Add ability to generate All Access tokens from the CLI about influx-cli HOT 6 CLOSED

@sanderson at present in v2.0.6 we dont have option to specify authorization flag when we create token through CLI, We should have ability to create all-access token through CLI

from influx-cli.

Transferring this to the new influxdata/influx-cli repo, as it's likely that all CLI feature work will be happening there in the future.

from influx-cli.

Which release of influxdb will have this feature

from influx-cli.

Most of the interesting stuff that happens in the UI when creating an all-access token is in this file: https://github.com/influxdata/ui/blob/master/src/authorizations/utils/permissions.ts

There is a hard-coded list of resource types to grant permissions to in the UI code, and when making a request to create an all-access token that list is used to generate a POST request with a body that looks something like this, containing all of the resource types listed:

{
   "orgID":"<org id>",
   "description":"<token name>",
   "permissions":[
      {
         "action":"read",
         "resource":{
            "type":"authorizations",
            "orgID":"<org id>"
         }
      },
      {
         "action":"write",
         "resource":{
            "type":"authorizations",
            "orgID":"<org id>"
         }
      },
      {
         "action":"read",
         "resource":{
            "type":"buckets",
            "orgID":"<org id>"
         }
      },
      {
         "action":"write",
         "resource":{
            "type":"buckets",
            "orgID":"<org id>"
         }
      },
      {
         "action":"read",
         "resource":{
            "type":"checks",
            "orgID":"<org id>"
         }
      },
      {
         "action":"write",
         "resource":{
            "type":"checks",
            "orgID":"<org id>"
         }
      },
      {
         "action":"read",
         "resource":{
            "type":"dashboards",
            "orgID":"<org id>"
         }
      },
      {
         "action":"write",
         "resource":{
            "type":"dashboards",
            "orgID":"<org id>"
         }
      },
    ... etc ...
   ]
}

The most obvious way to implement similar behavior in the CLI would be to have a hard-coded list in the CLI code as well to create the request.

Edit: After thinking about this a couple of minutes, I realized the only way this works in the UI is that the UI can differentiate if it is running in cloud-mode vs OSS-mode via a built-time environment variable. There are different types of resources for cloud vs. oss, like scrapers, managed functions, etc. I don't think there's a way for the CLI to know if it's sending a request to a cloud server or an OSS server. So adding some server-side functionality might be the only way...

A more elegant (but less backward compatible) strategy would be to add something server-side for creating an all-access token. I could see there being an endpoint like api/v2/authorizations/allAccess that you could POST to with a minimal amount of information like the orgID and token description that would internally generate a token for all resources on the server, for example.

from influx-cli.

Relevant: influxdata/influxdb#22135

from influx-cli.

Closed by #285

from influx-cli.