14260: secret_mounts works with runtime_token

[arvados.git] / services / api / app / controllers / arvados / v1 / containers_controller.rb

diff --git a/services/api/app/controllers/arvados/v1/containers_controller.rb b/services/api/app/controllers/arvados/v1/containers_controller.rb
index fa29dbd8135453587cee7a7fcfeb220f864d0755..98b987639bea61574423ae34322351569c803175 100644 (file)
--- a/services/api/app/controllers/arvados/v1/containers_controller.rb
+++ b/services/api/app/controllers/arvados/v1/containers_controller.rb
@@ -6,6 +6,7 @@ class Arvados::V1::ContainersController < ApplicationController
   accept_attribute_as_json :environment, Hash
   accept_attribute_as_json :mounts, Hash
   accept_attribute_as_json :runtime_constraints, Hash
+  accept_attribute_as_json :runtime_status, Hash
   accept_attribute_as_json :command, Array
   accept_attribute_as_json :scheduling_parameters, Hash
 
@@ -16,16 +17,19 @@ class Arvados::V1::ContainersController < ApplicationController
     if @object.locked_by_uuid != Thread.current[:api_client_authorization].uuid
       raise ArvadosModel::PermissionDeniedError.new("Not locked by your token")
     end
-    @object = @object.auth
+    if @object.runtime_token.nil?
+      @object = @object.auth
+    else
+      @object = ApiClientAuthorization.validate(token: @object.runtime_token)
+      if @object.nil?
+        raise ArvadosModel::PermissionDeniedError.new("Invalid runtime_token")
+      end
+    end
     show
   end
 
   def update
-    # container updates can trigger container request lookups, which
-    # can deadlock if we don't lock the container_requests table
-    # first.
-    @object.transaction do
-      ActiveRecord::Base.connection.execute('LOCK container_requests, containers IN EXCLUSIVE MODE')
+    @object.with_lock do
       @object.reload
       super
     end
@@ -54,20 +58,19 @@ class Arvados::V1::ContainersController < ApplicationController
     if Thread.current[:api_client_authorization].nil?
       send_error("Not logged in", status: 401)
     else
-      c = Container.where(auth_uuid: Thread.current[:api_client_authorization].uuid).first
-      if c.nil?
+      c = Container.for_current_token
+      if c.nil? or c.first.nil?
         send_error("Token is not associated with a container.", status: 404)
       else
-        @object = c
+        @object = c.first
         show
       end
     end
   end
 
   def secret_mounts
-    if @object &&
-       @object.auth_uuid &&
-       @object.auth_uuid == Thread.current[:api_client_authorization].uuid
+    c = Container.for_current_token
+    if @object && c && @object.uuid == c.uuid
       send_json({"secret_mounts" => @object.secret_mounts})
     else
       send_error("Token is not associated with this container.", status: 403)