[public-api] Generate & Parse Personal Access Tokens

[easyCZ]

Description

Introduces generation & validation of Personal Access Tokens (PAT).

A PAT is used as a stand-in for a user, inheriting their identity.

A PAT looks like gitpod_pat_ko8KC1tJ-GkqIwqNliwF4tBUk2Jd5nEe9qOWqYfobtY.6ZDQVanpaTKj9hQuji0thCe8KFCcmEDGpsaTkSSb (this is a random token, not having access to anything).

It is composed out of the following:

• Prefix gitpod_pat_
• Signature ko8KC1tJ-GkqIwqNliwF4tBUk2Jd5nEe9qOWqYfobtY
• Value 6ZDQVanpaTKj9hQuji0thCe8KFCcmEDGpsaTkSSb

A PAT has the following cryptographic properties:

• Signature is an HS256 signature (HMAC with SHA-256), Raw Base64 URL encoded
• Value is a random value with 172 bits of entropy
• Prefix can be used for code-scanning

The signature generation requires a secret key.

When validating a token, we do the following:

• Sanity check format
• Extract value and signature
• Use the signer to sign the value, encode to base64
• compare against provided signature, fail if they do not match.

The reason for including a signature is to fail-early when tokens which are not issued by gitpod are received on the API. This acts as a defence for Auth DDoS and amplification attacks.

Related Issue(s)

• Part of Implement CreatePersonalAccessToken RPC #14602

How to test

Unit tests

Release Notes

NONE

Documentation

Werft options:

• /werft with-local-preview
  If enabled this will build install/preview
• /werft with-preview
• /werft with-large-vm
• /werft with-integration-tests=all
  Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
Once a secret has been leaked into a git repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

<sup><sub>🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Our GitHub checks need improvements? Share your feedbacks!</sub></sup>

[laushinka]

Thanks for documenting this really well! 💪🏼

[laushinka]

Approving and holding because the useful examples are not liked by gitguardian[1].

/hold

[easyCZ]

Approving and holding because the useful examples are not liked by gitguardian[1].

I've resolved it in GitGuardian as a test token.