Personal settings auth tokens #24703

ChristophWurst · 2016-05-18T13:56:44Z

requires #24686, #24677
fixes #23458

TODO:

rebase onto add method to query all user auth tokens #24686
rebase onto a single token provider suffices #24677
list browser sessions and devices
add button to invalidate token
add button to create a new device token
unit tests

Ideas for follow-up PRs:

Allow omitting the dashes of device tokens, so users can use both 'ABCDEFGHIJKLMNOPQRST' and 'ABCDE-FGHIJ-KLMNO-PQRST'
Don't allow the users to kill the active browser session as that would log them out (probably unintended)
Convert sync client user agents like Mozilla/5.0 (Linux) mirall/2.1.1 to something like ownCloud sync client 2.1.1

cc @MorrisJobke

nickvergessen · 2016-05-18T14:43:00Z

lib/private/Server.php

@@ -837,6 +837,13 @@ public function getUserSession() {
 	}

 	/**
+	 * @return Authentication\Token\DefaultTokenProvider


Please either use the full class or import the full class

Also only public interfaces shall be returned™

If there is no public interface yet, because it's not yet done add a FIXME/TODO to make that clear

But this is an internal only method.

Then @internal ? ;)

MorrisJobke · 2016-05-18T15:46:12Z

After applying this:

diff --git a/settings/css/settings.css b/settings/css/settings.css
index be61265..42e2594 100644
--- a/settings/css/settings.css
+++ b/settings/css/settings.css
@@ -100,21 +100,27 @@ input#identity {
 table.nostyle label { margin-right: 2em; }
 table.nostyle td { padding: 0.2em 0; }

-#sessions,
-#devices {
-   min-height: 180px;
-}
 #sessions table,
 #devices table {
    width: 100%;
-   min-height: 150px;
-   padding-top: 25px;
 }
 #sessions table th,
 #devices table th {
    font-weight: 800;
 }

+#sessions table th,
+#sessions table td,
+#devices table th,
+#devices table td {
+   padding: 10px;
+}
+
+#sessions .token-list td,
+#devices .token-list td {
+   border-top: 1px solid #DDD;
+}
+
 /* USERS */
 #newgroup-init a span { margin-left: 20px; }
 #newgroup-init a span:before {
diff --git a/settings/js/authtoken_view.js b/settings/js/authtoken_view.js
index 0ca1682..b2bdee8 100644
--- a/settings/js/authtoken_view.js
+++ b/settings/js/authtoken_view.js
@@ -50,7 +50,9 @@
            list.html('');

            tokens.forEach(function(token) {
-               var html = _this.template(token.toJSON());
+               var t = token.toJSON();
+               t.lastActivity = moment(t.lastActivity, 'X').format('LLL');
+               var html = _this.template(t);
                list.append(html);
            });
        },

It looks like this:

MorrisJobke · 2016-05-18T15:46:59Z

@ChristophWurst @PVince81 What is the best way in Backbone to apply the date format stuff? Should this be a template filter?

PVince81 · 2016-05-18T15:57:20Z

So far I'd just preformat the date before passing it to the template as string.
See how it's done in here: https://github.com/owncloud/core/blob/master/apps/files/js/mainfileinfodetailview.js#L148

nickvergessen · 2016-05-18T16:03:09Z

settings/routes.php

@@ -36,7 +36,8 @@
 $application->registerRoutes($this, [
 	'resources' => [
 		'groups' => ['url' => '/settings/users/groups'],
-		'users' => ['url' => '/settings/users/users']
+		'users' => ['url' => '/settings/users/users'],
+		'AuthSettings' => ['url' => '/settings/personal/authtokens'],


if we want this information to be available on the client one day, it needs to be OCS, but I think for now it's okay

ChristophWurst · 2016-05-19T10:20:57Z

(Note that the token is now 4x5chars and not 5x5 like in the screenshot)

ChristophWurst · 2016-05-19T10:21:33Z

@MorrisJobke @LukasReschke @rullzer review please

PVince81 · 2016-05-20T08:36:50Z

BUG: use $(...).tooltip() on the trashbin element to make the tooltip look better

PVince81 · 2016-05-20T08:40:21Z

TODO: make the field for the generated token a real read-only input field + autofocus + autoselect on click, just like the permalink one, see https://github.com/owncloud/core/blob/master/apps/files/js/mainfileinfodetailview.js#L64

PVince81 · 2016-05-20T08:43:26Z

I'd even say, as soon as the token field gets displayed, autoselect it. If the user clicks away and clicks on it again, reselect again. Goal is to be able to quickly Ctrl+C.

