Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-7541

[redhat-3.11] Global read-only super user call some superuser APIs failed

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • quay-v3.11.4
    • quay-v3.12.0
    • quay

      Description of problem:

      After setting a user as global read-only super user,  this user call below superuser APIs failed.

      GET /api/v1/superuser/users/
      GET /api/v1/superuser/logs
      GET /api/v1/superuser/users/{namespace}/quota
      GET /api/v1/superuser/registrysize/
      GET /api/v1/superuser/keys
      GET /api/v1/superuser/keys/{kid}

      Version-Release number of selected component (if applicable):

      quay-operator-bundle-container-v3.12.0-16
      ------------------------------
      registry.redhat.io/quay/quay-rhel8@sha256:159d866d862b94cb954c1765393f963cd648b79892e8cc7a19a4df42f767c0cd
      ------------------------------
      registry.redhat.io/quay/quay-rhel8@sha256:d0735d2e3bf076ac5d4b0c68bf791c29a214b94ffbcc98f57aa6bb564649f204
      ------------------------------

      How reproducible:

      1. enable GLOBAL_READONLY_SUPER_USERS in quay config.yaml

      SUPER_USERS:
        - whuquay
      GLOBAL_READONLY_SUPER_USERS:
        - whuro 
      BROWSER_API_CALLS_XHR_ONLY: false
      FEATURE_UI_V2: true
      ........

      2. Create a normal user "user1" , a super user "whuquay" and a global read-only super user "whuro"

      3. log in quay by normal user "user1" and create a repository "user1_org/user1_repo"

      4  Call  build APIs by global read-only super user

      Actual results:

      Global read-only super user call some superuser APIs failed

      =========To test super user APIs by super user==========
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call createInstallUser by admin super user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X POST -H 'Content-Type: application/json' -H "Authorization: Bearer JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG"  --data '{"username": "installuser"}' https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/users/
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100   252  100   225  100    27    166     19  0:00:01  0:00:01 --:--:--   186
      {
        "username": "installuser",
        "email": null,
        "password": "2E5VAAYH57XQQK1PXJMNUTJABQRU896R",
        "encrypted_password": "6Upk90Cwfrm6WwjmDK+ka6RdpVkSH0FFUX1rET/xTmOG7R9+glYr6zQK5Zi7EHfzlb6iW4R3xq5R5hmWRzZzl5w68kUq5bAIs5dlXK2729k="
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call listAllUsers by admin super user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X GET -H "Content-Type: application/json" -H "Authorization: Bearer JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG" https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/users/
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100  5283  100  5283    0     0   5025      0  0:00:01  0:00:01 --:--:--  5026
      {
        "users": [
          {
            "kind": "user",
            "name": "whuquay",
            "username": "whuquay",
            "email": "quay+test@redhat.com",
            "verified": true,
            "avatar": {
              "name": "whuquay",
              "hash": "369072bc5a39f354a0e8e431e15427764f9d02f7ff266b4b9adffbc0128bed65",
              "color": "#6b6ecf",
              "kind": "user"
            },
            "super_user": true,
            "enabled": true,
            "quotas": [],
            "quota_report": {
              "quota_bytes": 0,
              "configured_quota": null,
              "running_backfill": "complete",
              "backfill_status": "complete"
            }
          },
          
       .........
          {
            "kind": "user",
            "name": "installuser",
            "username": "installuser",
            "email": "05d7ce27-6328-44bc-bb00-19d4d2a3035f",
            "verified": true,
            "avatar": {
              "name": "installuser",
              "hash": "64417d7fe37741aaec44017cb17c8be8f103a240402b671741f0b43b6c1ebc18",
              "color": "#2ca02c",
              "kind": "user"
            },
            "super_user": false,
            "enabled": true,
            "quotas": [],
            "quota_report": {
              "quota_bytes": 0,
              "configured_quota": null,
              "running_backfill": "waiting",
              "backfill_status": "waiting"
            }
          }
        ]
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call listAllUsers by read-only user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X GET -H "Content-Type: application/json" -H "Authorization: Bearer 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4" https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/users/
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100   277  100   277    0     0    113      0  0:00:02  0:00:02 --:--:--   113
      {
        "detail": "Unauthorized",
        "error_message": "Unauthorized",
        "error_type": "insufficient_scope",
        "title": "insufficient_scope",
        "type": "https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/error/insufficient_scope",
        "status": 403
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call listAllLogs by admin super user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X GET -H "Content-Type: application/json" -H "Authorization: Bearer JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG" https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/logs
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100 13075  100 13075    0     0  12951      0  0:00:01  0:00:01 --:--:-- 12958
      {
        "start_time": "Tue, 02 Jul 2024 08:16:23 -0000",
        "end_time": "Thu, 04 Jul 2024 08:16:23 -0000",
        "logs": [
          {
            "kind": "user_create",
            "metadata": {
              "email": null,
              "username": "installuser",
              "superuser": "whuquay",
              "oauth_token_id": 2,
              "oauth_token_application_id": "2NW37JCUFGGS3PZRNU1G",
              "oauth_token_application": "curl"
            },
            
