-Os-Auth` query params on objectstore image URLs, which the proxy forwards to objectstore for authentication. The token generator uses `Permission.OBJECT_READ` only and a 5-minute expiry to minimize the blast radius of any leaked token. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
|
🚨 Warning: This pull request contains Frontend and Backend changes! It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently. Have questions? Please ask in the |
Contributor
Backend Test FailuresFailures on
|
Contributor
Sentry Snapshot Testing
|
The test_one_build test does an exact JSON match on the response and was missing the new objectstore_token field.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#112469 modified frontend components that render images for snapshots to fetch directly from Objectstore.
As Objectstore will soon enforce auth, we need a way for those requests coming from the browser to carry auth information.
This adds an optional
objectstore_tokenfield to responses returned byOrganizationPreprodSnapshotEndpointandProjectPreprodBuildDetailsEndpoint.The token is a short-lived token with read-only permissions, scoped down to the appropriate usecase/org/proj.
That token is passed to the frontend and threaded down to components such as
AppIconandDiffImageDisplay, which include it in image URL via theX-Os-Authquery parameter.