Make hakai-api-client-matlab Public instead of private about hakai-api-client-matlab

[fostermh]

sorry just seeing your posts now. history is already purged. Please remove your local repos and re-clone. thanks.

[tayden]

I've got no issue with this. The Python and R versions of the API client are already public.

However, it seems like https://github.com/HakaiInstitute/hakai-api-client-matlab/blob/master/%2BHakai/%40Client/Client.m#L89 maybe hardcodes some info we don't want public. So that would have to be removed and then purged from the Git history before making it public.

Edit: I actually don't see this used anywhere in the rest of the code, and it's just a private property, not secret information. Even if you go to that URL, it just throws an error.

[JessyBarrette]

Oh ok, I can see if I drop it does it actually create any issues

[JessyBarrette]

commenting this line in the code doesn't seem to have any effect on the execution at least locally on my machine. So I believe we could just drop it whatever it means

[fostermh]

that is surprising as that line indicates which id to use when connecting to google authentication. you should not be able to authenticate with google without it. likely you have cached credentials on your system and you would be unable to connect tomorrow or whenever your cache times out.

[JessyBarrette]

Oh oups i must not deleted appropriately the auth file. Are you good @matthew Foster ***@***.***> with keeping the package public like that? Le jeu. 10 mars 2022 5:15 p.m., Matthew Foster ***@***.***> a écrit :

…

that is surprising as that line indicates which id to use when connecting to google authentication. you should not be able to authenticate with google without it. likely you have cached credentials on your system and you would be unable to connect tomorrow or whenever your cache times out. — Reply to this email directly, view it on GitHub <#4 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHICYOJIJU46IATUE2T6GDLU7JYABANCNFSM5QKNRKUQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you were assigned.Message ID: ***@***.***>

[fostermh]

I guess I'm wondering why this client has the client id hardcoded while the R and Python clients do not. Seems to me that they are using the API to authenticate while the matlab client is still using an older auth workflow? I would feel better about this if we were doing it consistently for all clients.

[JessyBarrette]

Strangely I think this is the most of recent out of the three 😆. Though I just, retried the client with a full cycle by regenerating a new credential and it this line is definitely unused. Plus I don't see anywhere in the code where it gets used at all.

[fostermh]

that is strange but, ok. once the current files are cleaned up I will purge the offending data from the git history

[tayden]

That "id" is actually just the URL for our login page, for this particular app which is setup via the google cloud console. The same URL is used in the API here: https://github.com/HakaiInstitute/hakai-api/commit/1ac2fee173c7efc78678f735a8f6fb0e8abd7d05#diff-690cc16f20041b3b798a0470ccc33495bf1761ad2aed120e53e7065913205355L12 (note its different now because I broke the old a couple weeks ago and had to update it.)

So it looks like this is something leftover from when we had a less nice way to do auth than is setup now in the API. I assume it was defined here to access that URL directly, instead of through the proxy setup in hakai-api.

Anyway, it's not sensitive information. It should be removed but we don't have to worry about it being in there, especially since those old credentials were blown away when I broke and then fixed the auth flow 15 days ago.

[tayden]

The current flow of requests is as follows, just for clarity:

matlab client -> hecate.hakai.org/api/oauth2/client -> [...].apps.googleusercontent.com -> https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?[...] (which is the Google select account/sign in page)

Then after authenticating, it goes to:
hecate.hakai.org/api/oauth2/client/code2jwt which responds to the original requester with the JWT token to be saved locally