X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/9992a8816837bd03a1beecd0c0e8082bd913319a..267d3c40bf1c5503e6487db2ab1f6a4339ac5f83:/lib/controller/handler.go

diff --git a/lib/controller/handler.go b/lib/controller/handler.go
index 2dd1d816e0..a35d003019 100644
--- a/lib/controller/handler.go
+++ b/lib/controller/handler.go
@@ -14,7 +14,9 @@ import (
 	"sync"
 	"time"
 
+	"git.arvados.org/arvados.git/lib/controller/api"
 	"git.arvados.org/arvados.git/lib/controller/federation"
+	"git.arvados.org/arvados.git/lib/controller/localdb"
 	"git.arvados.org/arvados.git/lib/controller/railsproxy"
 	"git.arvados.org/arvados.git/lib/controller/router"
 	"git.arvados.org/arvados.git/lib/ctrlctx"
@@ -23,6 +25,8 @@ import (
 	"git.arvados.org/arvados.git/sdk/go/health"
 	"git.arvados.org/arvados.git/sdk/go/httpserver"
 	"github.com/jmoiron/sqlx"
+
+	// sqlx needs lib/pq to talk to PostgreSQL
 	_ "github.com/lib/pq"
 )
 
@@ -87,22 +91,29 @@ func (h *Handler) setup() {
 		Routes: health.Routes{"ping": func() error { _, err := h.db(context.TODO()); return err }},
 	})
 
-	rtr := router.New(federation.New(h.Cluster), ctrlctx.WrapCallsInTransactions(h.db))
+	oidcAuthorizer := localdb.OIDCAccessTokenAuthorizer(h.Cluster, h.db)
+	rtr := router.New(federation.New(h.Cluster), router.Config{
+		MaxRequestSize: h.Cluster.API.MaxRequestSize,
+		WrapCalls:      api.ComposeWrappers(ctrlctx.WrapCallsInTransactions(h.db), oidcAuthorizer.WrapCalls),
+	})
 	mux.Handle("/arvados/v1/config", rtr)
-	mux.Handle("/"+arvados.EndpointUserAuthenticate.Path, rtr)
-
-	if !h.Cluster.ForceLegacyAPI14 {
-		mux.Handle("/arvados/v1/collections", rtr)
-		mux.Handle("/arvados/v1/collections/", rtr)
-		mux.Handle("/arvados/v1/users", rtr)
-		mux.Handle("/arvados/v1/users/", rtr)
-		mux.Handle("/login", rtr)
-		mux.Handle("/logout", rtr)
-	}
+	mux.Handle("/"+arvados.EndpointUserAuthenticate.Path, rtr) // must come before .../users/
+	mux.Handle("/arvados/v1/collections", rtr)
+	mux.Handle("/arvados/v1/collections/", rtr)
+	mux.Handle("/arvados/v1/users", rtr)
+	mux.Handle("/arvados/v1/users/", rtr)
+	mux.Handle("/arvados/v1/connect/", rtr)
+	mux.Handle("/arvados/v1/container_requests", rtr)
+	mux.Handle("/arvados/v1/container_requests/", rtr)
+	mux.Handle("/arvados/v1/groups", rtr)
+	mux.Handle("/arvados/v1/groups/", rtr)
+	mux.Handle("/login", rtr)
+	mux.Handle("/logout", rtr)
 
 	hs := http.NotFoundHandler()
 	hs = prepend(hs, h.proxyRailsAPI)
 	hs = h.setupProxyRemoteCluster(hs)
+	hs = prepend(hs, oidcAuthorizer.Middleware)
 	mux.Handle("/", hs)
 	h.handlerStack = mux