PVince81 · 2016-05-20T08:47:47Z

do we want the date in the table to be human readable, like "1 hour ago" + tooltip with full date ? Use OC.Util.relativeModifiedDate(timeStamp) for that

PVince81 · 2016-05-20T08:51:00Z

settings/js/authtoken_view.js

+	var SubView = Backbone.View.extend({
+		collection: null,
+		type: 0,
+		template: Handlebars.compile(TEMPLATE_TOKEN),


compile the template at usage time.

See https://github.com/owncloud/core/blob/v8.2.0/apps/files_versions/js/versionstabview.js#L146

ChristophWurst · 2016-05-20T10:04:03Z

settings/css/settings.css

+}
+
+#device-new-token {
+	width: 186px;


if someone knows a better way let me know

PVince81 · 2016-05-20T10:47:33Z

minor: missing empty message for the lists when empty. I'd suggest to hide the table header and the message "You've linked these devices" when the list is empty. Challenge is to make the list appear as soon as the first entry gets added

PVince81 · 2016-05-20T10:48:05Z

bug? I can create several devices with the same name

ChristophWurst · 2016-05-20T11:00:52Z

~~I think i broke something, no browser sessions are listed now~~ fixed

ChristophWurst · 2016-05-23T12:02:34Z

bug? I can create several devices with the same name

Not a bug in my opinion, but I'll open an enhancement issue.

PVince81 · 2016-05-23T12:03:38Z

Fair enough 👍

PVince81 · 2016-05-23T12:04:03Z

Second review ? @nickvergessen @schiesbn @MorrisJobke @LukasReschke @Xenopathic @rullzer

nickvergessen · 2016-05-23T12:11:50Z

lib/private/Authentication/Token/DefaultTokenMapper.php

+		$qb = $this->db->getQueryBuilder();
+		$qb->delete('authtoken')
+			->where($qb->expr()->eq('id', $qb->createNamedParameter($id)))
+			->andWhere($qb->expr()->eq('uid', $qb->createNamedParameter($user->getUID())));


not required, because id is unique?

Or don't you check ownership before

Exactly, I want to prevent users deleting other users tokens

https://github.com/owncloud/core/pull/24703/files#diff-86dbc8c463c390f9fcc767a856c332a3R147

nickvergessen · 2016-05-23T12:13:41Z

Works, and I agree that the same name is "not a bug"

👍

oparoz · 2016-05-31T19:42:47Z

Cool feature, thanks guys :)

lock · 2019-08-05T16:02:13Z

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

ChristophWurst added the security label May 18, 2016

ChristophWurst added this to the 9.1-current milestone May 18, 2016

ChristophWurst added the 2 - Developing label May 18, 2016

ChristophWurst changed the title ~~Personal settings auth tokens~~ [WIP] Personal settings auth tokens May 18, 2016

ChristophWurst force-pushed the personal-settings-auth-tokens branch from aea0805 to 0e32440 Compare May 18, 2016 14:34

nickvergessen reviewed May 18, 2016
View reviewed changes

ChristophWurst force-pushed the personal-settings-auth-tokens branch from 0e32440 to 8a9aec1 Compare May 18, 2016 14:52

nickvergessen reviewed May 18, 2016
View reviewed changes

ChristophWurst force-pushed the personal-settings-auth-tokens branch 6 times, most recently from fef6e35 to 4fae242 Compare May 19, 2016 10:19

ChristophWurst added 3 - To Review and removed 2 - Developing labels May 19, 2016

ChristophWurst changed the title ~~[WIP] Personal settings auth tokens~~ Personal settings auth tokens May 19, 2016

ChristophWurst mentioned this pull request May 19, 2016

'Login failed' log entries when using token auth #24727

Closed

ChristophWurst force-pushed the personal-settings-auth-tokens branch from 4fae242 to 90c3985 Compare May 19, 2016 11:52

PVince81 reviewed May 20, 2016
View reviewed changes

ChristophWurst force-pushed the personal-settings-auth-tokens branch from 90c3985 to f90d548 Compare May 20, 2016 09:58

ChristophWurst reviewed May 20, 2016
View reviewed changes

settings/css/settings.css

}

#device-new-token {

width: 186px;

Copy link

Contributor Author

ChristophWurst May 20, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if someone knows a better way let me know

