X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/12495b9c8e1cbde47d0a96c021d96141c51f10d8..641912ed2366dcd87c659fb73d8139e02cc6d05f:/lib/controller/federation.go?ds=inline

diff --git a/lib/controller/federation.go b/lib/controller/federation.go
index e08a1c1674..aceaba8087 100644
--- a/lib/controller/federation.go
+++ b/lib/controller/federation.go
@@ -11,13 +11,15 @@ import (
 	"fmt"
 	"io"
 	"io/ioutil"
+	"mime"
 	"net/http"
 	"net/url"
 	"regexp"
 	"strings"
 
-	"git.curoverse.com/arvados.git/sdk/go/arvados"
-	"git.curoverse.com/arvados.git/sdk/go/auth"
+	"git.arvados.org/arvados.git/sdk/go/arvados"
+	"git.arvados.org/arvados.git/sdk/go/auth"
+	"git.arvados.org/arvados.git/sdk/go/ctxlog"
 	"github.com/jmcvetta/randutil"
 )
 
@@ -25,8 +27,9 @@ var pathPattern = `^/arvados/v1/%s(/([0-9a-z]{5})-%s-[0-9a-z]{15})?(.*)$`
 var wfRe = regexp.MustCompile(fmt.Sprintf(pathPattern, "workflows", "7fd4e"))
 var containersRe = regexp.MustCompile(fmt.Sprintf(pathPattern, "containers", "dz642"))
 var containerRequestsRe = regexp.MustCompile(fmt.Sprintf(pathPattern, "container_requests", "xvhdp"))
-var collectionRe = regexp.MustCompile(fmt.Sprintf(pathPattern, "collections", "4zz18"))
-var collectionByPDHRe = regexp.MustCompile(`^/arvados/v1/collections/([0-9a-fA-F]{32}\+[0-9]+)+$`)
+var collectionsRe = regexp.MustCompile(fmt.Sprintf(pathPattern, "collections", "4zz18"))
+var collectionsByPDHRe = regexp.MustCompile(`^/arvados/v1/collections/([0-9a-fA-F]{32}\+[0-9]+)+$`)
+var linksRe = regexp.MustCompile(fmt.Sprintf(pathPattern, "links", "o0j2j"))
 
 func (h *Handler) remoteClusterRequest(remoteID string, req *http.Request) (*http.Response, error) {
 	remote, ok := h.Cluster.RemoteClusters[remoteID]
@@ -60,7 +63,11 @@ func (h *Handler) remoteClusterRequest(remoteID string, req *http.Request) (*htt
 // downstream proxy steps.
 func loadParamsFromForm(req *http.Request) error {
 	var postBody *bytes.Buffer
-	if req.Body != nil && req.Header.Get("Content-Type") == "application/x-www-form-urlencoded" {
+	if ct := req.Header.Get("Content-Type"); ct == "" {
+		// Assume application/octet-stream, i.e., no form to parse.
+	} else if ct, _, err := mime.ParseMediaType(ct); err != nil {
+		return err
+	} else if ct == "application/x-www-form-urlencoded" && req.Body != nil {
 		var cl int64
 		if req.ContentLength > 0 {
 			cl = req.ContentLength
@@ -89,6 +96,9 @@ func (h *Handler) setupProxyRemoteCluster(next http.Handler) http.Handler {
 	containersHandler := &genericFederatedRequestHandler{next, h, containersRe, nil}
 	containerRequestsHandler := &genericFederatedRequestHandler{next, h, containerRequestsRe,
 		[]federatedRequestDelegate{remoteContainerRequestCreate}}
+	collectionsRequestsHandler := &genericFederatedRequestHandler{next, h, collectionsRe,
+		[]federatedRequestDelegate{fetchRemoteCollectionByUUID, fetchRemoteCollectionByPDH}}
+	linksRequestsHandler := &genericFederatedRequestHandler{next, h, linksRe, nil}
 
 	mux.Handle("/arvados/v1/workflows", wfHandler)
 	mux.Handle("/arvados/v1/workflows/", wfHandler)
@@ -96,8 +106,10 @@ func (h *Handler) setupProxyRemoteCluster(next http.Handler) http.Handler {
 	mux.Handle("/arvados/v1/containers/", containersHandler)
 	mux.Handle("/arvados/v1/container_requests", containerRequestsHandler)
 	mux.Handle("/arvados/v1/container_requests/", containerRequestsHandler)
-	mux.Handle("/arvados/v1/collections", next)
-	mux.Handle("/arvados/v1/collections/", &collectionFederatedRequestHandler{next, h})
+	mux.Handle("/arvados/v1/collections", collectionsRequestsHandler)
+	mux.Handle("/arvados/v1/collections/", collectionsRequestsHandler)
+	mux.Handle("/arvados/v1/links", linksRequestsHandler)
+	mux.Handle("/arvados/v1/links/", linksRequestsHandler)
 	mux.Handle("/", next)
 
