1 // Copyright (C) The Arvados Authors. All rights reserved.
3 // SPDX-License-Identifier: AGPL-3.0
23 "git.arvados.org/arvados.git/lib/cmd"
24 "git.arvados.org/arvados.git/lib/webdavfs"
25 "git.arvados.org/arvados.git/sdk/go/arvados"
26 "git.arvados.org/arvados.git/sdk/go/arvadosclient"
27 "git.arvados.org/arvados.git/sdk/go/auth"
28 "git.arvados.org/arvados.git/sdk/go/ctxlog"
29 "git.arvados.org/arvados.git/sdk/go/httpserver"
30 "github.com/sirupsen/logrus"
31 "golang.org/x/net/webdav"
36 Cluster *arvados.Cluster
40 lock map[string]*sync.RWMutex
43 s3SecretCache map[string]*cachedS3Secret
44 s3SecretCacheMtx sync.Mutex
45 s3SecretCacheNextTidy time.Time
48 var urlPDHDecoder = strings.NewReplacer(" ", "+", "-", "+")
50 var notFoundMessage = "Not Found"
51 var unauthorizedMessage = "401 Unauthorized\n\nA valid Arvados token must be provided to access this resource."
53 // parseCollectionIDFromURL returns a UUID or PDH if s is a UUID or a
54 // PDH (even if it is a PDH with "+" replaced by " " or "-");
56 func parseCollectionIDFromURL(s string) string {
57 if arvadosclient.UUIDMatch(s) {
60 if pdh := urlPDHDecoder.Replace(s); arvadosclient.PDHMatch(pdh) {
66 func (h *handler) serveStatus(w http.ResponseWriter, r *http.Request) {
67 json.NewEncoder(w).Encode(struct{ Version string }{cmd.Version.String()})
70 type errorWithHTTPStatus interface {
74 // updateOnSuccess wraps httpserver.ResponseWriter. If the handler
75 // sends an HTTP header indicating success, updateOnSuccess first
76 // calls the provided update func. If the update func fails, an error
77 // response is sent (using the error's HTTP status or 500 if none),
78 // and the status code and body sent by the handler are ignored (all
79 // response writes return the update error).
80 type updateOnSuccess struct {
81 httpserver.ResponseWriter
82 logger logrus.FieldLogger
88 func (uos *updateOnSuccess) Write(p []byte) (int, error) {
90 uos.WriteHeader(http.StatusOK)
95 return uos.ResponseWriter.Write(p)
98 func (uos *updateOnSuccess) WriteHeader(code int) {
100 uos.sentHeader = true
101 if code >= 200 && code < 400 {
102 if uos.err = uos.update(); uos.err != nil {
103 code := http.StatusInternalServerError
104 if he := errorWithHTTPStatus(nil); errors.As(uos.err, &he) {
105 code = he.HTTPStatus()
107 uos.logger.WithError(uos.err).Errorf("update() returned %T error, changing response to HTTP %d", uos.err, code)
108 http.Error(uos.ResponseWriter, uos.err.Error(), code)
113 uos.ResponseWriter.WriteHeader(code)
117 corsAllowHeadersHeader = strings.Join([]string{
118 "Authorization", "Content-Type", "Range",
119 // WebDAV request headers:
120 "Depth", "Destination", "If", "Lock-Token", "Overwrite", "Timeout", "Cache-Control",
122 writeMethod = map[string]bool{
133 webdavMethod = map[string]bool{
146 browserMethod = map[string]bool{
151 // top-level dirs to serve with siteFS
152 siteFSDir = map[string]bool{
153 "": true, // root directory
159 func stripDefaultPort(host string) string {
160 // Will consider port 80 and port 443 to be the same vhost. I think that's fine.
161 u := &url.URL{Host: host}
162 if p := u.Port(); p == "80" || p == "443" {
163 return strings.ToLower(u.Hostname())
165 return strings.ToLower(host)
169 // CheckHealth implements service.Handler.
170 func (h *handler) CheckHealth() error {
174 // Done implements service.Handler.
