Return only own tokens in api/auth/access_tokens (#9950)

Author: zhiltsov-max

changelog.d/20251028_140529_mzhiltsov_list_only_own_tokens.md

@@ -0,0 +1,12 @@
+### Changed
+
+- Admins will no longer see access tokens of other users on the token management page
+  (<https://github.com/cvat-ai/cvat/pull/9950>)
+
+### Removed
+
+- \[Server API\] Only own access tokens will be returned in the `GET /api/auth/access_tokens`
+  responses for everyone, including admins
+  (<https://github.com/cvat-ai/cvat/pull/9950>)
+- \[Server API\] The `owner` filters are removed from the `GET /api/auth/access_tokens` endpoint
+  (<https://github.com/cvat-ai/cvat/pull/9950>)

cvat/apps/access_tokens/rules/access_tokens.rego

@@ -54,9 +54,5 @@ q_user_is_owner(user) := [
     {"owner_id": user.id},
 ]
 
-filter := [] if { # Django Q object to filter list of entries
-    utils.is_admin
-} else := qobject if {
-    user := input.auth.user
-    qobject := q_user_is_owner(user)
-}
+# Django Q object to filter list of entries
+filter := q_user_is_owner(input.auth.user)

cvat/apps/access_tokens/views.py

@@ -57,19 +57,15 @@ class AccessTokensViewSet(
     search_fields = ("name",)
     filter_fields = list(search_fields) + [
         "id",
-        "owner",
         "created_date",
         "updated_date",
         "expiry_date",
         "last_used_date",
         "read_only",
     ]
-    simple_filters = list(search_fields) + ["owner"]
+    simple_filters = list(search_fields)
     ordering_fields = list(filter_fields)
     ordering = "-id"
-    lookup_fields = {
-        "owner": "owner__id",
-    }
 
     iam_organization_field = None
     iam_permission_class = AccessTokenPermission

cvat/schema.yml

@@ -103,19 +103,14 @@ paths:
 
           Details about the syntax used can be found at the link: https://jsonlogic.com/
 
-           Available filter_fields: ['name', 'id', 'owner', 'created_date', 'updated_date', 'expiry_date', 'last_used_date', 'read_only'].
+           Available filter_fields: ['name', 'id', 'created_date', 'updated_date', 'expiry_date', 'last_used_date', 'read_only'].
         schema:
           type: string
       - name: name
         in: query
         description: A simple equality filter for the name field
         schema:
           type: string
-      - name: owner
-        in: query
-        description: A simple equality filter for the owner field
-        schema:
-          type: integer
       - name: page
         required: false
         in: query
@@ -138,7 +133,7 @@ paths:
         required: false
         in: query
         description: 'Which field to use when ordering the results. Available ordering_fields:
-          [''name'', ''id'', ''owner'', ''created_date'', ''updated_date'', ''expiry_date'',
+          [''name'', ''id'', ''created_date'', ''updated_date'', ''expiry_date'',
           ''last_used_date'', ''read_only'']'
         schema:
           type: string

tests/python/rest_api/test_access_tokens.py

@@ -2,13 +2,13 @@
 import json
 from contextlib import ExitStack
 from datetime import datetime, timedelta, timezone
+from http import HTTPStatus
 from io import StringIO
 from time import sleep
 
 import pytest
 from cvat_sdk.api_client import exceptions, models
 from cvat_sdk.api_client.api_client import ApiClient, Endpoint
-from cvat_sdk.core.utils import filter_dict
 from deepdiff import DeepDiff
 from pytest_cases import parametrize
 
@@ -88,26 +88,29 @@ def test_can_get_access_token(self, admin_user, access_tokens):
 
         assert DeepDiff(expected, actual, exclude_paths=["private_key"]) == {}
 
-    def test_cannot_see_foreign_tokens(self, users, access_tokens_by_username):
+    @parametrize("is_admin", [True, False])
+    def test_cannot_see_foreign_tokens(self, users, access_tokens_by_username, is_admin):
         token_owner, token_owner_tokens = next(iter(access_tokens_by_username.items()))
         token = token_owner_tokens[0]
 
         other_user = next(
-            u for u in users if u["username"] != token_owner and not u["is_superuser"]
+            u
+            for u in users
+            if u["username"] != token_owner
+            if u["is_superuser"] == is_admin
+            if not access_tokens_by_username.get(u["username"])
         )
 