ChristophWurst force-pushed the personal-settings-auth-tokens branch from f90d548 to 124db68 Compare May 20, 2016 10:57

ChristophWurst force-pushed the personal-settings-auth-tokens branch 2 times, most recently from 5895033 to 74277c2 Compare May 23, 2016 07:10

ChristophWurst added 3 commits May 23, 2016 09:11

list user's auth tokens on the personal settings page

12431aa

add button to add new device tokens

6495534

add button to invalidate browser sessions/device tokens

74277c2

ChristophWurst added comp:authentication and removed security labels May 23, 2016

ChristophWurst mentioned this pull request May 23, 2016

Prevent device tokens with same name #24778

Closed

nickvergessen reviewed May 23, 2016
View reviewed changes

nickvergessen added 4 - To release and removed 3 - To Review labels May 23, 2016

PVince81 merged commit 57525a0 into master May 23, 2016

PVince81 deleted the personal-settings-auth-tokens branch May 23, 2016 12:17

ChristophWurst mentioned this pull request May 24, 2016

remove debug console.log #24809

Merged

ChristophWurst mentioned this pull request Jun 1, 2016

Show clients connected to the account #6120

Closed

MorrisJobke mentioned this pull request Jun 15, 2016

Show login-history to user nextcloud/server#116

Closed

SamuAlfageme mentioned this pull request Aug 1, 2017

Sessions of Desktop, iOS and Android clients should be shown #27845

Closed

lock bot locked as resolved and limited conversation to collaborators Aug 5, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Personal settings auth tokens #24703

Personal settings auth tokens #24703

ChristophWurst commented May 18, 2016 •

edited

Loading

nickvergessen May 18, 2016

nickvergessen May 18, 2016

nickvergessen May 18, 2016

MorrisJobke May 18, 2016

nickvergessen May 18, 2016

MorrisJobke commented May 18, 2016

MorrisJobke commented May 18, 2016

PVince81 commented May 18, 2016

nickvergessen May 18, 2016

ChristophWurst commented May 19, 2016

ChristophWurst commented May 19, 2016

PVince81 commented May 20, 2016 •

edited by ChristophWurst

Loading

PVince81 commented May 20, 2016 •

edited by ChristophWurst

Loading

PVince81 commented May 20, 2016

PVince81 commented May 20, 2016 •

edited by ChristophWurst

Loading

PVince81 May 20, 2016

ChristophWurst May 20, 2016

PVince81 commented May 20, 2016 •

edited by ChristophWurst

Loading

PVince81 commented May 20, 2016

ChristophWurst commented May 20, 2016 •

edited

Loading

ChristophWurst commented May 23, 2016

PVince81 commented May 23, 2016

PVince81 commented May 23, 2016

nickvergessen May 23, 2016

nickvergessen May 23, 2016

ChristophWurst May 23, 2016

nickvergessen commented May 23, 2016

oparoz commented May 31, 2016

lock bot commented Aug 5, 2019

Personal settings auth tokens #24703

Personal settings auth tokens #24703

Conversation

ChristophWurst commented May 18, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

MorrisJobke commented May 18, 2016

MorrisJobke commented May 18, 2016

PVince81 commented May 18, 2016

Choose a reason for hiding this comment

ChristophWurst commented May 19, 2016

ChristophWurst commented May 19, 2016

PVince81 commented May 20, 2016 • edited by ChristophWurst Loading

PVince81 commented May 20, 2016 • edited by ChristophWurst Loading

PVince81 commented May 20, 2016

PVince81 commented May 20, 2016 • edited by ChristophWurst Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

PVince81 commented May 20, 2016 • edited by ChristophWurst Loading

PVince81 commented May 20, 2016

ChristophWurst commented May 20, 2016 • edited Loading

ChristophWurst commented May 23, 2016

PVince81 commented May 23, 2016

PVince81 commented May 23, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nickvergessen commented May 23, 2016

oparoz commented May 31, 2016

lock bot commented Aug 5, 2019

ChristophWurst commented May 18, 2016 •

edited

Loading

PVince81 commented May 20, 2016 •

edited by ChristophWurst

Loading

PVince81 commented May 20, 2016 •

edited by ChristophWurst

Loading

PVince81 commented May 20, 2016 •

edited by ChristophWurst

Loading

PVince81 commented May 20, 2016 •

edited by ChristophWurst

Loading

ChristophWurst commented May 20, 2016 •

edited

Loading