175 func (h *handler) Done() <-chan struct{} {
179 // ServeHTTP implements http.Handler.
180 func (h *handler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
181 if xfp := r.Header.Get("X-Forwarded-Proto"); xfp != "" && xfp != "http" {
185 wbuffer := newWriteBuffer(wOrig, int(h.Cluster.Collections.WebDAVOutputBuffer))
186 defer wbuffer.Close()
187 w := httpserver.WrapResponseWriter(responseWriter{
189 ResponseWriter: wOrig,
192 if r.Method == "OPTIONS" && ServeCORSPreflight(w, r.Header) {
196 if !browserMethod[r.Method] && !webdavMethod[r.Method] {
197 w.WriteHeader(http.StatusMethodNotAllowed)
201 if r.Header.Get("Origin") != "" {
202 // Allow simple cross-origin requests without user
203 // credentials ("user credentials" as defined by CORS,
204 // i.e., cookies, HTTP authentication, and client-side
205 // SSL certificates. See
206 // http://www.w3.org/TR/cors/#user-credentials).
207 w.Header().Set("Access-Control-Allow-Origin", "*")
208 w.Header().Set("Access-Control-Expose-Headers", "Content-Range")
216 arvPath := r.URL.Path
217 if prefix := r.Header.Get("X-Webdav-Prefix"); prefix != "" {
218 // Enable a proxy (e.g., container log handler in
219 // controller) to satisfy a request for path
220 // "/foo/bar/baz.txt" using content from
221 // "//abc123-4.internal/bar/baz.txt", by adding a
222 // request header "X-Webdav-Prefix: /foo"
223 if !strings.HasPrefix(arvPath, prefix) {
224 http.Error(w, "X-Webdav-Prefix header is not a prefix of the requested path", http.StatusBadRequest)
227 arvPath = r.URL.Path[len(prefix):]
231 w.Header().Set("Vary", "X-Webdav-Prefix, "+w.Header().Get("Vary"))
232 webdavPrefix = prefix
234 pathParts := strings.Split(arvPath[1:], "/")
237 var collectionID string
239 var reqTokens []string
243 credentialsOK := h.Cluster.Collections.TrustAllContent
244 reasonNotAcceptingCredentials := ""
246 if r.Host != "" && stripDefaultPort(r.Host) == stripDefaultPort(h.Cluster.Services.WebDAVDownload.ExternalURL.Host) {
249 } else if r.FormValue("disposition") == "attachment" {
254 reasonNotAcceptingCredentials = fmt.Sprintf("vhost %q does not specify a single collection ID or match Services.WebDAVDownload.ExternalURL %q, and Collections.TrustAllContent is false",
255 r.Host, h.Cluster.Services.WebDAVDownload.ExternalURL)
258 if collectionID = arvados.CollectionIDFromDNSName(r.Host); collectionID != "" {
259 // http://ID.collections.example/PATH...
261 } else if r.URL.Path == "/status.json" {
264 } else if siteFSDir[pathParts[0]] {
266 } else if len(pathParts) >= 1 && strings.HasPrefix(pathParts[0], "c=") {
268 collectionID = parseCollectionIDFromURL(pathParts[0][2:])
270 } else if len(pathParts) >= 2 && pathParts[0] == "collections" {
271 if len(pathParts) >= 4 && pathParts[1] == "download" {
272 // /collections/download/ID/TOKEN/PATH...
273 collectionID = parseCollectionIDFromURL(pathParts[2])
274 tokens = []string{pathParts[3]}
278 // /collections/ID/PATH...
