Adding generate_tenant_token method

[alallema]

Tenant tokens

Introduction of the new method generate_tenant_token in order to facilitate the generation of the tenant token.

Related to:

• this issue: Tenant Tokens (Multi-Tenant indexes) meilisearch#1991
• this spec: Tenant Token specifications#89

[sanders41]

@alallema I have been getting the same invalid API key errors when using a token. I thought I must have something wrong so didn't report it, but I see you are getting the same error. Do you think this is an issue in Meilisearch with the tokens?

Sorry after looking closer I think the issue is different. You are only getting the invalid key in one specific case.

[alallema]

@alallema I have been getting the same invalid API key errors when using a token. I thought I must have something wrong so didn't report it, but I see you are getting the same error. Do you think this is an issue in Meilisearch with the tokens?

Hi @sanders41,
Yes, the reason why my tests are failing it's because I test without searchRules field. It's the expected behavior that failed, I didn't finish this test but I wanted to push it before the end of my working day.
But I totally agree with you @brunoocasali has open a discussion about it, we find the error message is not really relevant. Is really complicated to know why the generate token doesn't work if the trouble didn't come from the encoding but for example if you forgot the searchRules field or if this one is just not well-formatted.
You can see the comment and the discussion.
I don't take the time to comment it yet but I will do it soon as I can.
For your issue, my first test passed well if you want to check it. But some advice:

• you can't use the masterKey to create a token
• the field searchRules is mandatory
• the field apiKeyPrefix is also mandatory with the 8 first characters of your key

[alallema]

Sorry after looking closer I think the issue is different. You are only getting the invalid key in one specific case.

Yes sorry I was too long to reply 😄

[sanders41]

Thanks this gives me my issue. I don't have the apiKeyPrefix.

[brunoocasali]

Hi @alallema I left some comments about the implementation/tests, let me know what do you think! :)

[brunoocasali]

You can handle empty strings? ''

[sanders41]

api_key = self.config.api_key if api_key is None else api_key

api_key is a string so no need to convert.

Also, the master key can't be used right? self.config.api_key could be the master key. There is a default search key available that can be used as a default instead.

[alallema]

@sanders41, yes I didn't convert it at first but mypy wasn't agree at all with it and generate this error:

meilisearch/client.py:510: error: Value of type "Optional[str]" is not indexable
meilisearch/client.py:523: error: Item "None" of "Optional[str]" has no attribute "encode"
Found 2 errors in 1 file (checked 7 source files)

How can I fix this in a better way than cast it in string?

[sanders41]

I think mypy is complaining because self.config.api_key could also be None and there isn’t a check for that.

[alallema]

You can handle empty strings? ''

I can handle empty string search_rule is Union[Dict[str, Any], List[str]] not a string. I can check if it's not an empty Dict or an empty List but I'm not sure it's relevant.

[brunoocasali]

Actually, you don't really care about the size of the response, because it's not related to the key generation itself. But you do care if the /search request answer with a success status!

[alallema]

I'm not sure to understand what you mean. There is no status field in the search response so I just check if the response has enough results to be valid. It could for example don't have the right on my index or had filters

[brunoocasali]

What I want to mean is, if your request returned just 10 records caused by a new version of the engine v0.27 for example, that's an error? this test should break because of that change? In this case no, because your test just wanted to check if your generated token can make a request successfully.

But, since the assertion is check if the returned records are equal to 20 now you have to fix this test too because the core engine changed internally.

Giving more context: this idea does not apply everywhere, because there are some use-cases we will need to handle that, ie. the tests regarding the filters or the search itself.

A different approach is to use more unit testing for some cases instead of e2e tests give a look here:

• https://www.onpathtesting.com/blog/end-to-end-vs-integration-testing
• https://prodperfect.com/blog/test-development/end-to-end-or-unit-testing-which-tests-for-which-bugs/

[alallema]

I get it you mean if the search limit by default is modified from 20 to 10.
I can change the request with a specific limit like:

    response = token_client.index('indexUID').search('', {
        'limit': 5
    })
    assert len(response['hits']) == 5

This way I'm sure the search works well and the test will not be breaking. What do you think?
Also, I just let it in the first test when the search_rule is set to ['*']

[brunoocasali]

Did you have a setup handler without documents or a simple index creation? Because it's good to avoid unnecessarily setup :D

[alallema]

I had documents to check the search return at least a few documents. I find that doing a search without results was less convincing

[alallema]

And same as above I just let this specific verification on the first one with search_rules ['*']

[sanders41]

api_key = self.config.api_key if api_key is None else api_key

api_key is a string so no need to convert.

Also, the master key can't be used right? self.config.api_key could be the master key. There is a default search key available that can be used as a default instead.

[sanders41]

lgtm