AWS IAM: lakefs IDP interface #8994

ItamarYuran · 2025-04-28T17:19:51Z

To make further IAM auth implementations easier, I moved JWT retrieval logic into lakeFS and put it behind a small interface.

Edit by isan for CHANGELOG:

This PR introduces new configuration for IAM Login support for lakectl, the feature itself is not implemented yet.
Using the new configuration with older version of lakectl will cause it to fail.

Not using the new configuration has no affect regardless of the version.

github-actions · 2025-04-28T17:27:57Z

E2E Test Results - DynamoDB Local - Local Block Adapter

github-actions · 2025-04-28T17:28:51Z

E2E Test Results - Quickstart

Isan-Rivkin · 2025-04-29T13:33:26Z

esti/external_auth_test.go

The package structure should allow extending it without refactor.
In the current form it's a mix of generic and AWS primitives.

For example:
The type IdentityTokenInfo is AWS specific but it's under the generic package externalidp.
The problem is that when we add azure token info, how would you call it? IdentityTokenInfoAzure? Then you'd refactor this one to IdentityTokenInfoAWS?

We should have a clear separation between external principal login VS AWS specific.

What do I actually suggest is 1 of 2 options, Im fine with either (The first one probably easier):

Add AWS to everything that is related to AWS, i.e IdentityTokenInfo -> AWSIdentityTokenInfo

Create a sub package to contain all AWS specific code under i.e externalidp/awsidp

pkg/authentication/externalidp/aws_client.go

Isan-Rivkin · 2025-04-29T13:37:54Z

pkg/authentication/externalidp/aws_client.go

+	return resp, err
+}
+
+func getJWT(params *AWSIAMParams, serverEndpoint string, httpClient *http.Client) (string, error) {


There's no point in another function getJWT if it's only used in Login put the code there, otherwise it's bloating the code

Isan-Rivkin · 2025-04-29T14:18:32Z

pkg/authentication/externalidp/aws_client.go

+	TokenTTL            time.Duration
+}
+
+func NewAWSProvider(params AWSIAMParams, serverEndpoint string, httpClient *http.Client) *AWSProvider {


*http.Client is (a) confusing name (b) too low level.

I suggest the following refactor:

Create a minimal interface (easier to test, less dependencies) with a single function ExternalPrincipalLoginWithResponse.

Note: that's already a part of the generated lakeFS client ClientWithResponsesInterface, but just this func.

type ExternalPrincipalLoginClient interface { ExternalPrincipalLoginWithResponse(ctx context.Context, body ExternalPrincipalLoginJSONRequestBody, reqEditors ...RequestEditorFn) (*ExternalPrincipalLoginResponse, error) }

Refactor the existing NewAWSProvider function (help with testing and mock):

NewAWSProviderWithClient(params AWSIAMParams, client ExternalPrincipalLoginClient) *AWSProvider { ... }

Add additional New func: NewAWSProvider that will be used in everest:

func NewAWSProvider(params AWSIAMParams, lakeFSHost string) (*AWSProvider, error) { client, err := apigen.NewClientWithResponses( serverEndpoint, apigen.WithHTTPClient(httpClient), ) if err != nil { return nil, err } return NewAWSProviderWithClient(params, client), nil }

Isan-Rivkin · 2025-04-29T14:22:01Z

pkg/authentication/externalidp/aws_client.go

+	Token string
+}
+
+type IDPProvider interface {


IDP == Identity Provider -> IDPProvider == IdentityProviderProvider 😋

Suggested change

type IDPProvider interface {

type Provider interface {

Since the package name contains the name idp and external, in go you don't need to duplicate the name, i.e this is enough:

import ( ".../externalidp" ) // usage is clear externalidp.Provider

Isan-Rivkin · 2025-04-29T14:27:30Z

pkg/authentication/externalidp/aws_client.go

+	return externalPrincipalLoginResp.JSON200.Token, nil
+}
+
+func getIdentityToken(ctx context.Context, params *AWSIAMParams) (string, error) {


Please avoid making this func private, so we can easily go-get and test.
Also it should be part of the AWSProvider struct, e.g struct method.