279 collectionID = parseCollectionIDFromURL(pathParts[1])
281 // This path is only meant to work for public
282 // data. Tokens provided with the request are
284 credentialsOK = false
285 reasonNotAcceptingCredentials = "the '/collections/UUID/PATH' form only works for public data"
290 if cc := r.Header.Get("Cache-Control"); strings.Contains(cc, "no-cache") || strings.Contains(cc, "must-revalidate") {
295 reqTokens = auth.CredentialsFromRequest(r).Tokens
299 origin := r.Header.Get("Origin")
300 cors := origin != "" && !strings.HasSuffix(origin, "://"+r.Host)
301 safeAjax := cors && (r.Method == http.MethodGet || r.Method == http.MethodHead)
302 // Important distinction: safeAttachment checks whether api_token exists
303 // as a query parameter. haveFormTokens checks whether api_token exists
304 // as request form data *or* a query parameter. Different checks are
305 // necessary because both the request disposition and the location of
306 // the API token affect whether or not the request needs to be
307 // redirected. The different branch comments below explain further.
308 safeAttachment := attachment && !r.URL.Query().Has("api_token")
309 if formTokens, haveFormTokens := r.Form["api_token"]; !haveFormTokens {
310 // No token to use or redact.
311 } else if safeAjax || safeAttachment {
312 // If this is a cross-origin request, the URL won't
313 // appear in the browser's address bar, so
314 // substituting a clipboard-safe URL is pointless.
315 // Redirect-with-cookie wouldn't work anyway, because
316 // it's not safe to allow third-party use of our
319 // If we're supplying an attachment, we don't need to
320 // convert POST to GET to avoid the "really resubmit
321 // form?" problem, so provided the token isn't
322 // embedded in the URL, there's no reason to do
323 // redirect-with-cookie in this case either.
324 for _, tok := range formTokens {
325 reqTokens = append(reqTokens, tok)
327 } else if browserMethod[r.Method] {
328 // If this is a page view, and the client provided a
329 // token via query string or POST body, we must put
330 // the token in an HttpOnly cookie, and redirect to an
331 // equivalent URL with the query param redacted and
333 h.seeOtherWithCookie(w, r, "", credentialsOK)
337 targetPath := pathParts[stripParts:]
338 if tokens == nil && len(targetPath) > 0 && strings.HasPrefix(targetPath[0], "t=") {
339 // http://ID.example/t=TOKEN/PATH...
340 // /c=ID/t=TOKEN/PATH...
342 // This form must only be used to pass scoped tokens
343 // that give permission for a single collection. See
344 // FormValue case above.
345 tokens = []string{targetPath[0][2:]}
347 targetPath = targetPath[1:]
353 if writeMethod[r.Method] {
354 http.Error(w, webdavfs.ErrReadOnly.Error(), http.StatusMethodNotAllowed)
357 if len(reqTokens) == 0 {
358 w.Header().Add("WWW-Authenticate", "Basic realm=\"collections\"")
359 http.Error(w, unauthorizedMessage, http.StatusUnauthorized)
363 } else if collectionID == "" {
364 http.Error(w, notFoundMessage, http.StatusNotFound)
367 fsprefix = "by_id/" + collectionID + "/"
370 if src := r.Header.Get("X-Webdav-Source"); strings.HasPrefix(src, "/") && !strings.Contains(src, "//") && !strings.Contains(src, "/../") {
376 if h.Cluster.Users.AnonymousUserToken != "" {
377 tokens = append(tokens, h.Cluster.Users.AnonymousUserToken)
381 if len(targetPath) > 0 && targetPath[0] == "_" {
382 // If a collection has a directory called "t=foo" or
383 // "_", it can be served at
384 // //collections.example/_/t=foo/ or
385 // //collections.example/_/_/ respectively:
386 // //collections.example/t=foo/ won't work because
387 // t=foo will be interpreted as a token "foo".
