Small fixes (feast-dev#71)

dmartinol · redhatHameed · commit 3dcddcc728a8 · 2024-08-14T11:22:40.000-04:00
* Improved permission denial log

Signed-off-by: Daniele Martinoli &lt;86618610+dmartinol@users.noreply.github.com&gt;

* Added leeway option to accept tokens released in the past (up to 10")

Signed-off-by: Daniele Martinoli &lt;86618610+dmartinol@users.noreply.github.com&gt;

---------

Signed-off-by: Daniele Martinoli &lt;86618610+dmartinol@users.noreply.github.com&gt;
Signed-off-by: Abdul Hameed &lt;ahameed@redhat.com&gt;
diff --git a/sdk/python/feast/permissions/auth/oidc_token_parser.py b/sdk/python/feast/permissions/auth/oidc_token_parser.py
@@ -78,6 +78,7 @@ async def user_details_from_access_token(self, access_token: str) -> User:
                     "verify_signature": True,
                     "verify_exp": True,
                 },
+                leeway=10,  # accepts tokens generated up to 10 seconds in the past, in case of clock skew
             )
 
             if "preferred_username" not in data:
diff --git a/sdk/python/feast/permissions/enforcer.py b/sdk/python/feast/permissions/enforcer.py
@@ -44,7 +44,7 @@ def enforce_policy(
     _permitted_resources: list[FeastObject] = []
     for resource in resources:
         logger.debug(
-            f"Enforcing permission policies for {type(resource)}:{resource.name} to execute {actions}"
+            f"Enforcing permission policies for {type(resource).__name__}:{resource.name} to execute {actions}"
         )
         matching_permissions = [
             p
@@ -60,7 +60,7 @@ def enforce_policy(
                 )
                 evaluator.add_grant(
                     permission_grant,
-                    f"Permission {p.name} denied access: {permission_explanation}",
+                    f"Permission {p.name} denied execution of {[a.value.upper() for a in actions]} to {type(resource).__name__}:{resource.name}: {permission_explanation}",
                 )
 
                 if evaluator.is_decided():

Original file line number	Diff line number	Diff line change
`@@ -78,6 +78,7 @@ async def user_details_from_access_token(self, access_token: str) -> User:`
`78`	`78`	`"verify_signature": True,`
`79`	`79`	`"verify_exp": True,`
`80`	`80`	`},`
	`81`	`+ leeway=10, # accepts tokens generated up to 10 seconds in the past, in case of clock skew`
`81`	`82`	`)`
`82`	`83`
`83`	`84`	`if "preferred_username" not in data:`
Original file line number	Diff line number	Diff line change
`@@ -44,7 +44,7 @@ def enforce_policy(`
`44`	`44`	`_permitted_resources: list[FeastObject] = []`
`45`	`45`	`for resource in resources:`
`46`	`46`	`logger.debug(`
`47`		`- f"Enforcing permission policies for {type(resource)}:{resource.name} to execute {actions}"`
	`47`	`+ f"Enforcing permission policies for {type(resource).__name__}:{resource.name} to execute {actions}"`
`48`	`48`	`)`
`49`	`49`	`matching_permissions = [`
`50`	`50`	`p`
`@@ -60,7 +60,7 @@ def enforce_policy(`
`60`	`60`	`)`
`61`	`61`	`evaluator.add_grant(`
`62`	`62`	`permission_grant,`
`63`		`- f"Permission {p.name} denied access: {permission_explanation}",`
	`63`	`+ f"Permission {p.name} denied execution of {[a.value.upper() for a in actions]} to {type(resource).__name__}:{resource.name}: {permission_explanation}",`
`64`	`64`	`)`
`65`	`65`
`66`	`66`	`if evaluator.is_decided():`