-        with (
-            make_api_client(other_user["username"]) as api_client,
-            pytest.raises(exceptions.ForbiddenException),
-        ):
-            api_client.auth_api.retrieve_access_tokens(token["id"])
+        with make_api_client(other_user["username"]) as api_client:
+            _, response = api_client.auth_api.retrieve_access_tokens(
+                token["id"], _check_status=False
+            )
+            if is_admin:
+                assert response.status == HTTPStatus.OK
+            else:
+                assert response.status == HTTPStatus.FORBIDDEN
 
-        assert (
-            api_client.auth_api.list_access_tokens(
-                filter=json.dumps({"!": {"==": [{"var": "owner"}, other_user["id"]]}})
-            )[0].count
-            == 0
-        )
+        assert api_client.auth_api.list_access_tokens()[0].count == 0
 
     def test_can_get_self(self, access_tokens_by_username):
         _, user_tokens = next(iter(access_tokens_by_username.items()))
@@ -160,21 +163,19 @@ def test_can_only_see_alive_tokens(self, token_eol_reason: str, admin_user):
 
 
 class TestAccessTokenListFilters(CollectionSimpleFilterTestBase):
-    field_lookups = {"owner": ["owner", "id"]}
-
-    @pytest.fixture(scope="session")
-    def _cleaned_access_tokens(self, access_tokens):
-        return [filter_dict(t, drop=("private_key",)) for t in access_tokens]
-
     @pytest.fixture(autouse=True)
-    def setup(self, restore_db_per_class, admin_user, _cleaned_access_tokens):
-        self.user = admin_user
-        self.samples = _cleaned_access_tokens
+    def setup(self, restore_db_per_class, users_by_name, raw_access_tokens_by_username):
+        # Only own keys are visible to each user
+        self.user, self.samples = next(
+            (username, user_tokens)
+            for username, user_tokens in raw_access_tokens_by_username.items()
+            if users_by_name[username]["is_superuser"] and user_tokens
+        )
 
     def _get_endpoint(self, api_client: ApiClient) -> Endpoint:
         return api_client.auth_api.list_access_tokens_endpoint
 
-    @pytest.mark.parametrize("field", ("name", "owner"))
+    @pytest.mark.parametrize("field", ("name",))
     def test_can_use_simple_filter_for_object_list(self, field):
         return super()._test_can_use_simple_filter_for_object_list(field)
 

tests/python/rest_api/test_check_objects_integrity.py

@@ -41,6 +41,22 @@ def test_check_objects_integrity(self, path: Path):
                         )
                         == {}
                     )
+            elif endpoint == "auth/access_tokens":
+                objects = json.load(f)
+                assert set(objects) == {"user"}
+
+                for username, tokens in objects["user"].items():
+                    response = config.get_method(
+                        username, "auth/access_tokens", page_size=100, sort="id"
+                    ).json()["results"]
+                    assert (
+                        DeepDiff(
+                            tokens,
+                            response,
+                            ignore_order=True,
+                        )
+                        == {}
+                    )
             else:
                 response = config.get_method("admin1", endpoint, page_size="all")
                 json_objs = json.load(f)