388 targetPath = targetPath[1:]
392 dirOpenMode := os.O_RDONLY
393 if writeMethod[r.Method] {
394 dirOpenMode = os.O_RDWR
398 var tokenScopeProblem bool
400 var tokenUser *arvados.User
401 var sessionFS arvados.CustomFileSystem
402 var session *cachedSession
403 var collectionDir arvados.File
404 for _, token = range tokens {
405 var statusErr errorWithHTTPStatus
406 fs, sess, user, err := h.Cache.GetSession(token)
407 if errors.As(err, &statusErr) && statusErr.HTTPStatus() == http.StatusUnauthorized {
410 } else if err != nil {
411 http.Error(w, "cache error: "+err.Error(), http.StatusInternalServerError)
414 if token != h.Cluster.Users.AnonymousUserToken {
417 f, err := fs.OpenFile(fsprefix, dirOpenMode, 0)
418 if errors.As(err, &statusErr) &&
419 statusErr.HTTPStatus() == http.StatusForbidden &&
420 token != h.Cluster.Users.AnonymousUserToken {
421 // collection id is outside scope of supplied
423 tokenScopeProblem = true
426 } else if os.IsNotExist(err) {
427 // collection does not exist or is not
428 // readable using this token
431 } else if err != nil {
432 http.Error(w, err.Error(), http.StatusInternalServerError)
438 collectionDir, sessionFS, session, tokenUser = f, fs, sess, user
442 // releaseSession() is equivalent to session.Release() except
443 // that it's a no-op if (1) session is nil, or (2) it has
444 // already been called.
446 // This way, we can do a defer call here to ensure it gets
447 // called in all code paths, and also call it inline (see
448 // below) in the cases where we want to release the lock
450 releaseSession := func() {}
452 var releaseSessionOnce sync.Once
453 releaseSession = func() { releaseSessionOnce.Do(func() { session.Release() }) }
455 defer releaseSession()
457 if forceReload && collectionDir != nil {
458 err := collectionDir.Sync()
460 if he := errorWithHTTPStatus(nil); errors.As(err, &he) {
461 http.Error(w, err.Error(), he.HTTPStatus())
463 http.Error(w, err.Error(), http.StatusInternalServerError)
470 // The URL is a "secret sharing link" that
471 // didn't work out. Asking the client for
472 // additional credentials would just be
474 http.Error(w, notFoundMessage, http.StatusNotFound)
478 // The client provided valid token(s), but the
479 // collection was not found.
480 http.Error(w, notFoundMessage, http.StatusNotFound)
483 if tokenScopeProblem {
484 // The client provided a valid token but
485 // fetching a collection returned 401, which
486 // means the token scope doesn't permit
487 // fetching that collection.
488 http.Error(w, notFoundMessage, http.StatusForbidden)
491 // The client's token was invalid (e.g., expired), or
492 // the client didn't even provide one. Redirect to
493 // workbench2's login-and-redirect-to-download url if
494 // this is a browser navigation request. (The redirect
495 // flow can't preserve the original method if it's not
496 // GET, and doesn't make sense if the UA is a
497 // command-line tool, is trying to load an inline
498 // image, etc.; in these cases, there's nothing we can
499 // do, so return 401 unauthorized.)
501 // Note Sec-Fetch-Mode is sent by all non-EOL
502 // browsers, except Safari.
503 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode
505 // TODO(TC): This response would be confusing to
506 // someone trying (anonymously) to download public
507 // data that has been deleted. Allow a referrer to
508 // provide this context somehow?
509 if r.Method == http.MethodGet && r.Header.Get("Sec-Fetch-Mode") == "navigate" {
510 target := url.URL(h.Cluster.Services.Workbench2.ExternalURL)
511 redirkey := "redirectToPreview"
513 redirkey = "redirectToDownload"
515 callback := "/c=" + collectionID + "/" + strings.Join(targetPath, "/")
516 query := url.Values{redirkey: {callback}}
517 queryString := query.Encode()
518 // Note: Encode (and QueryEscape function) turns space
519 // into plus sign (+) rather than %20 (the plus sign
520 // becomes %2B); that is the rule for web forms data
521 // sent in URL query part via GET, but we're not
522 // emulating forms here. Client JS APIs
523 // (URLSearchParam#get, decodeURIComponent) will
524 // decode %20, but while the former also expects the
525 // form-specific encoding, the latter doesn't.
526 // Encode() almost encodes everything; RFC3986 sec. 3.4
527 // says "it is sometimes better for usability" to not
528 // encode / and ? when passing URI reference in query.
