401 Unauthorized access | Check PAT token and GitHub permissions.

[yaroslav-st-nyt]

Hi! @martedesco & @karpikpl
I just updated the dashboard from v1.9 to v2.0.3 and am facing an issue with unauthorized access. Nothing has changed since we had access to all metrics prior to the version update.

We are using the GitHub app for authentication, and this error is visible to the organization or enterprise owners who didn't have an issue before. I also verified that the pod with the application has environment variables with accurate keys and values.

Is there a document with all the updates and changes made between v1.9 and v2.0.3? While updating the image version, I encountered other small issues, such as the new callback format.

Let me know if any other information is needed for a better investigation!

[yaroslav-st-nyt]

#165

@karpikpl
Is there a chance that now the GitHub app has to be installed for the user as well, not just for the organization (as it worked before in version 1.8)? I'm not sure about the logic in the code for that version, but previously we had the app working with the GitHub app installed only in the organization.

[karpikpl]

Hey @yaroslav-st-nyt , sorry for the spring-break delay.

The app doesn't have to be installed.
I tried to document the changes in the release notes https://github.com/github-copilot-resources/copilot-metrics-viewer/releases/tag/v2.0.0

I tried to maintain backwards compatibility between 1.9 and 2.0.
Docker container is supposed to read env variables and set new ones.

Can you check if the release notes help?
You can also provide the environment variables you have (without exposing any secrets) - and I can try to reproduce your issue.

[karpikpl]

Also this PR may fix it for you - #179

[yaroslav-st-nyt]

@karpikpl thanks for getting back to me, I appreciate your help!

Here are some portions of the environments provided to the pod via envVars:

Sensitive envs Im adding as a patch to kustomize referencing to the secrets and secrets getting values from the Vault.

Also by execing into the pod and checking values of the ENVs I can confirm that all values are accurate.

We are running Copilot Dashboard in the EKS cluster as a deployment by using FROM ghcr.io/github-copilot-resources/copilot-metrics-viewer-with-proxy:2.0.3 in our own dockerfile so we can keep a copy in the corporate ECR.

We use the GitHub app for authentication, and we know that only organization admins can access the application to view metrics. We don't use the PAT Token.

[yaroslav-st-nyt]

I tried these things, but it didn't help.

1. Use image without proxy
2. Remove this ENV to have a default value: NUXT_PUBLIC_GITHUB_API: /api/github
3. We have NITRO_PORT: 8080 because the standard port 80 used to cause problems in our environment. I also tried to run the application on port 3000.

I just updated the dashboard from v1.9 to v2.0.3

I apologize, but we have updated from version 1.8.0 (not 1.9) to the latest version 2.0.3.

[karpikpl]

if you're getting this error before seeing "sign in to GitHub" button, it would indicate the old version is executed but with new env variables.

Try this:

docker run -it --rm -p 3000:80 \
-e NUXT_PUBLIC_SCOPE=organization \
-e NUXT_PUBLIC_GITHUB_ORG=<YOUR ORG> \
-e NUXT_PUBLIC_USING_GITHUB_AUTH=true \
-e NUXT_OAUTH_GITHUB_CLIENT_ID=<ID> \
-e NUXT_OAUTH_GITHUB_CLIENT_SECRET=<SECRET> \
-e NUXT_SESSION_PASSWORD=something-very-random-very-very-very-random  \
ghcr.io/github-copilot-resources/copilot-metrics-viewer:2.0.3

you may need to add redirect_url to your app registration for local dev.

Then try the same with your image.

My guess is that by using FROM in the Dockerfile, something is not executed (can you share the dockerfile?

[yaroslav-st-nyt]

Hey @karpikpl

I just installed the application locally using the same GitHub App but changed the callback URL and application URL.
The error appears after signing in to GitHub; you can see in the screenshot that it contains my account name in the top right corner.

In the application logs, I can see the same error and identical logs as in our EKS version. I believe this error is normal when you don't have an admin role in the GitHub organization, as my GitHub account doesn't possess admin privileges or ownership. However, admins and owners of the organization in my company, who previously had access to metrics in version 1.8 using the same GitHub App, are now encountering this error as well.

1. I'm going to test my theory about whether the GitHub app should be installed for the user's account as well.
2. I rolled back the company's version of the Dashboard to 1.8.0, as we did a week ago, using the same values for the ENVs and just the old keys / callback; everything works well.

In the meantime, if you have any other suggestions for what to try or verify, please let me know. Perhaps we need to double-check the permissions of the users who are trying to view GitHub Copilot metrics? And again, thanks for trying to help me!

[karpikpl]

The other difference between the versions is that new one uses the new API.

Could you provide the dockerfile you use in your EKS deployment?

Maybe one of your admin users could test the local version?

The error may be coming from the app not GitHub
See this line:
https://github.com/github-copilot-resources/copilot-metrics-viewer/blob/main/server/api/seats.ts#L37

[karpikpl]

hey @yaroslav-st-nyt were you able to solve it?

[yaroslav-st-nyt]

@karpikpl Hi! While verifying some steps, I depend on other people who have the GH admin role in the organization, so the process is a bit slow.

I'm still working on verifying the step you recommended and also on confirming my theory about whether the GH app will be installed in the organization and the user's account.

[abhandari88]

@karpikpl I am running into same issue seems like app is missing authorization headers when sending request to github api .

[karpikpl]

I'm wondering if I can improve the docs....
The App has to be installed in the Org and the person accessing needs to have owner permissions.

We could add a feature to use Client Id / Cient Secret of the installed app (use app permissions instead of user permissions). It's been on my todo list but I've been busy with other work

[yaroslav-st-nyt]

"We could add a feature to use Client Id / Cient Secret of the installed app (use app permissions instead of user permissions). It's been on my todo list but I've been busy with other work"

@karpikpl
I don't have any updates yet, but has anything changed here (I quoted your message) since the 1.8.0 version? In our case, the same two people who had access to the app in 1.8.0 don't have access when updating to the latest version 2.0.

If it's possible, could you point out specifically (maybe with screenshots) where and what permissions a user needs to have so I can verify it to isolate the issue? Also, are the permissions user-specific or role-based, or does it not matter for the dashboard app?

[karpikpl]

From authorization perspective, the only change was the use of Nuxt Auth Provider for GitHub, which uses App Registration.
The redirect changed to a different path.

The app authenticates the user using Nuxt.
Next it grabs the token and makes the call to GitHub metrics API.
The API changed since it went GA but the permissions stayed the same.
https://docs.github.com/en/rest/copilot/copilot-metrics?apiVersion=2022-11-28#get-copilot-metrics-for-an-organization

This endpoint works with the following fine-grained token types:

GitHub App user access tokens
GitHub App installation access tokens
Fine-grained personal access tokens
The fine-grained token must have at least one of the following permission sets:

"GitHub Copilot Business" organization permissions (read)
"Administration" organization permissions (read)

I'm using it for https://copilot-metrics.net which I didn't have to update, still using same app registration.

My app has:

1. permission for GitHub Copilot Business (read-only)
2. permission for Members (read-only) -> this one I don't think I'm using now

App is installed in my test-org.

I'm the owner of the org

and metrics are enabled

[yaroslav-st-nyt]

@karpikpl Thanks for that detailed answer!

Do you know if admins in your organization can access the GitHub Copilot dashboard?