      ........
                "name": "user1_org",
                "hash": "776804aac1b838e463c049cbbc27d9cbc73329e4cae93f11226fafe87e479888",
                "color": "#9c9ede",
                "kind": "org"
              }
            }
          }
        ],
        "next_page": "gAAAAABmhQjXQwyCu_z8vRzKjYvrfbtxcQI_HBo9IcXFkD3TxzJnbMbsuq2528mtrlMxcvFLIuXl3B82zLFD8sk52y670QFN7_OzFTffCJEJtA-AxufUqYSEPoJ1OmwBD9SpYY7raddWchwqqWX4EVAURzvH2U53ZiPk9-1PRrmvnrW0qLUOzj8KblcsKjt19O1cLfBcZmUkz2oOe3VoAzGkSWGM6uZ94Q=="
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call listAllLogs by read-only user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X GET -H "Content-Type: application/json" -H "Authorization: Bearer 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4" https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/logs
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100   277  100   277    0     0    276      0  0:00:01  0:00:01 --:--:--   277
      {
        "detail": "Unauthorized",
        "error_message": "Unauthorized",
        "error_type": "insufficient_scope",
        "title": "insufficient_scope",
        "type": "https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/error/insufficient_scope",
        "status": 403
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call createOrganizationQuotaSuperUser by admin super user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X POST -H 'Content-Type: application/json' -H "Authorization: Bearer JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG"  --data '{"limit_bytes": 2147483648}' https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/users/user3/quota
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100   335  100   308  100    27    303     26  0:00:01  0:00:01 --:--:--   330
      {
        "detail": "Quota for 'user3' already exists",
        "error_message": "Quota for 'user3' already exists",
        "error_type": "invalid_request",
        "title": "invalid_request",
        "type": "https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/error/invalid_request",
        "status": 400
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call listOrganizationQuotaSuperUser by admin super user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
        0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
      ------------------------------
      $ curl -k -X GET -H 'Content-Type: application/json' -H "Authorization: Bearer JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG"   https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/users/user3/quota
      100   179  100   179    0     0    179      0  0:00:01 --:--:--  0:00:01   179
      [
        {
          "id": 1,
          "limit_bytes": 2147483648,
          "limit": "2.0 GiB",
          "default_config": false,
          "limits": [
            {
              "id": 1,
              "type": "Warning",
              "limit_percent": 70
            }
          ],
          "default_config_exists": false
        }
      ]
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call listOrganizationQuotaSuperUser by read-only  user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X GET -H 'Content-Type: application/json' -H "Authorization: Bearer 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4"   https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/users/user3/quota
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100   277  100   277    0     0    272      0  0:00:01  0:00:01 --:--:--   272
      {
        "detail": "Unauthorized",
        "error_message": "Unauthorized",
        "error_type": "insufficient_scope",
