- if effectiveMethod != "POST" || uuid != "" || remainder != "" ||
- *clusterId == "" || *clusterId == h.handler.Cluster.ClusterID {
+ if effectiveMethod != "POST" || uuid != "" || remainder != "" {
+ return false
+ }
+
+ // First make sure supplied token is valid.
+ creds := auth.NewCredentials()
+ creds.LoadTokensFromHTTPRequest(req)
+
+ currentUser, ok, err := h.handler.validateAPItoken(req, creds.Tokens[0])
+ if err != nil {
+ httpserver.Error(w, err.Error(), http.StatusInternalServerError)
+ return true
+ } else if !ok {
+ httpserver.Error(w, "invalid API token", http.StatusForbidden)
+ return true
+ }
+
+ if *clusterId == "" || *clusterId == h.handler.Cluster.ClusterID {
+ // Submitting container request to local cluster. No
+ // need to set a runtime_token (rails api will create
+ // one when the container runs) or do a remote cluster
+ // request.