Merge branch '18682-use-keyrings-instead-of-key-ids'

[arvados.git] / lib / controller / integration_test.go

diff --git a/lib/controller/integration_test.go b/lib/controller/integration_test.go
index c877d046b402485e3cdf744614b445f5a1251aaa..9f5d12598b70e31728fe29fb28ae4fa8ce58ec4e 100644 (file)
--- a/lib/controller/integration_test.go
+++ b/lib/controller/integration_test.go
@@ -510,10 +510,18 @@ func (s *IntegrationSuite) TestRequestIDHeader(c *check.C) {
                {"/arvados/v1/collections/" + coll.UUID, true, false},
                {"/arvados/v1/specimens/" + specimen.UUID, false, false},
                {"/arvados/v1/specimens/" + specimen.UUID, true, false},
+               // new code path (lib/controller/router etc) - single-cluster request
                {"/arvados/v1/collections/z1111-4zz18-0123456789abcde", false, true},
                {"/arvados/v1/collections/z1111-4zz18-0123456789abcde", true, true},
+               // new code path (lib/controller/router etc) - federated request
+               {"/arvados/v1/collections/z2222-4zz18-0123456789abcde", false, true},
+               {"/arvados/v1/collections/z2222-4zz18-0123456789abcde", true, true},
+               // old code path (proxyRailsAPI) - single-cluster request
                {"/arvados/v1/specimens/z1111-j58dm-0123456789abcde", false, true},
                {"/arvados/v1/specimens/z1111-j58dm-0123456789abcde", true, true},
+               // old code path (setupProxyRemoteCluster) - federated request
+               {"/arvados/v1/workflows/z2222-7fd4e-0123456789abcde", false, true},
+               {"/arvados/v1/workflows/z2222-7fd4e-0123456789abcde", true, true},
        }
 
        for _, tt := range tests {
@@ -533,24 +541,18 @@ func (s *IntegrationSuite) TestRequestIDHeader(c *check.C) {
                } else {
                        c.Check(resp.StatusCode, check.Equals, http.StatusOK)
                }
-               if !tt.reqIdProvided {
-                       c.Check(resp.Header.Get("X-Request-Id"), check.Matches, "^req-[0-9a-zA-Z]{20}$")
-                       if tt.notFoundRequest {
-                               var jresp httpserver.ErrorResponse
-                               err := json.NewDecoder(resp.Body).Decode(&jresp)
-                               c.Check(err, check.IsNil)
-                               c.Assert(jresp.Errors, check.HasLen, 1)
-                               c.Check(jresp.Errors[0], check.Matches, "^.*(req-[0-9a-zA-Z]{20}).*$")
-                       }
+               respHdr := resp.Header.Get("X-Request-Id")
+               if tt.reqIdProvided {
+                       c.Check(respHdr, check.Equals, customReqId)
                } else {
-                       c.Check(resp.Header.Get("X-Request-Id"), check.Equals, customReqId)
-                       if tt.notFoundRequest {
-                               var jresp httpserver.ErrorResponse
-                               err := json.NewDecoder(resp.Body).Decode(&jresp)
-                               c.Check(err, check.IsNil)
-                               c.Assert(jresp.Errors, check.HasLen, 1)
-                               c.Check(jresp.Errors[0], check.Matches, "^.*("+customReqId+").*$")
-                       }
+                       c.Check(respHdr, check.Matches, `req-[0-9a-zA-Z]{20}`)
+               }
+               if tt.notFoundRequest {
+                       var jresp httpserver.ErrorResponse
+                       err := json.NewDecoder(resp.Body).Decode(&jresp)
+                       c.Check(err, check.IsNil)
+                       c.Assert(jresp.Errors, check.HasLen, 1)
+                       c.Check(jresp.Errors[0], check.Matches, `.*\(`+respHdr+`\).*`)
                }
        }
 }
@@ -668,19 +670,17 @@ func (s *IntegrationSuite) TestFederatedApiClientAuthHandling(c *check.C) {
        conn1 := s.testClusters["z1111"].Conn()
 
        // Make sure LoginCluster is properly configured
-       for cls := range s.testClusters {
-               if cls == "z1111" || cls == "z3333" {
-                       c.Check(
-                               s.testClusters[cls].Config.Clusters[cls].Login.LoginCluster,
-                               check.Equals, "z1111",
-                               check.Commentf("incorrect LoginCluster config on cluster %q", cls))
-               }
+       for _, cls := range []string{"z1111", "z3333"} {
+               c.Check(
+                       s.testClusters[cls].Config.Clusters[cls].Login.LoginCluster,
+                       check.Equals, "z1111",
+                       check.Commentf("incorrect LoginCluster config on cluster %q", cls))
        }
        // Get user's UUID & attempt to create a token for it on the remote cluster
        _, _, _, user := s.testClusters["z1111"].UserClients(rootctx1, c, conn1,
                "user@example.com", true)
        _, rootclnt3, _ := s.testClusters["z3333"].ClientsWithToken(rootclnt1.AuthToken)
-       var resp interface{}
+       var resp arvados.APIClientAuthorization
        err := rootclnt3.RequestAndDecode(
                &resp, "POST", "arvados/v1/api_client_authorizations", nil,
                map[string]interface{}{
@@ -690,6 +690,29 @@ func (s *IntegrationSuite) TestFederatedApiClientAuthHandling(c *check.C) {
                },
        )
        c.Assert(err, check.IsNil)
+       c.Assert(resp.APIClientID, check.Not(check.Equals), 0)
+       newTok := resp.TokenV2()
+       c.Assert(newTok, check.Not(check.Equals), "")
+
+       // Confirm the token is from z1111
+       c.Assert(strings.HasPrefix(newTok, "v2/z1111-gj3su-"), check.Equals, true)
+
+       // Confirm the token works and is from the correct user
+       _, rootclnt3bis, _ := s.testClusters["z3333"].ClientsWithToken(newTok)
+       var curUser arvados.User
+       err = rootclnt3bis.RequestAndDecode(
+               &curUser, "GET", "arvados/v1/users/current", nil, nil,
+       )
+       c.Assert(err, check.IsNil)
+       c.Assert(curUser.UUID, check.Equals, user.UUID)
+
+       // Request the ApiClientAuthorization list using the new token
+       _, userClient, _ := s.testClusters["z3333"].ClientsWithToken(newTok)
+       var acaLst arvados.APIClientAuthorizationList
+       err = userClient.RequestAndDecode(
+               &acaLst, "GET", "arvados/v1/api_client_authorizations", nil, nil,
+       )
+       c.Assert(err, check.IsNil)
 }
 
 // Test for bug #18076
@@ -700,13 +723,11 @@ func (s *IntegrationSuite) TestStaleCachedUserRecord(c *check.C) {
        conn3 := s.testClusters["z3333"].Conn()
 
        // Make sure LoginCluster is properly configured
-       for cls := range s.testClusters {
-               if cls == "z1111" || cls == "z3333" {
-                       c.Check(
-                               s.testClusters[cls].Config.Clusters[cls].Login.LoginCluster,
-                               check.Equals, "z1111",
-                               check.Commentf("incorrect LoginCluster config on cluster %q", cls))
-               }
+       for _, cls := range []string{"z1111", "z3333"} {
+               c.Check(
+                       s.testClusters[cls].Config.Clusters[cls].Login.LoginCluster,
+                       check.Equals, "z1111",
+                       check.Commentf("incorrect LoginCluster config on cluster %q", cls))
        }
 
        for testCaseNr, testCase := range []struct {