[issue2551177] Consider macaroon bearer auth token support using pymacaroons

New submission from John Rouillard:

Basic JWT (json web tokens) support was added as part of the 2.0.0
release. Directions for it can be discussed on issue 2551064.

One issue with JWT is that a user can't use a jwt to derive a more restricted
token (say allow read only access to an issue for the next 24 hours from a specific
ip address range).

Investigate the ability to use  https://github.com/ecordell/pymacaroons
to allow users to derive tokens with more limited permissions/scopes
and the changes needed to support adding user specified restrictions.

Pypi uses macaroons (so we have some support for them) and there is a tool for
modifying a pypi macaroon:

  https://github.com/ewjoachim/pypitoken

announced:

  https://discuss.python.org/t/pypitoken-a-library-for-generating-and-manipulating-pypi-
tokens/7572

----------
components: Web interface
keywords: Effort-Medium
messages: 7396
nosy: rouilj
severity: normal
status: new
title: Consider macaroon bearer auth token support using pymacaroons
type: rfe

_________________________________________________
Roundup tracker <[email protected]>
<https://issues.roundup-tracker.org/issue2551177>
_________________________________________________