Isan-Rivkin · 2025-04-29T14:39:16Z

pkg/authentication/externalidp/aws_client.go

+	queryParams := parsedURL.Query()
+	credentials := queryParams.Get(AWSAuthCredentialKey)
+	splitedCreds := strings.Split(credentials, "/")
+	calculatedRegion := splitedCreds[2]
+	identityTokenInfo := IdentityTokenInfo{
+		Method:             "POST",
+		Host:               parsedURL.Host,
+		Region:             calculatedRegion,
+		Action:             AWSAuthAction,
+		Date:               queryParams.Get(AWSAuthDateKey),
+		ExpirationDuration: queryParams.Get(AWSAuthExpiresKey),
+		AccessKeyID:        creds.AccessKeyID,
+		Signature:          queryParams.Get(AWSAuthSignatureKey),
+		SignedHeaders:      strings.Split(queryParams.Get(AWSAuthSignedHeadersKey), ";"),
+		Version:            queryParams.Get(AWSAuthVersionKey),
+		Algorithm:          queryParams.Get(AWSAuthAlgorithmKey),
+		SecurityToken:      queryParams.Get(AWSAuthSecurityTokenKey),
+	}
+
+	marshaledIdentityTokenInfo, _ := json.Marshal(identityTokenInfo)
+	encodedIdentityTokenInfo := base64.StdEncoding.EncodeToString(marshaledIdentityTokenInfo)
+	return encodedIdentityTokenInfo, nil


This section is a good candidate to a separate function, it'll be easier to test it, i.e:

func NewIdentityTokenInfoFromURL(presignedURL string) (*IdentityTokenInfo, string, error)

Note: returning both the encoded string output of the identityTokenInfo and the struct itself - it allows to test it properly, writing a test for encoded string is harder if you want to verify specific fields.

pkg/authentication/externalidp/aws_client.go

Isan-Rivkin · 2025-04-29T14:46:31Z

pkg/authentication/externalidp/aws_client.go

+	if err != nil {
+		return "", err
+	}
+	if externalPrincipalLoginResp == nil || externalPrincipalLoginResp.JSON200 == nil {
+		return "", ErrRetrievingToken
+	}
+	return externalPrincipalLoginResp.JSON200.Token, nil


Check http issue after regular error with ResponseAsError

Return struct AuthenticationToken not just the token, it contains more info and allows extending

No need for those nil checks below

import "github.com/treeverse/lakefs/pkg/api/helpers" /// if err != nil { ... } err = helpers.ResponseAsError(res) if err != nil { return nil, err } return res.JSON200

Jonathan-Rosenberg · 2025-04-29T13:24:29Z

pkg/authentication/externalidp/aws_client.go

pkg/authentication/external_idp/aws_client.go

Jonathan-Rosenberg · 2025-04-29T13:42:09Z

pkg/authentication/externalidp/aws_client.go

+type LoginResponse struct {
+	Token string
+}
+
+type IDPProvider interface {
+	Login() (LoginResponse, error)
+}


either rename the file, or extract these to a general idp.go file

Isan-Rivkin

re-request when ready

Isan-Rivkin

say when ok

cmd/lakectl/cmd/root.go

go.mod

pkg/authentication/externalidp/awsiam/aws_client.go

Isan-Rivkin · 2025-05-13T07:12:28Z

cmd/lakectl/cmd/root.go

@@ -195,8 +196,9 @@ const (
 	defaultMaxRetryInterval = 30 * time.Second
 	defaultMinRetryInterval = 200 * time.Millisecond

-	defaultTokenTTL      = 3600 * time.Second
-	defaultURLPresignTTL = 60 * time.Second
+	defaultTokenTTL        = 0 * time.Second


remove, shouldn't be used

Isan-Rivkin · 2025-05-13T07:14:03Z

cmd/lakectl/cmd/root.go

@@ -679,5 +681,6 @@ func initConfig() {
 	viper.SetDefault("local.skip_non_regular_files", false)
 	viper.SetDefault("credentials.provider.aws_iam.token_ttl_seconds", defaultTokenTTL)
 	viper.SetDefault("credentials.provider.aws_iam.url_presign_ttl_seconds", defaultURLPresignTTL)
+	viper.SetDefault("credentials.provider.aws_iam.refresh_interval", defaultRefreshInterval)


No reason to define an explicit default here, the default of this type is already 0.
The struct instance will contain the default of time.Duration if it's not defined here, and it's 0.

