[sup] ACM cookie-auth session: URL cluster/node context + temp-credential lifecycle
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- sql, typescript
- Domain
- api, authentication, frontend
Research direction
Start by tracing the existing ChCtx/session flow and the ACM URL context, then inspect the /api/account and /api/cluster/{id}/support/credentials entry points. Verify the cookie-only requests, ACM redirect on 401, engineer-email attribution, and single-flight credential minting with every documented response shape; done means all listed acceptance checks pass.
Written by the indexing model from the issue text.
Description
Part of #352. Heavily simplified by the cookie-auth model (was: #user login + pasted ACM key).
A dedicated ACM-mode ChCtx/session — no login form, no token, no key persistence.
Scope
- Read context from URL:
clusterandnodequery params (supplied by the ACM console link). No cluster URL→id resolution. - Cookie auth: all
/apicallscredentials:'same-origin', no auth header. A 401 = ACM session lost → redirect to ACM login (standard), not our concern to refresh. - Identity:
GET /api/account→ engineer email, used as CHuser=forquery_logattribution. Model engineer-identity (from/account) separately from CH transport login (may be a returnedlogin, else the email) and never assume they're the same. - Temp CH credential lifecycle: mint via
GET /api/cluster/{id}/support/credentials; read TTL from the response (don't hardcode); keep alive via/support/refreshor re-mint; single-flight so concurrent schema/dashboard requests don't mint in parallel. Handle both documented shapes ({password,ttl}/ bare string /{login,password}).
Removed vs. original
#usersentinel, ACM key in a password field, Chrome-password-store, no-localStorage/share-link/export rules for the key
Acceptance
- Loads cluster/node from URL;
currentUser()is the engineer email. - No credential stored in JS; cookie-only; 401 → ACM login redirect.
- Temp creds mint + refresh (single-flight), TTL from response, all response shapes handled.
- Dominant language
- TypeScript
- Stars
- 8
- Forks
- 2
- Avg merge
- 1h 34m
- Merged PRs (30d)
- 6
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Altinity/altinity-sql-browser
-
inbox
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Altinity/altinity-sql-browser#605 ·
-
inbox
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Altinity/altinity-sql-browser#509 ·
-
inbox
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Altinity/altinity-sql-browser#489 ·
-
flamegraph Openenhancement
Difficulty 5/5 Over a week Newbie friendliness 25/100
Altinity/altinity-sql-browser#684 ·
-
bug
Difficulty 4/5 3-5 days Newbie friendliness 68/100
Altinity/altinity-sql-browser#680 · 2 comments ·
All issues in Altinity/altinity-sql-browser
Similar issues
-
VerificationGate: ATTRIBUTION quote guard never matches a normal quotation (\b around the quote) Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
danielmiessler/LifeOS#2234 ·
-
T: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
Mend: dependency security vulnerability untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 70/100