UID2-3506 Add functionality on oncall page to list related keysets and rotate them #329

cYKatherine · 2024-08-05T09:35:11Z

UI looks below. It will highlight the reason why the keyset is related to the participant. Also tested the rotation works.

webroot/js/participantSummary.js

src/main/resources/localstack/s3/core/keysets/keysets.json

src/main/java/com/uid2/admin/vertx/service/SharingService.java

src/main/java/com/uid2/admin/Main.java

src/test/java/com/uid2/admin/vertx/ClientKeyServiceTest.java

webroot/js/participantSummary.js

src/main/java/com/uid2/admin/vertx/service/SharingService.java

vishalegbert-ttd · 2024-08-07T03:29:28Z

webroot/js/participantSummary.js

+        const ja = JSON.parse(keysets);
+        var rotateKeysetsMessage = '';
+        ja.forEach((keyset) => {
+            var url = `/api/key/rotate_keyset_key?min_age_seconds=3600&keyset_id=${keyset.keyset_id}&force=true`;


I doublechecked the code, the min age seconds doesn't matter if we set force to true, maybe we can just set min_age_seconds=0 here

Yes, I tried setting min_age_seconds=0 but it will return with 404 as it needs a positive integer 😢 I can change it to 1 if that makes more sense 🤷‍♀️

should we make min_age_seconds=0 not return a 404 then and get rid of force?

Lemme separate that to a new ticket as it's behaviour change 😢 and need some extra frontend work

https://atlassian.thetradedesk.com/jira/browse/UID2-3898

vishalegbert-ttd · 2024-08-07T03:31:11Z

Just want to confirm, it looks like the Rotate All Keys will also rotate master keys and site keys for ID_READER?

cYKatherine · 2024-08-07T03:34:20Z

Just want to confirm, it looks like the Rotate All Keys will also rotate master keys and site keys for ID_READER?

Technically speaking this shouldn't happen. master keys and site keys (with site id -1 and -2) shouldn't have any allowed_sites or allowed_types. I checked our integ and prod environment and attached the screenshot.

src/main/java/com/uid2/admin/vertx/service/SharingService.java

jon8787 · 2024-08-07T05:26:03Z

src/main/java/com/uid2/admin/vertx/service/SharingService.java

+                // b. If this participant has a client key with ID_READER role, we want to rotate all the keysets where allowed_sites is set to null
+                // c. Keysets where allowed_sites include the leaked site
+                // d. Keysets belonging to the leaked site itself
+                if (containsAny(keyset.getValue().getAllowedTypes(), clientTypes) ||


Btw there is a method canClientAccessKey which is the source of truth.

Would be great if we could use that here, although might not be feasible. If we can't use it, still worth mentioning it here as a comment.

jon8787 · 2024-08-07T05:27:29Z

src/test/java/com/uid2/admin/vertx/SharingServiceTest.java

+    void RelatedKeysetSetsWithClientTypes(Vertx vertx, VertxTestContext testContext) {
+        fakeAuth(Role.MAINTAINER);
+
+        AdminKeyset adminKeyset1 = new AdminKeyset(3, 5, "test", Set.of(4,6,7), Instant.now().getEpochSecond(),true, true, new HashSet<>(Arrays.asList(ClientType.DSP, ClientType.PUBLISHER)));


might be worth checking out the test cases for canClientAccessKey

jon8787 · 2024-08-07T05:28:28Z

webroot/js/participantSummary.js

+        const ja = JSON.parse(keysets);
+        var rotateKeysetsMessage = '';
+        ja.forEach((keyset) => {
+            var url = `/api/key/rotate_keyset_key?min_age_seconds=3600&keyset_id=${keyset.keyset_id}&force=true`;


should we make min_age_seconds=0 not return a 404 then and get rid of force?

jon8787 · 2024-08-07T23:50:21Z

did we add some text / warning about what will happen when you click Rotate?

cYKatherine · 2024-08-08T00:45:31Z

did we add some text / warning about what will happen when you click Rotate?

Done

jon8787 · 2024-08-08T03:14:07Z

webroot/adm/oncall/participant-summary.html

+
+                        <div class="col">
+                            <a href="#" class="btn btn-primary" id="doRotateKeysets">Rotate Keysets</a>
+                            <div>Note: Once rotated, the participant will need to get a new refresh key to be able to decrypt data.</div>


Suggested wording:
"Normally, keys don't become active for 24 hours when rotated, which gives participants 24 hours before they need to call sdk.refresh().
However in this case, rotation will make the new keys active immediately. This means participants will not be able to decrypt newly created UID tokens until they have called sdk.refresh(). Note that we recommend calling sdk.refresh() once per hour".