529 // This is also legal according to WHATWG URL spec and
530 // can be desirable for debugging webapp.
531 // We can let slash / appear in the encoded query, and
532 // equality-sign = too, but exempting ? is not very
534 // Plus-sign, hash, and ampersand are never exempt.
535 r := strings.NewReplacer("+", "%20", "%2F", "/", "%3D", "=")
536 target.RawQuery = r.Replace(queryString)
537 w.Header().Add("Location", target.String())
538 w.WriteHeader(http.StatusSeeOther)
542 http.Error(w, fmt.Sprintf("Authorization tokens are not accepted here: %v, and no anonymous user token is configured.", reasonNotAcceptingCredentials), http.StatusUnauthorized)
545 // If none of the above cases apply, suggest the
546 // user-agent (which is either a non-browser agent
547 // like wget, or a browser that can't redirect through
548 // a login flow) prompt the user for credentials.
549 w.Header().Add("WWW-Authenticate", "Basic realm=\"collections\"")
550 http.Error(w, unauthorizedMessage, http.StatusUnauthorized)
554 if r.Method == http.MethodGet || r.Method == http.MethodHead {
555 targetfnm := fsprefix + strings.Join(pathParts[stripParts:], "/")
556 if fi, err := sessionFS.Stat(targetfnm); err == nil && fi.IsDir() {
557 releaseSession() // because we won't be writing anything
558 if !strings.HasSuffix(r.URL.Path, "/") {
559 h.seeOtherWithCookie(w, r, r.URL.Path+"/", credentialsOK)
561 h.serveDirectory(w, r, fi.Name(), sessionFS, targetfnm, !useSiteFS)
568 if len(targetPath) > 0 {
569 basename = targetPath[len(targetPath)-1]
571 if arvadosclient.PDHMatch(collectionID) && writeMethod[r.Method] {
572 http.Error(w, webdavfs.ErrReadOnly.Error(), http.StatusMethodNotAllowed)
575 if !h.userPermittedToUploadOrDownload(r.Method, tokenUser) {
576 http.Error(w, "Not permitted", http.StatusForbidden)
579 h.logUploadOrDownload(r, session.arvadosclient, sessionFS, fsprefix+strings.Join(targetPath, "/"), nil, tokenUser)
581 writing := writeMethod[r.Method]
582 locker := h.collectionLock(collectionID, writing)
583 defer locker.Unlock()
586 // Save the collection only if/when all
587 // webdav->filesystem operations succeed --
588 // and send a 500 error if the modified
589 // collection can't be saved.
591 // Perform the write in a separate sitefs, so
592 // concurrent read operations on the same
593 // collection see the previous saved
594 // state. After the write succeeds and the
595 // collection record is updated, we reset the
596 // session so the updates are visible in
597 // subsequent read requests.
598 client := session.client.WithRequestID(r.Header.Get("X-Request-Id"))
599 sessionFS = client.SiteFileSystem(session.keepclient)
600 writingDir, err := sessionFS.OpenFile(fsprefix, os.O_RDONLY, 0)
602 http.Error(w, err.Error(), http.StatusInternalServerError)
605 defer writingDir.Close()
606 w = &updateOnSuccess{
608 logger: ctxlog.FromContext(r.Context()),
609 update: func() error {
610 err := writingDir.Sync()
611 var te arvados.TransactionError
612 if errors.As(err, &te) {
618 // Sync the changes to the persistent
619 // sessionfs for this token.
620 snap, err := writingDir.Snapshot()
624 collectionDir.Splice(snap)
628 // When writing, we need to block session renewal
629 // until we're finished, in order to guarantee the
630 // effect of the write is visible in future responses.
631 // But if we're not writing, we can release the lock
632 // early. This enables us to keep renewing sessions
633 // and processing more requests even if a slow client
634 // takes a long time to download a large file.