tests/python/shared/assets/access_tokens.json

@@ -1,71 +1,87 @@
 {
-  "count": 4,
-  "next": null,
-  "previous": null,
-  "results": [
-    {
-      "created_date": "2025-08-12T10:30:10.206000Z",
-      "expiry_date": null,
-      "id": 7,
-      "last_used_date": null,
-      "name": "test readonly key",
-      "owner": {
-        "first_name": "Admin",
-        "id": 18,
-        "last_name": "Second",
-        "url": "http://localhost:8080/api/users/18",
-        "username": "admin2"
+  "user": {
+    "admin1": [],
+    "admin2": [
+      {
+        "created_date": "2025-07-17T16:17:35.436000Z",
+        "expiry_date": null,
+        "id": 3,
+        "last_used_date": null,
+        "name": "test key",
+        "owner": {
+          "first_name": "Admin",
+          "id": 18,
+          "last_name": "Second",
+          "url": "http://localhost:8080/api/users/18",
+          "username": "admin2"
+        },
+        "read_only": false,
+        "updated_date": "2025-07-17T16:17:35.436000Z"
       },
-      "read_only": true,
-      "updated_date": "2025-08-12T10:30:10.206000Z"
-    },
-    {
-      "created_date": "2025-07-17T16:19:46.576000Z",
-      "expiry_date": null,
-      "id": 5,
-      "last_used_date": null,
-      "name": "test readwrite key",
-      "owner": {
-        "first_name": "User",
-        "id": 2,
-        "last_name": "First",
-        "url": "http://localhost:8080/api/users/2",
-        "username": "user1"
+      {
+        "created_date": "2025-08-12T10:30:10.206000Z",
+        "expiry_date": null,
+        "id": 7,
+        "last_used_date": null,
+        "name": "test readonly key",
+        "owner": {
+          "first_name": "Admin",
+          "id": 18,
+          "last_name": "Second",
+          "url": "http://localhost:8080/api/users/18",
+          "username": "admin2"
+        },
+        "read_only": true,
+        "updated_date": "2025-08-12T10:30:10.206000Z"
+      }
+    ],
+    "lonely_user": [],
+    "user1": [
+      {
+        "created_date": "2025-07-17T16:19:18.229000Z",
+        "expiry_date": null,
+        "id": 4,
+        "last_used_date": null,
+        "name": "test readonly key",
+        "owner": {
+          "first_name": "User",
+          "id": 2,
+          "last_name": "First",
+          "url": "http://localhost:8080/api/users/2",
+          "username": "user1"
+        },
+        "read_only": true,
+        "updated_date": "2025-07-17T16:19:18.229000Z"
       },
-      "read_only": false,
-      "updated_date": "2025-07-17T16:19:46.576000Z"
-    },
-    {
-      "created_date": "2025-07-17T16:19:18.229000Z",
-      "expiry_date": null,
-      "id": 4,
-      "last_used_date": null,
-      "name": "test readonly key",
-      "owner": {
-        "first_name": "User",
-        "id": 2,
-        "last_name": "First",
-        "url": "http://localhost:8080/api/users/2",
-        "username": "user1"
-      },
-      "read_only": true,
-      "updated_date": "2025-07-17T16:19:18.229000Z"
-    },
-    {
-      "created_date": "2025-07-17T16:17:35.436000Z",
-      "expiry_date": null,
-      "id": 3,
-      "last_used_date": null,
-      "name": "test key",
-      "owner": {
-        "first_name": "Admin",
-        "id": 18,
-        "last_name": "Second",
-        "url": "http://localhost:8080/api/users/18",
-        "username": "admin2"
-      },
-      "read_only": false,
-      "updated_date": "2025-07-17T16:17:35.436000Z"
-    }
-  ]
+      {
+        "created_date": "2025-07-17T16:19:46.576000Z",
+        "expiry_date": null,
+        "id": 5,
+        "last_used_date": null,
+        "name": "test readwrite key",
+        "owner": {
+          "first_name": "User",
+          "id": 2,
+          "last_name": "First",
+          "url": "http://localhost:8080/api/users/2",
+          "username": "user1"
+        },
+        "read_only": false,
+        "updated_date": "2025-07-17T16:19:46.576000Z"
+      }
+    ],
+    "user10": [],
+    "user2": [],
+    "user3": [],
+    "user4": [],
+    "user5": [],
+    "user6": [],
+    "user7": [],
+    "user8": [],
+    "user9": [],
+    "worker1": [],
+    "worker2": [],
+    "worker3": [],
+    "worker4": []
+  }
 }