Add backend change for listing related keysets

7456d0e

cYKatherine self-assigned this Aug 5, 2024

Improve logic on backend filtering

92ecbae

cYKatherine changed the title ~~UID2-3506 Add backend change for listing related keysets~~ UID2-3506 Add functionality on oncall page to list related keysets and rotate them Aug 5, 2024

cYKatherine force-pushed the kcc-UID2-3506-list-keys-need-to-be-rotated branch 2 times, most recently from f84c010 to 76379a2 Compare August 5, 2024 12:54

Add frontend to highlight related keysets

413f065

cYKatherine force-pushed the kcc-UID2-3506-list-keys-need-to-be-rotated branch from 76379a2 to 413f065 Compare August 5, 2024 12:54

Add functionality to rotate keysets

837ddbb

cYKatherine force-pushed the kcc-UID2-3506-list-keys-need-to-be-rotated branch from ef3020c to 837ddbb Compare August 5, 2024 13:30

cYKatherine commented Aug 5, 2024

View reviewed changes

webroot/js/participantSummary.js Outdated Show resolved Hide resolved

cYKatherine commented Aug 5, 2024

View reviewed changes

src/main/resources/localstack/s3/core/keysets/keysets.json Outdated Show resolved Hide resolved

cYKatherine commented Aug 5, 2024

View reviewed changes

src/main/java/com/uid2/admin/vertx/service/SharingService.java Outdated Show resolved Hide resolved

cYKatherine commented Aug 6, 2024

View reviewed changes

src/main/java/com/uid2/admin/vertx/service/SharingService.java Outdated Show resolved Hide resolved

cYKatherine added 6 commits August 6, 2024 15:17

Get ClientTypes from backend

454aa90

Remove condition for force check

dce0e23

Check if a site has any client key that has ID_READER role

dce1109

Add helper text to explain min age and force option

950d2a8

Check ID_READER role with correct type

5ddf6b0

Add tests for related keyset api

056f414

cYKatherine commented Aug 6, 2024

View reviewed changes

src/main/java/com/uid2/admin/Main.java Show resolved Hide resolved

cYKatherine commented Aug 6, 2024

View reviewed changes

src/test/java/com/uid2/admin/vertx/ClientKeyServiceTest.java Show resolved Hide resolved

Update comments

9c215fc

cYKatherine commented Aug 6, 2024

View reviewed changes

webroot/js/participantSummary.js Show resolved Hide resolved

cYKatherine added 4 commits August 6, 2024 21:16

Update highlights for client types

d25ca9a

Revert changes for keyset.json

3234fe8

Revert unused functions

2e05764

Revert unused clock

17f4b8c

cYKatherine commented Aug 6, 2024

View reviewed changes

webroot/js/participantSummary.js Show resolved Hide resolved

cYKatherine force-pushed the kcc-UID2-3506-list-keys-need-to-be-rotated branch from ab04e93 to d7515d8 Compare August 6, 2024 12:05

Add changes to show rotation result

9875b73

cYKatherine force-pushed the kcc-UID2-3506-list-keys-need-to-be-rotated branch from d7515d8 to 9875b73 Compare August 6, 2024 12:06

cYKatherine commented Aug 6, 2024

View reviewed changes

webroot/js/participantSummary.js Show resolved Hide resolved

cYKatherine requested review from vishalegbert-ttd and jon8787 August 6, 2024 12:07

vishalegbert-ttd reviewed Aug 7, 2024

View reviewed changes

jon8787 reviewed Aug 7, 2024

View reviewed changes

src/main/java/com/uid2/admin/vertx/service/SharingService.java Outdated Show resolved Hide resolved

jon8787 reviewed Aug 7, 2024

View reviewed changes

cYKatherine added 5 commits August 7, 2024 15:47

Update min_age_seconds to 1

b22494a

Use Collections.disjoint instead of customised ContainAny

6e0e979

Modify logic for verifying site id

bbc1a36

Add comments for moving checking keyset logic to shared

5c6af71

Fix logic of disjoint

d06b81b

Add prompt to confirm rotation

49d0971

jon8787 reviewed Aug 8, 2024

View reviewed changes

Update wordings for the note

9a20263

jon8787 approved these changes Aug 8, 2024

View reviewed changes

cYKatherine merged commit 15f3771 into main Aug 8, 2024
4 checks passed

cYKatherine deleted the kcc-UID2-3506-list-keys-need-to-be-rotated branch August 8, 2024 03:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

UID2-3506 Add functionality on oncall page to list related keysets and rotate them #329

UID2-3506 Add functionality on oncall page to list related keysets and rotate them #329

cYKatherine commented Aug 5, 2024 •

edited

Loading

vishalegbert-ttd Aug 7, 2024

cYKatherine Aug 7, 2024

jon8787 Aug 7, 2024

cYKatherine Aug 7, 2024

cYKatherine Aug 7, 2024

vishalegbert-ttd commented Aug 7, 2024

cYKatherine commented Aug 7, 2024

jon8787 Aug 7, 2024

jon8787 Aug 7, 2024

jon8787 Aug 7, 2024

jon8787 commented Aug 7, 2024

cYKatherine commented Aug 8, 2024

jon8787 Aug 8, 2024 •

edited

Loading

cYKatherine Aug 8, 2024

UID2-3506 Add functionality on oncall page to list related keysets and rotate them #329

UID2-3506 Add functionality on oncall page to list related keysets and rotate them #329

Conversation

cYKatherine commented Aug 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vishalegbert-ttd commented Aug 7, 2024

cYKatherine commented Aug 7, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jon8787 commented Aug 7, 2024

cYKatherine commented Aug 8, 2024

jon8787 Aug 8, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cYKatherine commented Aug 5, 2024 •

edited

Loading

jon8787 Aug 8, 2024 •

edited

Loading