        "title": "insufficient_scope",
        "type": "https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/error/insufficient_scope",
        "status": 403
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call getRegistrySize by admin super user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X GET -H 'Content-Type: application/json' -H "Authorization: Bearer JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG"   https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/registrysize/
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100    71  100    71    0     0     70      0  0:00:01  0:00:01 --:--:--    70
      {
        "size_bytes": 0,
        "last_ran": null,
        "running": false,
        "queued": false
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call getRegistrySize by read-only user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X GET -H 'Content-Type: application/json' -H "Authorization: Bearer 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4"   https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/registrysize/
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100   277  100   277    0     0    276      0  0:00:01  0:00:01 --:--:--   276
      {
        "detail": "Unauthorized",
        "error_message": "Unauthorized",
        "error_type": "insufficient_scope",
        "title": "insufficient_scope",
        "type": "https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/error/insufficient_scope",
        "status": 403
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call createServiceKey by admin super user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X POST -H 'Content-Type: application/json' -H "Authorization: Bearer JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG"  --data '{"expiration":null,"name":"whukeytest","service":"whusvc"}' https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/keys
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100  2346  100  2288  100    58   2125     53  0:00:01  0:00:01 --:--:--  2180
      {
        "kid": "FLI_yzut8ywCkyVn7uqH9vCcNmkKVEkEiKyd_klLwMM",
        "name": "whukeytest",
        "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAz9ulCNILdZxkKYncugnEFx5KdMRzEfhjS0UIJia48NFfC3+q\nxl+/X2ysyTu+6XE6mXBUlF3/1S92VLmdTpLmKkCK5zSpfXJPRJ/zRlAi/eTwqrMO\nVNTAZGGIVimie2M7bn4EEIip1R97PxOQ26Yyg57v4F7kNZZ+M3wFJReYJ9ywD2Y/\nqePn1xZ/DpOn5TUmmzik6Z8oTIMFtOhTJ/1nukPfqcnwtsb0O8pxhIIkxGqzr6jE\n8BbmjB0ko5KHfqCrwzoR0M6X+cAUA2gveCvUUlXR2czFvjG9X7Gi/R5JCAwwY9qn\neIhj6jwn3gHiFYkl7fwR++ecLwZ0vFFZIDN98QIDAQABAoIBAEue6lzaJgck3Z/r\nIx2f3fJXN9lhe0fHaUCCHePbZJ9gXMbPLK89OF+cJwSTMvK1Gg+muW69AA1sVg2e\n9ecXNJucnaxeEWetRb9+vcAP+ZsLRq+jswwT1ubuQO6v+QgQ4xdgy1PElJ0P9gPN\nt37h6TDPiw/DFh2U4dcTQL/s5JNjY5ULTbiLHF+d5SOrh/zw+y2YioIG+03MrYy2\nL2URFFJ05fDXv+XRcqaCYNJ32tUN39+QOiEBMSQHVeL/CQpyRWQQNo0HqBHmLzya\nvqAiH/fvdLro3WH8kRqKFQEHQZ80J5moK4L6tw+7oNmxZ3JHbdP0xVZ1rlNWlgVo\n+IV8a9ECgYEA9Tgr1QpA3+c5yIG8lmTyUn6hi6B+R4YC17q3BlcaUYzKgj6dSVvC\n6zy3xzinDT6/4heLJNtgxtrmJaTo6ZDbL3ws8vcSoAxIhQyJVlSrPevPXv+wgJ64\nPzCObbtWBXybKE2hFR6S5gYPEfOzWS8KT4StvbPf1ZXbIhY/Y2JCgsUCgYEA2P78\n+MKm1S/BLPCfJ3wxLQHN/tWl1F2qb7GXrOBX1eaY8BkollTZXJVpJb16KqgBzJYK\n3Ep9N3YdIbxfrqQXaOeSfNw5FaQyFteVV0Qy56gfhH0iGNW2bIKSb8AcIjDgzguO\nDD7xRY+KWc/eqlwm27NUm26u2uQPYa4v9aayUT0CgYBWP/KS1S9qUX7uektlro3Y\n3Ddf0Ax6hbU8Qa0casiUBGw6EWHrKn5NlSaiyNdg/kApetRzG0JXzyiB9xYBCPU/\nJ3L75lFDv+5F9dncZp1wgx+GL3LaWnk9qIuAJxMjjOdZ7qwIrJ9IjrsAOnJLnRMI\nUwd1IO5KxpGz1JVpFGeGbQKBgQCpdnE/IFzDzriRDRVt86o/2NHz+wu3jrKk6c9m\n/gj6jkzP7QXqaTca+8AS7idzGqPVDzRKF440evSDPSaIL7PshDS9eArIoONRPWlu\nrl8G1SBQCp1PQc9mbI5J4YDXHs7hetqjK6Cmz1Ofkhv1dWQPXbxsaoL5hPOSOENS\nF63YjQKBgAvrGWDciYX5UoGQNGU+5U5vtf2+u+iXr2TkrY9xwBqUp+nq9giVmk2Z\n6gSapRkE/CYUP2gyFs/GtgLFFXGEWQIc8fIVRx/FaOI4BIEXmO9iarTW7v0GPeHH\nomjw4ZT+VUueVLWV1j6f3KnnvJgOGBhz8auHfzTO39BQRSWFgYti\n-----END RSA PRIVATE KEY-----\n",
