X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/2e0648fb2b8a006664e6225826d78916f682eff5..HEAD:/lib/controller/federation.go

diff --git a/lib/controller/federation.go b/lib/controller/federation.go
index aceaba8087..432e3c7478 100644
--- a/lib/controller/federation.go
+++ b/lib/controller/federation.go
@@ -94,20 +94,12 @@ func (h *Handler) setupProxyRemoteCluster(next http.Handler) http.Handler {
 
 	wfHandler := &genericFederatedRequestHandler{next, h, wfRe, nil}
 	containersHandler := &genericFederatedRequestHandler{next, h, containersRe, nil}
-	containerRequestsHandler := &genericFederatedRequestHandler{next, h, containerRequestsRe,
-		[]federatedRequestDelegate{remoteContainerRequestCreate}}
-	collectionsRequestsHandler := &genericFederatedRequestHandler{next, h, collectionsRe,
-		[]federatedRequestDelegate{fetchRemoteCollectionByUUID, fetchRemoteCollectionByPDH}}
 	linksRequestsHandler := &genericFederatedRequestHandler{next, h, linksRe, nil}
 
 	mux.Handle("/arvados/v1/workflows", wfHandler)
 	mux.Handle("/arvados/v1/workflows/", wfHandler)
 	mux.Handle("/arvados/v1/containers", containersHandler)
 	mux.Handle("/arvados/v1/containers/", containersHandler)
-	mux.Handle("/arvados/v1/container_requests", containerRequestsHandler)
-	mux.Handle("/arvados/v1/container_requests/", containerRequestsHandler)
-	mux.Handle("/arvados/v1/collections", collectionsRequestsHandler)
-	mux.Handle("/arvados/v1/collections/", collectionsRequestsHandler)
 	mux.Handle("/arvados/v1/links", linksRequestsHandler)
 	mux.Handle("/arvados/v1/links/", linksRequestsHandler)
 	mux.Handle("/", next)
@@ -129,8 +121,6 @@ func (h *Handler) setupProxyRemoteCluster(next http.Handler) http.Handler {
 
 		mux.ServeHTTP(w, req)
 	})
-
-	return mux
 }
 
 type CurrentUser struct {
@@ -152,7 +142,7 @@ type CurrentUser struct {
 // non-nil, true, nil -- if the token is valid
 func (h *Handler) validateAPItoken(req *http.Request, token string) (*CurrentUser, bool, error) {
 	user := CurrentUser{Authorization: arvados.APIClientAuthorization{APIToken: token}}
-	db, err := h.db(req.Context())
+	db, err := h.dbConnector.GetDB(req.Context())
 	if err != nil {
 		ctxlog.FromContext(req.Context()).WithError(err).Debugf("validateAPItoken(%s): database error", token)
 		return nil, false, err
@@ -189,7 +179,7 @@ func (h *Handler) validateAPItoken(req *http.Request, token string) (*CurrentUse
 }
 
 func (h *Handler) createAPItoken(req *http.Request, userUUID string, scopes []string) (*arvados.APIClientAuthorization, error) {
-	db, err := h.db(req.Context())
+	db, err := h.dbConnector.GetDB(req.Context())
 	if err != nil {
 		return nil, err
 	}
@@ -213,10 +203,10 @@ func (h *Handler) createAPItoken(req *http.Request, userUUID string, scopes []st
 		`INSERT INTO api_client_authorizations
 (uuid, api_token, expires_at, scopes,
 user_id,
-api_client_id, created_at, updated_at)
+created_at, updated_at)
 VALUES ($1, $2, CURRENT_TIMESTAMP AT TIME ZONE 'UTC' + INTERVAL '2 weeks', $3,
 (SELECT id FROM users WHERE users.uuid=$4 LIMIT 1),
-0, CURRENT_TIMESTAMP AT TIME ZONE 'UTC', CURRENT_TIMESTAMP AT TIME ZONE 'UTC')`,
+CURRENT_TIMESTAMP AT TIME ZONE 'UTC', CURRENT_TIMESTAMP AT TIME ZONE 'UTC')`,
 		uuid, token, string(scopesjson), userUUID)
 
 	if err != nil {
@@ -224,10 +214,9 @@ VALUES ($1, $2, CURRENT_TIMESTAMP AT TIME ZONE 'UTC' + INTERVAL '2 weeks', $3,
 	}
 
 	return &arvados.APIClientAuthorization{
-		UUID:      uuid,
-		APIToken:  token,
-		ExpiresAt: "",
-		Scopes:    scopes}, nil
+		UUID:     uuid,
+		APIToken: token,
+		Scopes:   scopes}, nil
 }
 
 // Extract the auth token supplied in req, and replace it with a
@@ -263,17 +252,20 @@ func (h *Handler) saltAuthToken(req *http.Request, remote string) (updatedReq *h
 		return updatedReq, nil
 	}
 
+	ctxlog.FromContext(req.Context()).Debugf("saltAuthToken: cluster %s token %s remote %s", h.Cluster.ClusterID, creds.Tokens[0], remote)
 	token, err := auth.SaltToken(creds.Tokens[0], remote)
 
-	if err == auth.ErrObsoleteToken {
-		// If the token exists in our own database, salt it
-		// for the remote. Otherwise, assume it was issued by
-		// the remote, and pass it through unmodified.
+	if err == auth.ErrObsoleteToken || err == auth.ErrTokenFormat {
+		// If the token exists in our own database for our own
+		// user, salt it for the remote. Otherwise, assume it
+		// was issued by the remote, and pass it through
+		// unmodified.
 		currentUser, ok, err := h.validateAPItoken(req, creds.Tokens[0])
 		if err != nil {
 			return nil, err
-		} else if !ok {
-			// Not ours; pass through unmodified.
+		} else if !ok || strings.HasPrefix(currentUser.UUID, remote) {
+			// Unknown, or cached + belongs to remote;
+			// pass through unmodified.
 			token = creds.Tokens[0]
 		} else {
 			// Found; make V2 version and salt it.