Merge pull request #213 from ClusterCockpit/hotfix

Hotfix
ClusterCockpit · Sep 7, 2023 · ab08600 · ab08600
2 parents 0f34c8c + 7a5ccff
commit ab08600
Show file tree

Hide file tree

Showing 11 changed files with 94 additions and 85 deletions.
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
@@ -101,5 +101,6 @@ release:
   draft: false
   footer: |
     Supports job archive version 1 and database version 6.
+    Please check out the [Release Notes](https://github.com/ClusterCockpit/cc-backend/blob/master/ReleaseNotes.md) for further details on breaking changes.
 
 # vim: set ts=2 sw=2 tw=0 fo=cnqoj
diff --git a/Makefile b/Makefile
@@ -2,7 +2,7 @@ TARGET = ./cc-backend
 VAR = ./var
 CFG = config.json .env
 FRONTEND = ./web/frontend
-VERSION = 1.2.0
+VERSION = 1.2.1
 GIT_HASH := $(shell git rev-parse --short HEAD || echo 'development')
 CURRENT_TIME = $(shell date +"%Y-%m-%d:T%H:%M:%S")
 LD_FLAGS = '-s -X main.date=${CURRENT_TIME} -X main.version=${VERSION} -X main.commit=${GIT_HASH}'

diff --git a/ReleaseNotes.md b/ReleaseNotes.md
@@ -1,4 +1,4 @@
-# `cc-backend` version 1.2.0
+# `cc-backend` version 1.2.1
 
 Supports job archive version 1 and database version 6.
 
@@ -25,6 +25,10 @@ is not the number of cores the core hours will be too high by a factor!
   validity. Some key names have changed, please refer to
   [config documentation](./configs/README.md) for details.
 
+* The following API endpoints are only accessible from IPs registered using the apiAllowedIPs configuration option:
+   - `/users/` [GET, POST, DELETE]
+   - `/user/{id}` [POST]
+
 ** NOTE **
 If you are using the sqlite3 backend the `PRAGMA` option `foreign_keys` must be
 explicitly set to ON. If using the sqlite3 console it is per default set to