        "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz9ulCNILdZxkKYncugnE\nFx5KdMRzEfhjS0UIJia48NFfC3+qxl+/X2ysyTu+6XE6mXBUlF3/1S92VLmdTpLm\nKkCK5zSpfXJPRJ/zRlAi/eTwqrMOVNTAZGGIVimie2M7bn4EEIip1R97PxOQ26Yy\ng57v4F7kNZZ+M3wFJReYJ9ywD2Y/qePn1xZ/DpOn5TUmmzik6Z8oTIMFtOhTJ/1n\nukPfqcnwtsb0O8pxhIIkxGqzr6jE8BbmjB0ko5KHfqCrwzoR0M6X+cAUA2gveCvU\nUlXR2czFvjG9X7Gi/R5JCAwwY9qneIhj6jwn3gHiFYkl7fwR++ecLwZ0vFFZIDN9\n8QIDAQAB\n-----END PUBLIC KEY-----\n",
        "service": "whusvc"
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call listServiceKeys by admin super user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X GET -H 'Content-Type: application/json' -H "Authorization: Bearer JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG"   https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/keys
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100  4872  100  4872    0     0   4839      0  0:00:01  0:00:01 --:--:--  4842
      {
        "keys": [
          {
            "approval": {
              "approval_type": "ServiceKeyApprovalType.AUTOMATIC",
              "approved_date": "Wed, 03 Jul 2024 01:58:01 GMT",
              "approver": null,
              "notes": ""
            },
            "created_date": "Wed, 03 Jul 2024 01:58:01 GMT",
      .........
              "n": "z9ulCNILdZxkKYncugnEFx5KdMRzEfhjS0UIJia48NFfC3-qxl-_X2ysyTu-6XE6mXBUlF3_1S92VLmdTpLmKkCK5zSpfXJPRJ_zRlAi_eTwqrMOVNTAZGGIVimie2M7bn4EEIip1R97PxOQ26Yyg57v4F7kNZZ-M3wFJReYJ9ywD2Y_qePn1xZ_DpOn5TUmmzik6Z8oTIMFtOhTJ_1nukPfqcnwtsb0O8pxhIIkxGqzr6jE8BbmjB0ko5KHfqCrwzoR0M6X-cAUA2gveCvUUlXR2czFvjG9X7Gi_R5JCAwwY9qneIhj6jwn3gHiFYkl7fwR--ecLwZ0vFFZIDN98Q"
            },
            "kid": "FLI_yzut8ywCkyVn7uqH9vCcNmkKVEkEiKyd_klLwMM",
            "metadata": {
              "created_by": "Quay Superuser Panel",
              "creator": "whuquay",
              "ip": "10.128.2.5"
            },
            "name": "whukeytest",
            "rotation_duration": null,
            "service": "whusvc"
          }
        ]
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call listServiceKeys by read-only user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X GET -H 'Content-Type: application/json' -H "Authorization: Bearer 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4"   https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/keys
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100   277  100   277    0     0    221      0  0:00:01  0:00:01 --:--:--   221
      {
        "detail": "Unauthorized",
        "error_message": "Unauthorized",
        "error_type": "insufficient_scope",
        "title": "insufficient_scope",
        "type": "https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/error/insufficient_scope",
        "status": 403
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call approveServiceKey by admin super user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X POST -H 'Content-Type: application/json' -H "Authorization: Bearer JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG" --data '{"notes":"aaaaa"}'  https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/approvedkeys/FLI_yzut8ywCkyVn7uqH9vCcNmkKVEkEiKyd_klLwMM
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100    17    0     0  100    17      0     17  0:00:01 --:--:--  0:00:01    17
