Skip to content

Use AgentTokensFinder in agent_token/revoke API endpoint

Pam Artiaga requested to merge pam/agent-tokens-finder-revoke-endpoint into master

What does this MR do and why?

The AgentTokensFinder was introduced in !103170 (merged) & !104038 (merged) and used for fetching all agent tokens of an agent, and updated in !103292 (merged) to support finding a single record.

Here, the AgentTokensFinder class is used for fetching a single agent_token record in the DELETE /projects/:id/cluster_agents/:agent_id/tokens/:token_id endpoint.

Note that this follows the original behavior of revoking the token regardless of status (active or already revoked).

Issue: #363119 (closed)

Screenshots or screen recordings

Setup

Example project (ID=27):

test_browser_project

Project Agent -> Tokens page

test_browser_agent_tokens

Project agent and agent tokens in the database

test_psql_project_agents

test_psql_project_agent_tokens

Test

Revoking a single agent token

test_api_revoke-token

Token with ID=8 has now been revoked

test_api_revoke-token-browser-agent-tokens

test_api_revoke-token-psql

Revoking a single agent token that is revoked

test_api_revoke-token-revoked

When specified agent_id is not under the specified project

test_api_revoke-token-wrong-project

When specified agent does not exist

test_api_revoke-token-wrong-agent

How to set up and validate locally

  1. Create a project (or use an existing one)
  2. Set up an agent in that project
    • This will register an agent and create one agent token
  3. Create more agent tokens:
    1. Go to project Infrastructure -> Kubernetes clusters page
    2. Go to the agent's page
    3. Select the Access tokens tab
    4. Click the Create token button

Validate

Use curl to test the API endpoint

  1. Set up a project or personal access token to make sure your curl request is authorized

  2. Run the following curl request:

    curl -ki -X DELETE \
    --header "Authorization: Bearer <your project or personal access token>" \
    "https://<local gitlab url>/api/v4/projects/<project_id>/cluster_agents/<agent_id>/tokens/<token_id>"

    Example:

    curl -ki -X DELETE \
    --header "Authorization: Bearer <token>" \
    "https://gdk.test:3443/api/v4/projects/27/cluster_agents/7/tokens/6"

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Pam Artiaga

Merge request reports