Allow clear cache sessions - #2472
Open
benidk wants to merge 2 commits into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Following this issue
Administrators had no way to invalidate active authentication-approval bypasses (the cached "remembered web approval" that lets a login skip re-approval for the configured grace period) without waiting it out. This adds that capability, for use during offboarding, a suspected key compromise, or a policy change.
Backend (
warpgate-admin,warpgate-core)GET /web-approvals— list currently active (unexpired) cached bypasses,aggregated across the cluster.
DELETE /web-approvals— clear every cached bypass (global).DELETE /web-approvals/:username— clear all cached bypasses for one user.DELETE /web-approvals/:username/scope— clear a single target's (or,via
all_targets, every target's) bypass for one user, for row-levelrevoke from the UI.
All mutating endpoints require the
config_editadmin permission. Thecache is per-node in-memory, so clears fan out to every other cluster node
(same pattern as session termination), and reads aggregate results from
all nodes too.
Web Admin UI
New "Web approvals" page under Status: lists active bypasses (user,
protocol, target/scope, source IP, granted-at), with:
that user's bypasses,
target/scope rather than the whole user.
Tests
AuthStateStore/Servicesmethods(clear all / clear for user / clear for user+scope / list active).
AdminApiTestCaseentries for the 4 new operations sothe admin-API permission-coverage test passes.
AI Usage
Choose the level of AI involvement for this PR.
This is not to block AI contributions but rather to speed up PR review (saves time on trying to deduce the logic behind AI hallucinations).