637 if r.Method == http.MethodGet {
638 applyContentDispositionHdr(w, r, basename, attachment)
640 if webdavPrefix == "" {
641 webdavPrefix = "/" + strings.Join(pathParts[:stripParts], "/")
643 wh := &webdav.Handler{
644 Prefix: webdavPrefix,
645 FileSystem: &webdavfs.FS{
646 FileSystem: sessionFS,
648 Writing: writeMethod[r.Method],
649 AlwaysReadEOF: r.Method == "PROPFIND",
651 LockSystem: webdavfs.NoLockSystem,
652 Logger: func(r *http.Request, err error) {
653 if err != nil && !os.IsNotExist(err) {
654 ctxlog.FromContext(r.Context()).WithError(err).Error("error reported by webdav handler")
658 h.metrics.track(wh, w, r)
659 if r.Method == http.MethodGet && w.WroteStatus() == http.StatusOK {
660 wrote := int64(w.WroteBodyBytes())
661 fnm := strings.Join(pathParts[stripParts:], "/")
662 fi, err := wh.FileSystem.Stat(r.Context(), fnm)
663 if err == nil && fi.Size() != wrote {
665 f, err := wh.FileSystem.OpenFile(r.Context(), fnm, os.O_RDONLY, 0)
667 n, err = f.Read(make([]byte, 1024))
670 ctxlog.FromContext(r.Context()).Errorf("stat.Size()==%d but only wrote %d bytes; read(1024) returns %d, %v", fi.Size(), wrote, n, err)
675 var dirListingTemplate = `<!DOCTYPE HTML>
677 <META name="robots" content="NOINDEX">
678 <TITLE>{{ .CollectionName }}</TITLE>
679 <STYLE type="text/css">
684 background-color: #D9EDF7;
685 border-radius: .25em;
696 font-family: monospace;
703 <H1>{{ .CollectionName }}</H1>
705 <P>This collection of data files is being shared with you through
706 Arvados. You can download individual files listed below. To download
707 the entire directory tree with wget, try:</P>
709 <PRE>$ wget --mirror --no-parent --no-host --cut-dirs={{ .StripParts }} https://{{ .Request.Host }}{{ .Request.URL.Path }}</PRE>
711 <H2>File Listing</H2>
717 <LI>{{" " | printf "%15s " | nbsp}}<A href="{{print "./" .Name}}/">{{.Name}}/</A></LI>
719 <LI>{{.Size | printf "%15d " | nbsp}}<A href="{{print "./" .Name}}">{{.Name}}</A></LI>
724 <P>(No files; this collection is empty.)</P>
731 Arvados is a free and open source software bioinformatics platform.
732 To learn more, visit arvados.org.
733 Arvados is not responsible for the files listed on this page.
740 type fileListEnt struct {
746 func (h *handler) serveDirectory(w http.ResponseWriter, r *http.Request, collectionName string, fs http.FileSystem, base string, recurse bool) {
747 var files []fileListEnt
748 var walk func(string) error
749 if !strings.HasSuffix(base, "/") {
752 walk = func(path string) error {
753 dirname := base + path
755 dirname = strings.TrimSuffix(dirname, "/")
757 d, err := fs.Open(dirname)
761 ents, err := d.Readdir(-1)
765 for _, ent := range ents {
766 if recurse && ent.IsDir() {
767 err = walk(path + ent.Name() + "/")
772 files = append(files, fileListEnt{
773 Name: path + ent.Name(),
781 if err := walk(""); err != nil {
782 http.Error(w, "error getting directory listing: "+err.Error(), http.StatusInternalServerError)
786 funcs := template.FuncMap{
787 "nbsp": func(s string) template.HTML {
788 return template.HTML(strings.Replace(s, " ", " ", -1))
791 tmpl, err := template.New("dir").Funcs(funcs).Parse(dirListingTemplate)
793 http.Error(w, "error parsing template: "+err.Error(), http.StatusInternalServerError)
796 sort.Slice(files, func(i, j int) bool {
797 return files[i].Name < files[j].Name
799 w.WriteHeader(http.StatusOK)
800 tmpl.Execute(w, map[string]interface{}{
801 "CollectionName": collectionName,
804 "StripParts": strings.Count(strings.TrimRight(r.URL.Path, "/"), "/"),
808 func applyContentDispositionHdr(w http.ResponseWriter, r *http.Request, filename string, isAttachment bool) {
809 disposition := "inline"
811 disposition = "attachment"
813 if strings.ContainsRune(r.RequestURI, '?') {
814 // Help the UA realize that the filename is just
815 // "filename.txt", not
816 // "filename.txt?disposition=attachment".
