import (
"bytes"
- "context"
"database/sql"
"encoding/json"
"fmt"
"io"
"io/ioutil"
+ "mime"
"net/http"
"net/url"
"regexp"
"strings"
- "git.curoverse.com/arvados.git/sdk/go/arvados"
- "git.curoverse.com/arvados.git/sdk/go/auth"
+ "git.arvados.org/arvados.git/sdk/go/arvados"
+ "git.arvados.org/arvados.git/sdk/go/auth"
"github.com/jmcvetta/randutil"
)
var wfRe = regexp.MustCompile(fmt.Sprintf(pathPattern, "workflows", "7fd4e"))
var containersRe = regexp.MustCompile(fmt.Sprintf(pathPattern, "containers", "dz642"))
var containerRequestsRe = regexp.MustCompile(fmt.Sprintf(pathPattern, "container_requests", "xvhdp"))
-var collectionRe = regexp.MustCompile(fmt.Sprintf(pathPattern, "collections", "4zz18"))
-var collectionByPDHRe = regexp.MustCompile(`^/arvados/v1/collections/([0-9a-fA-F]{32}\+[0-9]+)+$`)
+var collectionsRe = regexp.MustCompile(fmt.Sprintf(pathPattern, "collections", "4zz18"))
+var collectionsByPDHRe = regexp.MustCompile(`^/arvados/v1/collections/([0-9a-fA-F]{32}\+[0-9]+)+$`)
+var linksRe = regexp.MustCompile(fmt.Sprintf(pathPattern, "links", "o0j2j"))
-func (h *Handler) remoteClusterRequest(remoteID string, req *http.Request) (*http.Response, context.CancelFunc, error) {
+func (h *Handler) remoteClusterRequest(remoteID string, req *http.Request) (*http.Response, error) {
remote, ok := h.Cluster.RemoteClusters[remoteID]
if !ok {
- return nil, nil, HTTPError{fmt.Sprintf("no proxy available for cluster %v", remoteID), http.StatusNotFound}
+ return nil, HTTPError{fmt.Sprintf("no proxy available for cluster %v", remoteID), http.StatusNotFound}
}
scheme := remote.Scheme
if scheme == "" {
}
saltedReq, err := h.saltAuthToken(req, remoteID)
if err != nil {
- return nil, nil, err
+ return nil, err
}
urlOut := &url.URL{
Scheme: scheme,
// downstream proxy steps.
func loadParamsFromForm(req *http.Request) error {
var postBody *bytes.Buffer
- if req.Body != nil && req.Header.Get("Content-Type") == "application/x-www-form-urlencoded" {
+ if ct := req.Header.Get("Content-Type"); ct == "" {
+ // Assume application/octet-stream, i.e., no form to parse.
+ } else if ct, _, err := mime.ParseMediaType(ct); err != nil {
+ return err
+ } else if ct == "application/x-www-form-urlencoded" && req.Body != nil {
var cl int64
if req.ContentLength > 0 {
cl = req.ContentLength
containersHandler := &genericFederatedRequestHandler{next, h, containersRe, nil}
containerRequestsHandler := &genericFederatedRequestHandler{next, h, containerRequestsRe,
[]federatedRequestDelegate{remoteContainerRequestCreate}}
+ collectionsRequestsHandler := &genericFederatedRequestHandler{next, h, collectionsRe,
+ []federatedRequestDelegate{fetchRemoteCollectionByUUID, fetchRemoteCollectionByPDH}}
+ linksRequestsHandler := &genericFederatedRequestHandler{next, h, linksRe, nil}
mux.Handle("/arvados/v1/workflows", wfHandler)
mux.Handle("/arvados/v1/workflows/", wfHandler)
mux.Handle("/arvados/v1/containers/", containersHandler)
mux.Handle("/arvados/v1/container_requests", containerRequestsHandler)
mux.Handle("/arvados/v1/container_requests/", containerRequestsHandler)
- mux.Handle("/arvados/v1/collections", next)
- mux.Handle("/arvados/v1/collections/", &collectionFederatedRequestHandler{next, h})
+ mux.Handle("/arvados/v1/collections", collectionsRequestsHandler)
+ mux.Handle("/arvados/v1/collections/", collectionsRequestsHandler)
+ mux.Handle("/arvados/v1/links", linksRequestsHandler)
+ mux.Handle("/arvados/v1/links/", linksRequestsHandler)
mux.Handle("/", next)
return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
// checks it again api_client_authorizations table in the database,
// and fills in the token scope and user UUID. Does not handle remote
// tokens unless they are already in the database and not expired.
-func (h *Handler) validateAPItoken(req *http.Request, token string) (*CurrentUser, error) {
+//
+// Return values are:
+//
+// nil, false, non-nil -- if there was an internal error
+//
+// nil, false, nil -- if the token is invalid
+//
+// non-nil, true, nil -- if the token is valid
+func (h *Handler) validateAPItoken(req *http.Request, token string) (*CurrentUser, bool, error) {
user := CurrentUser{Authorization: arvados.APIClientAuthorization{APIToken: token}}
db, err := h.db(req)
if err != nil {
- return nil, err
+ return nil, false, err
}
var uuid string
user.Authorization.APIToken = token
var scopes string
err = db.QueryRowContext(req.Context(), `SELECT api_client_authorizations.uuid, api_client_authorizations.scopes, users.uuid FROM api_client_authorizations JOIN users on api_client_authorizations.user_id=users.id WHERE api_token=$1 AND (expires_at IS NULL OR expires_at > current_timestamp) LIMIT 1`, token).Scan(&user.Authorization.UUID, &scopes, &user.UUID)
- if err != nil {
- return nil, err
+ if err == sql.ErrNoRows {
+ return nil, false, nil
+ } else if err != nil {
+ return nil, false, err
}
if uuid != "" && user.Authorization.UUID != uuid {
- return nil, fmt.Errorf("UUID embedded in v2 token did not match record")
+ // secret part matches, but UUID doesn't -- somewhat surprising
+ return nil, false, nil
}
err = json.Unmarshal([]byte(scopes), &user.Authorization.Scopes)
if err != nil {
- return nil, err
+ return nil, false, err
}
- return &user, nil
+ return &user, true, nil
}
func (h *Handler) createAPItoken(req *http.Request, userUUID string, scopes []string) (*arvados.APIClientAuthorization, error) {
// If the token exists in our own database, salt it
// for the remote. Otherwise, assume it was issued by
// the remote, and pass it through unmodified.
- currentUser, err := h.validateAPItoken(req, creds.Tokens[0])
- if err == sql.ErrNoRows {
+ currentUser, ok, err := h.validateAPItoken(req, creds.Tokens[0])
+ if err != nil {
+ return nil, err
+ } else if !ok {
// Not ours; pass through unmodified.
token = creds.Tokens[0]
- } else if err != nil {
- return nil, err
} else {
// Found; make V2 version and salt it.
token, err = auth.SaltToken(currentUser.Authorization.TokenV2(), remote)
}
updatedReq.Header.Set("Authorization", "Bearer "+token)
- // Remove api_token=... from the the query string, in case we
+ // Remove api_token=... from the query string, in case we
// end up forwarding the request.
if values, err := url.ParseQuery(updatedReq.URL.RawQuery); err != nil {
return nil, err
projects / arvados.git / blobdiff