Isan-Rivkin · 2025-05-13T07:17:49Z

cmd/lakectl/cmd/root.go

+	defaultURLPresignTTL   = 60 * time.Second
+	defaultRefreshInterval = 300 * time.Second


Side note on those defaults
you know that other services re-using this configuration will need to define their own defaults, right?
Viper instantiation is specific to lakectl, not other binaries like everest that has their own viper instance initiating defaults.

I'm OK to keeping these if you'd like now because those are good defaults that we will want when we implement this logic in lakectl, but they will not be reflected in any other binary such as everest.

Isan-Rivkin · 2025-05-13T07:18:55Z

pkg/authentication/externalidp/awsiam/aws_client.go

+	CredentialTimeFormat  = "20060102"
+	DefaultSTSLoginExpire = 15 * time.Minute
+
+	mimLengthSplitCreds = 3


Isan-Rivkin · 2025-05-13T07:20:11Z

pkg/authentication/externalidp/awsiam/aws_client.go

+	DefaultSTSLoginExpire = 15 * time.Minute
+
+	mimLengthSplitCreds = 3


Part of go and out go styling, encapsulate consts in logical groups, all of the above are query params, and those are just random consts

Suggested change

DefaultSTSLoginExpire = 15 * time.Minute

mimLengthSplitCreds = 3

const (

DefaultSTSLoginExpire = 15 * time.Minute

mimLengthSplitCreds = 3

)

Isan-Rivkin · 2025-05-13T07:29:34Z

pkg/authentication/externalidp/awsiam/aws_client.go

+	"github.com/google/uuid"
+)
+
+var ErrInvalidCredentialsFormat = errors.New("missing required parts in credentials")


Suggested change

var ErrInvalidCredentialsFormat = errors.New("missing required parts in credentials")

var ErrInvalidCredentialsFormat = errors.New("missing required parts in query param X-Amz-Credential")

Isan-Rivkin · 2025-05-13T07:32:31Z

pkg/authentication/externalidp/awsiam/aws_client.go

+	credentials := queryParams.Get(AuthCredentialKey)
+	splitedCreds := strings.Split(credentials, "/")
+	if len(splitedCreds) < mimLengthSplitCreds {
+		return nil, fmt.Errorf("invalid credentials format: %w", ErrInvalidCredentialsFormat)


Suggested change

return nil, fmt.Errorf("invalid credentials format: %w", ErrInvalidCredentialsFormat)

return nil, fmt.Errorf("min length for query param not '%d' ('%s'): %w",mimLengthSplitCreds, splitedCreds, ErrInvalidCredentialsFormat)

pkg/authentication/externalidp/awsiam/aws_client.go

Isan-Rivkin · 2025-05-13T07:43:45Z

pkg/authentication/externalidp/awsiam/aws_client.go

+	return presign.URL, err
+}
+
+func RetrieveCredentials(ctx context.Context, cfg *aws.Config) (*aws.Credentials, error) {


I'd strongly consider removing this function.
After our ping-pong's it's been reduced to really 1 line of code creds, err := cfg.Credentials.Retrieve(ctx) , not used in lakeFS.
It has no extra logic so the tests are essentially just testing AWS sdk cfg.Credentials.Retrieve function that we don't need to test.

In other words, a whole lot of bloat to the code for a single func call that is not implemented by us anyway.

Isan-Rivkin · 2025-05-13T07:46:43Z

pkg/authentication/externalidp/awsiam/aws_client_test.go

+	require.Contains(t, url, "amazonaws.com")   // ensures it's AWS
+	require.Contains(t, url, "X-Amz-Signature") // ensures it's signed
+}
+func TestGeneratePresignedURL_Integration(t *testing.T) {


test func name should match PresignGetCallerIdentityFromAuthParams

function name should be TestPresignGetCallerIdentityFromAuthParams

Isan-Rivkin · 2025-05-13T14:25:25Z

pkg/authentication/externalidp/awsiam/aws_client.go

+}
+
+type IAMAuthParams struct {
+	ProviderType        string


unused remove

cmd/lakectl/cmd/root.go

Isan-Rivkin · 2025-05-14T08:37:53Z

pkg/authentication/externalidp/awsiam/aws_client.go

+
+func NewIAMAuthParams(lakeFSHost string, opts ...IAMAuthParamsOptions) *IAMAuthParams {
+	headers := map[string]string{
+		"X-LakeFS-Server-ID": lakeFSHost,


please export to global-const so that it can be re-used by everest and other tools as well as verified in tests.
i.e something like:

const ( // Header that should contain the lakeFS host and will signed as part of the identity token request by default HostServerIDHeader ... )

