From 5820ccd20833c5b7a2a3b69a8cc1d00b17bf5056 Mon Sep 17 00:00:00 2001
From: Subramanian Neelakantan <sneelakantan@yugabyte.com>
Date: Fri, 19 Jul 2024 03:06:37 +0000
Subject: [PATCH] [PLAT-14710] Do not return apiToken in response to
 getSessionInfo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Summary:
**Context**
The GET /session_info YBA API returns:
{
    "authToken": "…",
    "apiToken": "….",
    "apiTokenVersion": "….",
    "customerUUID": "uuid1",
    "userUUID": "useruuid1"
}

The apiToken and apiTokenVersion is supposed to be the last generated token that is valid. We had the following sequence of changes to this API.

https://yugabyte.atlassian.net/browse/PLAT-8028 - Do not store YBA token in YBA.

After the above fix, YBA does not store the apiToken anymore. So it cannot return it as part of the /session_info. The change for this ticket returned the hashed apiToken instead.

https://yugabyte.atlassian.net/browse/PLAT-14672 - getSessionInfo should generate and return api key in response

Since the hashed apiToken value is not useful to any client, and it broke YBM create cluster (https://yugabyte.atlassian.net/browse/CLOUDGA-22117), the first change for this ticket returned a new apiToken instead.

Note that GET /session_info is meant to get customer and user information for the currently authenticated session. This is useful for automation starting off an authenticated session from an existing/cached API token. It is not necessary for the /session_info API to return the authToken and apiToken. The client already has one of authToken or apiToken with which it invoked /session_info API. In fact generating a new apiToken whenever /session_info is called will invalidate the previous apiToken which would not be expected by the client. There is a different API /api_token to regenerate the apiToken explicitly.

**Fix in this change**
So the right behaviour is for /session_info to stop sending the apiToken in the response. In fact, the current behaviour of generating a new apiToken everytime will break a client (for example node-agent usage of /session_info here (https://github.com/yugabyte/yugabyte-db/blob/4ca56cfe27d1cae64e0e61a1bde22406e003ec04/managed/node-agent/app/server/handler.go#L19).

**Client impact of not returning apiToken in response of /session_info**

This should not impact any normal client that was using /session_info only to get the user uuid and customer uuid.

However, there might be a few clients (like YBM for example) that invoked /session_info to get the last generated apiToken from YBA. Unfortunately, this was a mis-use of this API. YBA generates the apiToken in response to a few entry point APIs like /register, /api_login and /api_token. The apiToken is long lived. YBA could choose to expire these apiTokens after a fixed amount of (long) time, but for now there is no expiration. The clients are expected to store the apiToken at their end and use the token to reestablish a session with YBA whenever needed. After establishinig a new session, clients would call GET /session_info to get the user uuid and customer uuid. This is getting fixed in YBM with https://yugabyte.atlassian.net/browse/CLOUDGA-22117. So this PLAT change should be taken up by YBM only after CLOUDGA-22117 is fixed.

Test Plan:
* Manually verified that session_info does not return authToken
* Shubham verified that node-agent works with this fix. Thanks Shubham!

Reviewers: svarshney, dkumar, tbedi, #yba-api-review!

Reviewed By: svarshney

Subscribers: yugaware

Differential Revision: https://phorge.dev.yugabyte.com/D36712
---
 .../java/com/yugabyte/yw/controllers/SessionController.java   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/managed/src/main/java/com/yugabyte/yw/controllers/SessionController.java b/managed/src/main/java/com/yugabyte/yw/controllers/SessionController.java
index c22882d626f5..56d4343603b4 100644
--- a/managed/src/main/java/com/yugabyte/yw/controllers/SessionController.java
+++ b/managed/src/main/java/com/yugabyte/yw/controllers/SessionController.java
@@ -193,8 +193,8 @@ public Result getSessionInfo(Http.Request request) {
     SessionInfo sessionInfo =
         new SessionInfo(
             authCookie.isPresent() ? authCookie.get().value() : null,
-            user.upsertApiToken(),
-            user.getApiTokenVersion(),
+            null,
+            null,
             cust.getUuid(),
             user.getUuid());
     return withData(sessionInfo);