diff --git a/api/swagger.json b/api/swagger.json
@@ -29,7 +29,7 @@
                     "application/json"
                 ],
                 "tags": [
-                    "query"
+                    "Job query"
                 ],
                 "summary": "Lists all jobs",
                 "parameters": [
@@ -127,7 +127,7 @@
                     "application/json"
                 ],
                 "tags": [
-                    "remove"
+                    "Job remove"
                 ],
                 "summary": "Remove a job from the sql database",
                 "parameters": [
@@ -199,7 +199,7 @@
                     "application/json"
                 ],
                 "tags": [
-                    "remove"
+                    "Job remove"
                 ],
                 "summary": "Remove a job from the sql database",
                 "parameters": [
@@ -269,7 +269,7 @@
                     "application/json"
                 ],
                 "tags": [
-                    "remove"
+                    "Job remove"
                 ],
                 "summary": "Remove a job from the sql database",
                 "parameters": [
@@ -342,7 +342,7 @@
                     "application/json"
                 ],
                 "tags": [
-                    "add and modify"
+                    "Job add and modify"
                 ],
                 "summary": "Adds a new job as \"running\"",
                 "parameters": [
@@ -408,7 +408,7 @@
                     "application/json"
                 ],
                 "tags": [
-                    "add and modify"
+                    "Job add and modify"
                 ],
                 "summary": "Marks job as completed and triggers archiving",
                 "parameters": [
@@ -483,7 +483,7 @@
                     "application/json"
                 ],
                 "tags": [
-                    "add and modify"
+                    "Job add and modify"
                 ],
                 "summary": "Marks job as completed and triggers archiving",
                 "parameters": [
@@ -565,7 +565,7 @@
                     "application/json"
                 ],
                 "tags": [
-                    "add and modify"
+                    "Job add and modify"
                 ],
                 "summary": "Adds one or more tags to a job",
                 "parameters": [
@@ -638,7 +638,7 @@
                     "application/json"
                 ],
                 "tags": [
-                    "query"
+                    "Job query"
                 ],
                 "summary": "Get complete job meta and metric data",
                 "parameters": [
@@ -715,15 +715,15 @@
                         "ApiKeyAuth": []
                     }
                 ],
-                "description": "Modifies user defined by username (id) in one of four possible ways.\nIf more than one formValue is set then only the highest priority field is used.",
+                "description": "Modifies user defined by username (id) in one of four possible ways.\nIf more than one formValue is set then only the highest priority field is used.\nOnly accessible from IPs registered with apiAllowedIPs configuration option.",
                 "consumes": [
                     "multipart/form-data"
                 ],
                 "produces": [
                     "text/plain"
                 ],
                 "tags": [
-                    "add and modify"
+                    "User"
                 ],
                 "summary": "Updates an existing user",
                 "parameters": [
@@ -820,12 +820,12 @@
                         "ApiKeyAuth": []
                     }
                 ],
-                "description": "Returns a JSON-encoded list of users.\nRequired query-parameter defines if all users or only users with additional special roles are returned.",
+                "description": "Returns a JSON-encoded list of users.\nRequired query-parameter defines if all users or only users with additional special roles are returned.\nOnly accessible from IPs registered with apiAllowedIPs configuration option.",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "query"
+                    "User"
                 ],
                 "summary": "Returns a list of users",
                 "parameters": [
@@ -879,15 +879,15 @@
                         "ApiKeyAuth": []
                     }
                 ],
-                "description": "User specified in form data will be saved to database.",
+                "description": "User specified in form data will be saved to database.\nOnly accessible from IPs registered with apiAllowedIPs configuration option.",
                 "consumes": [
                     "multipart/form-data"
                 ],
                 "produces": [
                     "text/plain"
                 ],
                 "tags": [
-                    "add and modify"
+                    "User"
                 ],
                 "summary": "Adds a new user",
                 "parameters": [
@@ -983,15 +983,15 @@
                         "ApiKeyAuth": []
                     }
                 ],
-                "description": "User defined by username in form data will be deleted from database.",
+                "description": "User defined by username in form data will be deleted from database.\nOnly accessible from IPs registered with apiAllowedIPs configuration option.",
                 "consumes": [
                     "multipart/form-data"
                 ],
                 "produces": [
                     "text/plain"
                 ],
                 "tags": [
-                    "remove"
+                    "User"
                 ],
                 "summary": "Deletes a user",
                 "parameters": [