Isan-Rivkin · 2025-05-14T08:41:31Z

pkg/authentication/externalidp/awsiam/aws_client.go

+	calculatedRegion := splitedCreds[2]
+	accessKeyID := splitedCreds[0]
+	return &AWSIdentityTokenInfo{
+		Method:             "POST",


use AuthMethod

Isan-Rivkin · 2025-05-14T08:41:49Z

pkg/authentication/externalidp/awsiam/aws_client.go

+				middleware.BuildOutput, middleware.Metadata, error,
+			) {
+				if req, ok := in.Request.(*smithyhttp.Request); ok {
+					req.Method = "POST"


use AuthMethod

Isan-Rivkin · 2025-05-14T08:52:50Z

pkg/authentication/externalidp/awsiam/aws_client.go

+
+func PresignGetCallerIdentityFromAuthParams(ctx context.Context, params *IAMAuthParams, stsClient *sts.Client) (string, error) {
+	setHTTPHeaders := func(requestHeaders map[string]string, ttl time.Duration) func(*middleware.Stack) error {
+		middlewareName := "AddHeaders" + uuid.New().String()


This is not a bug but a potential for one if the presignClient moves somewhere else and will be injected from the outside.
Should make the name constant, it'll make sure only single middleware of this type will be added to the presign client otherwise will error.

Isan-Rivkin · 2025-05-14T08:55:00Z

pkg/authentication/externalidp/awsiam/aws_client.go

+	if err != nil {
+		return "", err
+	}
+	return presign.URL, err


Suggested change

return presign.URL, err

return presign.URL, nil

pkg/authentication/externalidp/awsiam/aws_client.go

Isan-Rivkin · 2025-05-14T09:00:21Z

pkg/authentication/externalidp/awsiam/aws_client_test.go

+	}
+
+	url, err := PresignGetCallerIdentityFromAuthParams(context.TODO(), params, stsClient)
+	fmt.Println("\n\n", url)


Isan-Rivkin · 2025-05-14T09:04:18Z

pkg/authentication/externalidp/awsiam/aws_client_test.go

+	require.Contains(t, url, "sts.")
+	require.Contains(t, url, "us-east-1")
+	require.Contains(t, url, "X-Amz-Signature")
+	require.Contains(t, url, "X-Amz-Credential")
+	require.Contains(t, url, "X-Amz-Algorithm")
+	require.Contains(t, url, "X-Amz-Date")
+	require.Contains(t, url, fmt.Sprintf("X-Amz-Expires=%d", numSeconds))
+	require.Contains(t, url, "a-nice-header")
+	require.Contains(t, url, "x-custom-test")


instead parse the url and check actual query params and Their values are correact

import "net/url" parsedURL, err := url.Parse(presignedURL) require.NoError(t, err) queryParams := parsedURL.Query() // nothing less, nothing more, assert all expected values and check existance for signature

Isan-Rivkin · 2025-05-14T09:05:47Z

pkg/authentication/externalidp/awsiam/aws_client_test.go

+	url, err := PresignGetCallerIdentityFromAuthParams(context.TODO(), params, stsClient)
+	fmt.Println("\n\n", url)
+	require.NoError(t, err)
+	require.NotEmpty(t, url)


remove this check, empty can only be if err returned and you already check for err.

Isan-Rivkin · 2025-05-14T09:07:11Z

pkg/authentication/externalidp/awsiam/aws_client_test.go

+	require.Equal(t, params.TokenRequestHeaders["X-LakeFS-Server-ID"], "")
+
+	newheaders := map[string]string{"header": "hallo"}
+	newparams := NewIAMAuthParams("host", WithRefreshInterval(13*time.Minute), WithTokenTTL(9*time.Minute), WithProviderType("aws_iam"), WithTokenRequestHeaders(newheaders))


please use variables for all those and re-use, easier to change and read:
13*time.Minute, 9*time.Minute,

Isan-Rivkin · 2025-05-14T09:08:23Z

pkg/authentication/externalidp/awsiam/aws_client_test.go

+func TestGeneratePresignedURL_Integration(t *testing.T) {
+	numSeconds := 360
+	validCreds := aws.Credentials{
+		AccessKeyID: "accesKey",


This test actually exposes a bug, no?
we must have 3 parameters: secret key, access key AND session token
This will prolly reflect when u verify the presign url below.