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
@@ -130,11 +142,20 @@ type CurrentUser struct {
 // checks it again api_client_authorizations table in the database,
 // and fills in the token scope and user UUID.  Does not handle remote
 // tokens unless they are already in the database and not expired.
-func (h *Handler) validateAPItoken(req *http.Request, token string) (*CurrentUser, error) {
+//
+// Return values are:
+//
+// nil, false, non-nil -- if there was an internal error
+//
+// nil, false, nil -- if the token is invalid
+//
+// non-nil, true, nil -- if the token is valid
+func (h *Handler) validateAPItoken(req *http.Request, token string) (*CurrentUser, bool, error) {
 	user := CurrentUser{Authorization: arvados.APIClientAuthorization{APIToken: token}}
-	db, err := h.db(req)
+	db, err := h.db(req.Context())
 	if err != nil {
-		return nil, err
+		ctxlog.FromContext(req.Context()).WithError(err).Debugf("validateAPItoken(%s): database error", token)
+		return nil, false, err
 	}
 
 	var uuid string
@@ -145,22 +166,30 @@ func (h *Handler) validateAPItoken(req *http.Request, token string) (*CurrentUse
 	}
 	user.Authorization.APIToken = token
 	var scopes string
-	err = db.QueryRowContext(req.Context(), `SELECT api_client_authorizations.uuid, api_client_authorizations.scopes, users.uuid FROM api_client_authorizations JOIN users on api_client_authorizations.user_id=users.id WHERE api_token=$1 AND (expires_at IS NULL OR expires_at > current_timestamp) LIMIT 1`, token).Scan(&user.Authorization.UUID, &scopes, &user.UUID)
-	if err != nil {
-		return nil, err
+	err = db.QueryRowContext(req.Context(), `SELECT api_client_authorizations.uuid, api_client_authorizations.scopes, users.uuid FROM api_client_authorizations JOIN users on api_client_authorizations.user_id=users.id WHERE api_token=$1 AND (expires_at IS NULL OR expires_at > current_timestamp AT TIME ZONE 'UTC') LIMIT 1`, token).Scan(&user.Authorization.UUID, &scopes, &user.UUID)
+	if err == sql.ErrNoRows {
+		ctxlog.FromContext(req.Context()).Debugf("validateAPItoken(%s): not found in database", token)
+		return nil, false, nil
+	} else if err != nil {
+		ctxlog.FromContext(req.Context()).WithError(err).Debugf("validateAPItoken(%s): database error", token)
+		return nil, false, err
 	}
 	if uuid != "" && user.Authorization.UUID != uuid {
-		return nil, fmt.Errorf("UUID embedded in v2 token did not match record")
+		// secret part matches, but UUID doesn't -- somewhat surprising
+		ctxlog.FromContext(req.Context()).Debugf("validateAPItoken(%s): secret part found, but with different UUID: %s", token, user.Authorization.UUID)
+		return nil, false, nil
 	}
 	err = json.Unmarshal([]byte(scopes), &user.Authorization.Scopes)
 	if err != nil {
-		return nil, err
+		ctxlog.FromContext(req.Context()).WithError(err).Debugf("validateAPItoken(%s): error parsing scopes from db", token)
+		return nil, false, err
 	}
-	return &user, nil
+	ctxlog.FromContext(req.Context()).Debugf("validateAPItoken(%s): ok", token)
+	return &user, true, nil
 }
 
 func (h *Handler) createAPItoken(req *http.Request, userUUID string, scopes []string) (*arvados.APIClientAuthorization, error) {
-	db, err := h.db(req)
+	db, err := h.db(req.Context())
 	if err != nil {
 		return nil, err
 	}
@@ -185,9 +214,9 @@ func (h *Handler) createAPItoken(req *http.Request, userUUID string, scopes []st
 (uuid, api_token, expires_at, scopes,
 user_id,
 api_client_id, created_at, updated_at)
-VALUES ($1, $2, CURRENT_TIMESTAMP + INTERVAL '2 weeks', $3,
+VALUES ($1, $2, CURRENT_TIMESTAMP AT TIME ZONE 'UTC' + INTERVAL '2 weeks', $3,
 (SELECT id FROM users WHERE users.uuid=$4 LIMIT 1),
-0, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`,
+0, CURRENT_TIMESTAMP AT TIME ZONE 'UTC', CURRENT_TIMESTAMP AT TIME ZONE 'UTC')`,
 		uuid, token, string(scopesjson), userUUID)
 
 	if err != nil {
@@ -240,12 +269,12 @@ func (h *Handler) saltAuthToken(req *http.Request, remote string) (updatedReq *h
 		// If the token exists in our own database, salt it
 		// for the remote. Otherwise, assume it was issued by
 		// the remote, and pass it through unmodified.
-		currentUser, err := h.validateAPItoken(req, creds.Tokens[0])
-		if err == sql.ErrNoRows {
+		currentUser, ok, err := h.validateAPItoken(req, creds.Tokens[0])
+		if err != nil {
+			return nil, err
+		} else if !ok {
 			// Not ours; pass through unmodified.
 			token = creds.Tokens[0]
-		} else if err != nil {
-			return nil, err
 		} else {
 			// Found; make V2 version and salt it.
 			token, err = auth.SaltToken(currentUser.Authorization.TokenV2(), remote)
@@ -264,7 +293,7 @@ func (h *Handler) saltAuthToken(req *http.Request, remote string) (updatedReq *h
 	}
 	updatedReq.Header.Set("Authorization", "Bearer "+token)
 
-	// Remove api_token=... from the the query string, in case we
+	// Remove api_token=... from the query string, in case we
 	// end up forwarding the request.
 	if values, err := url.ParseQuery(updatedReq.URL.RawQuery); err != nil {
 		return nil, err