@@ -1757,10 +1757,5 @@
             "name": "X-Auth-Token",
             "in": "header"
         }
-    },
-    "tags": [
-        {
-            "name": "Job API"
-        }
-    ]
+    }
 }
diff --git a/api/swagger.yaml b/api/swagger.yaml
@@ -607,7 +607,7 @@ paths:
       - ApiKeyAuth: []
       summary: Lists all jobs
       tags:
-      - query
+      - Job query
   /jobs/{id}:
     post:
       consumes:
@@ -665,7 +665,7 @@ paths:
       - ApiKeyAuth: []
       summary: Get complete job meta and metric data
       tags:
-      - query
+      - Job query
   /jobs/delete_job/:
     delete:
       consumes:
@@ -715,7 +715,7 @@ paths:
       - ApiKeyAuth: []
       summary: Remove a job from the sql database
       tags:
-      - remove
+      - Job remove
   /jobs/delete_job/{id}:
     delete:
       description: Job to remove is specified by database ID. This will not remove
@@ -762,7 +762,7 @@ paths:
       - ApiKeyAuth: []
       summary: Remove a job from the sql database
       tags:
-      - remove
+      - Job remove
   /jobs/delete_job_before/{ts}:
     delete:
       description: Remove all jobs with start time before timestamp. The jobs will
@@ -809,7 +809,7 @@ paths:
       - ApiKeyAuth: []
       summary: Remove a job from the sql database
       tags:
-      - remove
+      - Job remove
   /jobs/start_job/:
     post:
       consumes:
@@ -856,7 +856,7 @@ paths:
       - ApiKeyAuth: []
       summary: Adds a new job as "running"
       tags:
-      - add and modify
+      - Job add and modify
   /jobs/stop_job/:
     post:
       description: |-
@@ -905,7 +905,7 @@ paths:
       - ApiKeyAuth: []
       summary: Marks job as completed and triggers archiving
       tags:
-      - add and modify
+      - Job add and modify
   /jobs/stop_job/{id}:
     post:
       consumes:
@@ -961,7 +961,7 @@ paths:
       - ApiKeyAuth: []
       summary: Marks job as completed and triggers archiving
       tags:
-      - add and modify
+      - Job add and modify
   /jobs/tag_job/{id}:
     post:
       consumes:
@@ -1010,14 +1010,15 @@ paths:
       - ApiKeyAuth: []
       summary: Adds one or more tags to a job
       tags:
-      - add and modify
+      - Job add and modify
   /user/{id}:
     post:
       consumes:
       - multipart/form-data
       description: |-
         Modifies user defined by username (id) in one of four possible ways.
         If more than one formValue is set then only the highest priority field is used.
+        Only accessible from IPs registered with apiAllowedIPs configuration option.
       parameters:
       - description: Database ID of User
         in: path
@@ -1083,12 +1084,14 @@ paths:
       - ApiKeyAuth: []
       summary: Updates an existing user
       tags:
-      - add and modify
+      - User
   /users/:
     delete:
       consumes:
       - multipart/form-data
-      description: User defined by username in form data will be deleted from database.
+      description: |-
+        User defined by username in form data will be deleted from database.
+        Only accessible from IPs registered with apiAllowedIPs configuration option.
       parameters:
       - description: User ID to delete
         in: formData
@@ -1124,11 +1127,12 @@ paths:
       - ApiKeyAuth: []
       summary: Deletes a user
       tags:
-      - remove
+      - User
     get:
       description: |-
         Returns a JSON-encoded list of users.
         Required query-parameter defines if all users or only users with additional special roles are returned.
+        Only accessible from IPs registered with apiAllowedIPs configuration option.
       parameters:
       - description: If returned list should contain all users or only users with
           additional special roles
@@ -1165,11 +1169,13 @@ paths:
       - ApiKeyAuth: []
       summary: Returns a list of users
       tags:
-      - query
+      - User
     post:
       consumes:
       - multipart/form-data
-      description: User specified in form data will be saved to database.
+      description: |-
+        User specified in form data will be saved to database.
+        Only accessible from IPs registered with apiAllowedIPs configuration option.
       parameters:
       - description: Unique user ID
         in: formData
@@ -1235,12 +1241,10 @@ paths:
       - ApiKeyAuth: []
       summary: Adds a new user
       tags:
-      - add and modify
+      - User
 securityDefinitions:
   ApiKeyAuth:
     in: header
     name: X-Auth-Token
     type: apiKey
 swagger: "2.0"
-tags:
-- name: Job API
diff --git a/configs/README.md b/configs/README.md
@@ -9,6 +9,7 @@ It is supported to set these by means of a `.env` file in the project root.
 ## Configuration Options
 
 * `addr`: Type string.  Address where the http (or https) server will listen on (for example: 'localhost:80'). Default `:8080`.
+* `apiAllowedIPs`: Type string array.  Addresses from which the secured API endpoints (/users and other auth related endpoints)  can be reached
 * `user`: Type string. Drop root permissions once .env was read and the port was taken. Only applicable if using privileged port.
 * `group`: Type string.  Drop root permissions once .env was read and the port was taken. Only applicable if using privileged port.
 * `disable-authentication`: Type bool.  Disable authentication (for everything: API, Web-UI, ...). Default `false`.

diff --git a/configs/config-demo.json b/configs/config-demo.json
@@ -5,7 +5,7 @@
         "path": "./var/job-archive"
     },
     "jwts": {
-        "max-age": "2m"
+        "max-age": "2000h"
     },
     "clusters": [
         {

diff --git a/configs/config.json b/configs/config.json
@@ -43,7 +43,7 @@
     "jwts": {
         "cookieName": "",
         "validateUser": false,
-        "max-age": "2m",
+        "max-age": "2000h",
         "trustedIssuer": ""
     },
     "short-running-jobs-duration": 300