818 // TODO(TC): Follow advice at RFC 6266 appendix D
819 disposition += "; filename=" + strconv.QuoteToASCII(filename)
821 if disposition != "inline" {
822 w.Header().Set("Content-Disposition", disposition)
826 func (h *handler) seeOtherWithCookie(w http.ResponseWriter, r *http.Request, location string, credentialsOK bool) {
827 if formTokens, haveFormTokens := r.Form["api_token"]; haveFormTokens {
829 // It is not safe to copy the provided token
830 // into a cookie unless the current vhost
831 // (origin) serves only a single collection or
832 // we are in TrustAllContent mode.
833 http.Error(w, "cannot serve inline content at this URL (possible configuration error; see https://doc.arvados.org/install/install-keep-web.html#dns)", http.StatusBadRequest)
837 // The HttpOnly flag is necessary to prevent
838 // JavaScript code (included in, or loaded by, a page
839 // in the collection being served) from employing the
840 // user's token beyond reading other files in the same
841 // domain, i.e., same collection.
843 // The 303 redirect is necessary in the case of a GET
844 // request to avoid exposing the token in the Location
845 // bar, and in the case of a POST request to avoid
846 // raising warnings when the user refreshes the
848 for _, tok := range formTokens {
852 http.SetCookie(w, &http.Cookie{
853 Name: "arvados_api_token",
854 Value: auth.EncodeTokenCookie([]byte(tok)),
857 SameSite: http.SameSiteLaxMode,
863 // Propagate query parameters (except api_token) from
864 // the original request.
865 redirQuery := r.URL.Query()
866 redirQuery.Del("api_token")
870 newu, err := u.Parse(location)
872 http.Error(w, "error resolving redirect target: "+err.Error(), http.StatusInternalServerError)
878 Scheme: r.URL.Scheme,
881 RawQuery: redirQuery.Encode(),
884 w.Header().Add("Location", redir)
885 w.WriteHeader(http.StatusSeeOther)
886 io.WriteString(w, `<A href="`)
887 io.WriteString(w, html.EscapeString(redir))
888 io.WriteString(w, `">Continue</A>`)
891 func (h *handler) userPermittedToUploadOrDownload(method string, tokenUser *arvados.User) bool {
892 var permitDownload bool
893 var permitUpload bool
894 if tokenUser != nil && tokenUser.IsAdmin {
895 permitUpload = h.Cluster.Collections.WebDAVPermission.Admin.Upload
896 permitDownload = h.Cluster.Collections.WebDAVPermission.Admin.Download
898 permitUpload = h.Cluster.Collections.WebDAVPermission.User.Upload
899 permitDownload = h.Cluster.Collections.WebDAVPermission.User.Download
901 if (method == "PUT" || method == "POST") && !permitUpload {
902 // Disallow operations that upload new files.
903 // Permit webdav operations that move existing files around.
905 } else if method == "GET" && !permitDownload {
906 // Disallow downloading file contents.
907 // Permit webdav operations like PROPFIND that retrieve metadata
908 // but not file contents.
914 func (h *handler) logUploadOrDownload(
916 client *arvadosclient.ArvadosClient,
917 fs arvados.CustomFileSystem,
919 collection *arvados.Collection,
920 user *arvados.User) {
922 log := ctxlog.FromContext(r.Context())
923 props := make(map[string]string)
924 props["reqPath"] = r.URL.Path
927 log = log.WithField("user_uuid", user.UUID).