Isan-Rivkin · 2025-05-14T09:30:27Z

pkg/authentication/externalidp/awsiam/aws_client_test.go

+	params := NewIAMAuthParams("")
+	require.Equal(t, params.TokenTTL, 3600*time.Minute)
+	require.Equal(t, params.RefreshInterval, 5*time.Minute)
+	require.Equal(t, params.TokenRequestHeaders["X-LakeFS-Server-ID"], "")


use x-lakefs-server-id as variable exported from aws_client.go

Isan-Rivkin · 2025-05-14T09:30:36Z

pkg/authentication/externalidp/awsiam/aws_client_test.go

+	require.Equal(t, newparams.TokenTTL, 9*time.Minute)
+	require.Equal(t, newparams.RefreshInterval, 13*time.Minute)
+	require.Equal(t, newparams.ProviderType, "aws_iam")
+	require.NotContains(t, newparams.TokenRequestHeaders["X-LakeFS-Server-ID"], "host")


use x-lakefs-server-id as variable exported from aws_client.go

Isan-Rivkin · 2025-05-14T09:31:53Z

pkg/authentication/externalidp/awsiam/aws_client_test.go

+	require.Contains(t, url, "X-Amz-Date")
+	require.Contains(t, url, fmt.Sprintf("X-Amz-Expires=%d", numSeconds))
+	require.Contains(t, url, "a-nice-header")
+	require.Contains(t, url, "x-custom-test")


also please verify X-Amz-Security-Token and X-Amz-SignedHeaders

Isan-Rivkin · 2025-05-14T11:25:20Z

pkg/authentication/externalidp/awsiam/aws_client_test.go

+	require.Contains(t, url, "amazonaws.com")   // ensures it's AWS
+	require.Contains(t, url, "X-Amz-Signature") // ensures it's signed
+}
+func TestGeneratePresignedURL_Integration(t *testing.T) {


function name should be TestPresignGetCallerIdentityFromAuthParams

Isan-Rivkin · 2025-05-14T11:29:14Z

pkg/authentication/externalidp/awsiam/aws_client_test.go

+	require.Equal(t, "a-nice-header;host;x-custom-test", q.Get("X-Amz-SignedHeaders"))
+	signedHeaders := q.Get("X-Amz-SignedHeaders")
+	require.Contains(t, signedHeaders, "a-nice-header")
+	require.Contains(t, signedHeaders, "x-custom-test")


Isn't require.Equal(t, "a-nice-header;host;x-custom-test", q.Get("X-Amz-SignedHeaders")) enough?

can be deleted, no?

signedHeaders := q.Get("X-Amz-SignedHeaders") require.Contains(t, signedHeaders, "a-nice-header") require.Contains(t, signedHeaders, "x-custom-test")

Isan-Rivkin

Very nice, LGTM!
please verify 2 things and merge:

remove extra lines testing signed headers
security token, is changing? if not check exact.

Isan-Rivkin · 2025-05-14T12:02:47Z

@ItamarYuran 🕺 🥳

IAM mount: lakefs IDP interface

a9e4edd

ItamarYuran added the exclude-changelog PR description should not be included in next release changelog label Apr 28, 2025

no lint

4dad5ff

ItamarYuran requested review from Isan-Rivkin and Jonathan-Rosenberg April 28, 2025 19:49

ItamarYuran added 2 commits April 29, 2025 16:27

maybe

125fecf

maybe now

7859d81

Isan-Rivkin requested changes Apr 29, 2025

View reviewed changes

Jonathan-Rosenberg requested changes Apr 29, 2025

View reviewed changes

ItamarYuran added 2 commits May 4, 2025 14:50

kadima

f477495

no linters

ef90ede

ItamarYuran requested review from Isan-Rivkin and Jonathan-Rosenberg May 4, 2025 15:09

caps

9b20fb1

Isan-Rivkin changed the title ~~IAM mount: lakefs IDP interface~~ AWS IAM: lakefs IDP interface May 5, 2025

