Merge branch '16265-security-updates' into dependabot/bundler/apps/workbench/loofah...

[arvados.git] / lib / controller / handler.go

diff --git a/lib/controller/handler.go b/lib/controller/handler.go
index 775d2903475d6ad83eb368b77191cf479065cb57..e3869261a160b4e42d147574410f15b9641b4e9d 100644 (file)
--- a/lib/controller/handler.go
+++ b/lib/controller/handler.go
@@ -8,22 +8,24 @@ import (
        "context"
        "database/sql"
        "errors"
-       "net"
+       "fmt"
        "net/http"
        "net/url"
        "strings"
        "sync"
        "time"
 
-       "git.curoverse.com/arvados.git/sdk/go/arvados"
-       "git.curoverse.com/arvados.git/sdk/go/health"
-       "git.curoverse.com/arvados.git/sdk/go/httpserver"
+       "git.arvados.org/arvados.git/lib/controller/federation"
+       "git.arvados.org/arvados.git/lib/controller/railsproxy"
+       "git.arvados.org/arvados.git/lib/controller/router"
+       "git.arvados.org/arvados.git/sdk/go/arvados"
+       "git.arvados.org/arvados.git/sdk/go/health"
+       "git.arvados.org/arvados.git/sdk/go/httpserver"
        _ "github.com/lib/pq"
 )
 
 type Handler struct {
-       Cluster     *arvados.Cluster
-       NodeProfile *arvados.NodeProfile
+       Cluster *arvados.Cluster
 
        setupOnce      sync.Once
        handlerStack   http.Handler
@@ -50,8 +52,8 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
                        req.URL.Path = strings.Replace(req.URL.Path, "//", "/", -1)
                }
        }
-       if h.Cluster.HTTPRequestTimeout > 0 {
-               ctx, cancel := context.WithDeadline(req.Context(), time.Now().Add(time.Duration(h.Cluster.HTTPRequestTimeout)))
+       if h.Cluster.API.RequestTimeout > 0 {
+               ctx, cancel := context.WithDeadline(req.Context(), time.Now().Add(time.Duration(h.Cluster.API.RequestTimeout)))
                req = req.WithContext(ctx)
                defer cancel()
        }
@@ -61,7 +63,7 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 
 func (h *Handler) CheckHealth() error {
        h.setupOnce.Do(h.setup)
-       _, _, err := findRailsAPI(h.Cluster, h.NodeProfile)
+       _, _, err := railsproxy.FindRailsAPI(h.Cluster)
        return err
 }
 
@@ -74,6 +76,19 @@ func (h *Handler) setup() {
                Prefix: "/_health/",
                Routes: health.Routes{"ping": func() error { _, err := h.db(&http.Request{}); return err }},
        })
+
+       rtr := router.New(federation.New(h.Cluster))
+       mux.Handle("/arvados/v1/config", rtr)
+
+       if !h.Cluster.ForceLegacyAPI14 {
+               mux.Handle("/arvados/v1/collections", rtr)
+               mux.Handle("/arvados/v1/collections/", rtr)
+               mux.Handle("/arvados/v1/users", rtr)
+               mux.Handle("/arvados/v1/users/", rtr)
+               mux.Handle("/login", rtr)
+               mux.Handle("/logout", rtr)
+       }
+
        hs := http.NotFoundHandler()
        hs = prepend(hs, h.proxyRailsAPI)
        hs = h.setupProxyRemoteCluster(hs)
@@ -127,7 +142,7 @@ func prepend(next http.Handler, middleware middlewareFunc) http.Handler {
 }
 
 func (h *Handler) localClusterRequest(req *http.Request) (*http.Response, error) {
-       urlOut, insecure, err := findRailsAPI(h.Cluster, h.NodeProfile)
+       urlOut, insecure, err := railsproxy.FindRailsAPI(h.Cluster)
        if err != nil {
                return nil, err
        }
@@ -153,22 +168,19 @@ func (h *Handler) proxyRailsAPI(w http.ResponseWriter, req *http.Request, next h
        }
 }
 
-// For now, findRailsAPI always uses the rails API running on this
-// node.
-func findRailsAPI(cluster *arvados.Cluster, np *arvados.NodeProfile) (*url.URL, bool, error) {
-       hostport := np.RailsAPI.Listen
-       if len(hostport) > 1 && hostport[0] == ':' && strings.TrimRight(hostport[1:], "0123456789") == "" {
-               // ":12345" => connect to indicated port on localhost
-               hostport = "localhost" + hostport
-       } else if _, _, err := net.SplitHostPort(hostport); err == nil {
-               // "[::1]:12345" => connect to indicated address & port
-       } else {
-               return nil, false, err
+// Use a localhost entry from Services.RailsAPI.InternalURLs if one is
+// present, otherwise choose an arbitrary entry.
+func findRailsAPI(cluster *arvados.Cluster) (*url.URL, bool, error) {
+       var best *url.URL
+       for target := range cluster.Services.RailsAPI.InternalURLs {
+               target := url.URL(target)
+               best = &target
+               if strings.HasPrefix(target.Host, "localhost:") || strings.HasPrefix(target.Host, "127.0.0.1:") || strings.HasPrefix(target.Host, "[::1]:") {
+                       break
+               }
        }
-       proto := "http"
-       if np.RailsAPI.TLS {
-               proto = "https"
+       if best == nil {
+               return nil, false, fmt.Errorf("Services.RailsAPI.InternalURLs is empty")
        }
-       url, err := url.Parse(proto + "://" + hostport)
-       return url, np.RailsAPI.Insecure, err
+       return best, cluster.TLS.Insecure, nil
 }