928 WithField("user_full_name", user.FullName)
931 useruuid = fmt.Sprintf("%s-tpzed-anonymouspublic", h.Cluster.ClusterID)
933 if collection == nil && fs != nil {
934 collection, filepath = h.determineCollection(fs, filepath)
936 if collection != nil {
937 log = log.WithField("collection_file_path", filepath)
938 props["collection_file_path"] = filepath
939 // h.determineCollection populates the collection_uuid
940 // prop with the PDH, if this collection is being
941 // accessed via PDH. For logging, we use a different
942 // field depending on whether it's a UUID or PDH.
943 if len(collection.UUID) > 32 {
944 log = log.WithField("portable_data_hash", collection.UUID)
945 props["portable_data_hash"] = collection.UUID
947 log = log.WithField("collection_uuid", collection.UUID)
948 props["collection_uuid"] = collection.UUID
951 if r.Method == "PUT" || r.Method == "POST" {
952 log.Info("File upload")
953 if h.Cluster.Collections.WebDAVLogEvents {
955 lr := arvadosclient.Dict{"log": arvadosclient.Dict{
956 "object_uuid": useruuid,
957 "event_type": "file_upload",
958 "properties": props}}
959 err := client.Create("logs", lr, nil)
961 log.WithError(err).Error("Failed to create upload log event on API server")
965 } else if r.Method == "GET" {
966 if collection != nil && collection.PortableDataHash != "" {
967 log = log.WithField("portable_data_hash", collection.PortableDataHash)
968 props["portable_data_hash"] = collection.PortableDataHash
970 log.Info("File download")
971 if h.Cluster.Collections.WebDAVLogEvents {
973 lr := arvadosclient.Dict{"log": arvadosclient.Dict{
974 "object_uuid": useruuid,
975 "event_type": "file_download",
976 "properties": props}}
977 err := client.Create("logs", lr, nil)
979 log.WithError(err).Error("Failed to create download log event on API server")
986 func (h *handler) determineCollection(fs arvados.CustomFileSystem, path string) (*arvados.Collection, string) {
987 target := strings.TrimSuffix(path, "/")
988 for cut := len(target); cut >= 0; cut = strings.LastIndexByte(target, '/') {
989 target = target[:cut]
990 fi, err := fs.Stat(target)
991 if os.IsNotExist(err) {
992 // creating a new file/dir, or download
995 } else if err != nil {
998 switch src := fi.Sys().(type) {
999 case *arvados.Collection:
1000 return src, strings.TrimPrefix(path[len(target):], "/")
1001 case *arvados.Group:
1004 if _, ok := src.(error); ok {
1012 var lockTidyInterval = time.Minute * 10
1014 // Lock the specified collection for reading or writing. Caller must
1015 // call Unlock() on the returned Locker when the operation is
1017 func (h *handler) collectionLock(collectionID string, writing bool) sync.Locker {
1019 defer h.lockMtx.Unlock()
1020 if time.Since(h.lockTidied) > lockTidyInterval {
1021 // Periodically delete all locks that aren't in use.
1022 h.lockTidied = time.Now()
1023 for id, locker := range h.lock {
1024 if locker.TryLock() {
1030 locker := h.lock[collectionID]
1032 locker = new(sync.RWMutex)
1034 h.lock = map[string]*sync.RWMutex{}
1036 h.lock[collectionID] = locker
1043 return locker.RLocker()
1047 func ServeCORSPreflight(w http.ResponseWriter, header http.Header) bool {
1048 method := header.Get("Access-Control-Request-Method")
1052 if !browserMethod[method] && !webdavMethod[method] {
1053 w.WriteHeader(http.StatusMethodNotAllowed)
1056 w.Header().Set("Access-Control-Allow-Headers", corsAllowHeadersHeader)
1057 w.Header().Set("Access-Control-Allow-Methods", "COPY, DELETE, GET, LOCK, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, RMCOL, UNLOCK")
1058 w.Header().Set("Access-Control-Allow-Origin", "*")
1059 w.Header().Set("Access-Control-Max-Age", "86400")