ItamarYuran and others added 5 commits May 5, 2025 16:18

just another commit

c3080fd

Update README.md

1cb02ab

Merge branch 'master' into iam-auth

ab76f8d

fresh start

2d1405d

aws client

fdd6822

Isan-Rivkin requested changes May 7, 2025

View reviewed changes

ItamarYuran added 3 commits May 11, 2025 11:54

new way

e6e7d93

Merge branch 'master' into iam-auth

d541159

linter

6fff5d4

ItamarYuran requested a review from Isan-Rivkin May 11, 2025 09:08

Isan-Rivkin requested changes May 12, 2025

View reviewed changes

w tests

6dc1fcf

ItamarYuran requested a review from Isan-Rivkin May 12, 2025 08:54

right go mod

e148d23

Isan-Rivkin requested changes May 12, 2025

View reviewed changes

ItamarYuran added 2 commits May 12, 2025 14:24

right sum

ecbe333

changes

d53953e

ItamarYuran requested a review from Isan-Rivkin May 12, 2025 12:04

ItamarYuran added 2 commits May 12, 2025 15:22

no magics

4a28fb6

right errors

0049782

Isan-Rivkin requested changes May 13, 2025

View reviewed changes

ItamarYuran added 2 commits May 13, 2025 15:04

changes

02ed282

changes

3774f6c

ItamarYuran requested a review from Isan-Rivkin May 14, 2025 08:14

Isan-Rivkin requested changes May 14, 2025

View reviewed changes

pkg/authentication/externalidp/awsiam/aws_client.go Show resolved Hide resolved

Isan-Rivkin requested changes May 14, 2025

View reviewed changes

ItamarYuran requested a review from Isan-Rivkin May 14, 2025 11:08

ItamarYuran added 2 commits May 14, 2025 14:21

kadima

9975fd0

kadima2

0358833

Isan-Rivkin requested changes May 14, 2025

View reviewed changes

Isan-Rivkin self-requested a review May 14, 2025 11:33

Isan-Rivkin approved these changes May 14, 2025

View reviewed changes

kadima3

878b4d7

Jonathan-Rosenberg approved these changes May 14, 2025

View reviewed changes

ItamarYuran merged commit ef91121 into master May 14, 2025
41 checks passed

ItamarYuran deleted the iam-auth branch May 14, 2025 11:55

Isan-Rivkin added include-changelog PR description should be included in next release changelog and removed exclude-changelog PR description should not be included in next release changelog labels May 14, 2025

		defaultURLPresignTTL = 60 * time.Second
		defaultRefreshInterval = 300 * time.Second

		DefaultSTSLoginExpire = 15 * time.Minute

		mimLengthSplitCreds = 3

	var ErrInvalidCredentialsFormat = errors.New("missing required parts in credentials")
	var ErrInvalidCredentialsFormat = errors.New("missing required parts in query param X-Amz-Credential")

	return nil, fmt.Errorf("invalid credentials format: %w", ErrInvalidCredentialsFormat)
	return nil, fmt.Errorf("min length for query param not '%d' ('%s'): %w",mimLengthSplitCreds, splitedCreds, ErrInvalidCredentialsFormat)

AWS IAM: lakefs IDP interface #8994

AWS IAM: lakefs IDP interface #8994

Uh oh!

Conversation

ItamarYuran commented Apr 28, 2025 • edited by Isan-Rivkin Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Edit by isan for CHANGELOG:

Uh oh!

github-actions bot commented Apr 28, 2025

E2E Test Results - DynamoDB Local - Local Block Adapter

Uh oh!

github-actions bot commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Test Results - Quickstart

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Isan-Rivkin left a comment

Choose a reason for hiding this comment

Uh oh!

Isan-Rivkin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ItamarYuran commented Apr 28, 2025 •

edited by Isan-Rivkin

Loading

github-actions bot commented Apr 28, 2025 •

edited

Loading

Isan-Rivkin May 14, 2025 •

edited

Loading

Isan-Rivkin May 14, 2025 •

edited

Loading

Isan-Rivkin May 14, 2025 •

edited

Loading

Isan-Rivkin May 14, 2025 •

edited

Loading