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call getServiceKey by admin super user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X GET -H 'Content-Type: application/json' -H "Authorization: Bearer JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG"   https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/keys/FLI_yzut8ywCkyVn7uqH9vCcNmkKVEkEiKyd_klLwMM
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100  1237  100  1237    0     0    934      0  0:00:01  0:00:01 --:--:--   933
      {
        "approval": {
          "approval_type": "ServiceKeyApprovalType.SUPERUSER",
          "approved_date": "Wed, 03 Jul 2024 08:16:30 GMT",
          "approver": {
            "avatar": {
              "color": "#6b6ecf",
              "hash": "369072bc5a39f354a0e8e431e15427764f9d02f7ff266b4b9adffbc0128bed65",
              "kind": "user",
              "name": "whuquay"
            },
            "email": "quay+test@redhat.com",
            "enabled": true,
            "kind": "user",
            "name": "whuquay",
            "quota_report": {
              "backfill_status": "complete",
              "configured_quota": null,
              "quota_bytes": 0,
              "running_backfill": "complete"
            },
            "quotas": [],
            "super_user": true,
            "username": "whuquay",
            "verified": true
          },
          "notes": ""
        },
        "created_date": "Wed, 03 Jul 2024 08:16:30 GMT",
        "expiration_date": null,
        "jwk": {
          "e": "AQAB",
          "kid": "FLI_yzut8ywCkyVn7uqH9vCcNmkKVEkEiKyd_klLwMM",
          "kty": "RSA",
          "n": "z9ulCNILdZxkKYncugnEFx5KdMRzEfhjS0UIJia48NFfC3-qxl-_X2ysyTu-6XE6mXBUlF3_1S92VLmdTpLmKkCK5zSpfXJPRJ_zRlAi_eTwqrMOVNTAZGGIVimie2M7bn4EEIip1R97PxOQ26Yyg57v4F7kNZZ-M3wFJReYJ9ywD2Y_qePn1xZ_DpOn5TUmmzik6Z8oTIMFtOhTJ_1nukPfqcnwtsb0O8pxhIIkxGqzr6jE8BbmjB0ko5KHfqCrwzoR0M6X-cAUA2gveCvUUlXR2czFvjG9X7Gi_R5JCAwwY9qneIhj6jwn3gHiFYkl7fwR--ecLwZ0vFFZIDN98Q"
        },
        "kid": "FLI_yzut8ywCkyVn7uqH9vCcNmkKVEkEiKyd_klLwMM",
        "metadata": {
          "created_by": "Quay Superuser Panel",
          "creator": "whuquay",
          "ip": "10.128.2.5"
        },
        "name": "whukeytest",
        "rotation_duration": null,
        "service": "whusvc"
      }
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      -> super user token    : JSRudyKOLEHBM6fk0C5nwOAMoY9l1Kx25qBocyfG
      -> readonly user token : 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4
      -> normal user token   : Nn1PqRVBa6qodykQQfuDPqS0RuMWwllJbdV5l0AH
      ->
      -> call getServiceKey by read-only user
      =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*==*=*=
      ------------------------------
      $ curl -k -X GET -H 'Content-Type: application/json' -H "Authorization: Bearer 2cPDNXw7OkWccP1pfzyNBW44zxrM2UtPnAqDHTw4"   https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/superuser/keys/FLI_yzut8ywCkyVn7uqH9vCcNmkKVEkEiKyd_klLwMM
        % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                       Dload  Upload   Total   Spent    Left  Speed
      100   277  100   277    0     0    278      0 --:--:-- --:--:-- --:--:--   278
      {
        "detail": "Unauthorized",
        "error_message": "Unauthorized",
        "error_type": "insufficient_scope",
        "title": "insufficient_scope",
        "type": "https://quayregistry-quay-quay-enterprise.apps.whu414az49.qe.azure.devcluster.openshift.com/api/v1/error/insufficient_scope",
        "status": 403
      } 

      Expected results

      Global read-only super user call all superuser APIs successfully.

       

            bcaton@redhat.com Brandon Caton
            rhwhu Weihua Hu
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: