X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/a4a1420766c6e2e84e61f1d5e8cbb319521af31e..75906f69902fd15c559df303aea7b54b4490f391:/lib/config/load.go

diff --git a/lib/config/load.go b/lib/config/load.go
index 888cc828af..8d498af170 100644
--- a/lib/config/load.go
+++ b/lib/config/load.go
@@ -6,6 +6,7 @@ package config
 
 import (
 	"bytes"
+	_ "embed"
 	"encoding/json"
 	"errors"
 	"flag"
@@ -23,6 +24,9 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
+//go:embed config.default.yml
+var DefaultYAML []byte
+
 var ErrNoClustersDefined = errors.New("config does not define any clusters")
 
 type Loader struct {
@@ -226,6 +230,9 @@ func (ldr *Loader) Load() (*arvados.Config, error) {
 	}
 	ldr.logExtraKeys(merged, src, "")
 	removeSampleKeys(merged)
+	// We merge the loaded config into the default, overriding any existing keys.
+	// Make sure we do not override a default with a key that has a 'null' value.
+	removeNullKeys(src)
 	err = mergo.Merge(&merged, src, mergo.WithOverride)
 	if err != nil {
 		return nil, fmt.Errorf("merging config data: %s", err)
@@ -292,9 +299,10 @@ func (ldr *Loader) Load() (*arvados.Config, error) {
 		for _, err = range []error{
 			ldr.checkClusterID(fmt.Sprintf("Clusters.%s", id), id, false),
 			ldr.checkClusterID(fmt.Sprintf("Clusters.%s.Login.LoginCluster", id), cc.Login.LoginCluster, true),
-			ldr.checkToken(fmt.Sprintf("Clusters.%s.ManagementToken", id), cc.ManagementToken),
-			ldr.checkToken(fmt.Sprintf("Clusters.%s.SystemRootToken", id), cc.SystemRootToken),
-			ldr.checkToken(fmt.Sprintf("Clusters.%s.Collections.BlobSigningKey", id), cc.Collections.BlobSigningKey),
+			ldr.checkToken(fmt.Sprintf("Clusters.%s.ManagementToken", id), cc.ManagementToken, true, false),
+			ldr.checkToken(fmt.Sprintf("Clusters.%s.SystemRootToken", id), cc.SystemRootToken, true, false),
+			ldr.checkToken(fmt.Sprintf("Clusters.%s.Users.AnonymousUserToken", id), cc.Users.AnonymousUserToken, false, true),
+			ldr.checkToken(fmt.Sprintf("Clusters.%s.Collections.BlobSigningKey", id), cc.Collections.BlobSigningKey, true, false),
 			checkKeyConflict(fmt.Sprintf("Clusters.%s.PostgreSQL.Connection", id), cc.PostgreSQL.Connection),
 			ldr.checkEnum("Containers.LocalKeepLogsToContainerLog", cc.Containers.LocalKeepLogsToContainerLog, "none", "all", "errors"),
 			ldr.checkEmptyKeepstores(cc),
@@ -308,6 +316,11 @@ func (ldr *Loader) Load() (*arvados.Config, error) {
 				return nil, err
 			}
 		}
+		if strings.Count(cc.Users.AnonymousUserToken, "/") == 3 {
+			// V2 token, strip it to just a secret
+			tmp := strings.Split(cc.Users.AnonymousUserToken, "/")
+			cc.Users.AnonymousUserToken = tmp[2]
+		}
 	}
 	return &cfg, nil
 }
@@ -326,13 +339,32 @@ func (ldr *Loader) checkClusterID(label, clusterID string, emptyStringOk bool) e
 var acceptableTokenRe = regexp.MustCompile(`^[a-zA-Z0-9]+$`)
 var acceptableTokenLength = 32
 
-func (ldr *Loader) checkToken(label, token string) error {
-	if token == "" {
-		if ldr.Logger != nil {
-			ldr.Logger.Warnf("%s: secret token is not set (use %d+ random characters from a-z, A-Z, 0-9)", label, acceptableTokenLength)
+func (ldr *Loader) checkToken(label, token string, mandatory bool, acceptV2 bool) error {
+	if len(token) == 0 {
+		if !mandatory {
+			// when a token is not mandatory, the acceptable length and content is only checked if its length is non-zero
+			return nil
+		} else {
+			if ldr.Logger != nil {
+				ldr.Logger.Warnf("%s: secret token is not set (use %d+ random characters from a-z, A-Z, 0-9)", label, acceptableTokenLength)
+			}
 		}
 	} else if !acceptableTokenRe.MatchString(token) {
-		return fmt.Errorf("%s: unacceptable characters in token (only a-z, A-Z, 0-9 are acceptable)", label)
+		if !acceptV2 {
+			return fmt.Errorf("%s: unacceptable characters in token (only a-z, A-Z, 0-9 are acceptable)", label)
+		}
+		// Test for a proper V2 token
+		tmp := strings.SplitN(token, "/", 3)
+		if len(tmp) != 3 {
+			return fmt.Errorf("%s: unacceptable characters in token (only a-z, A-Z, 0-9 are acceptable)", label)
+		}
+		if !strings.HasPrefix(token, "v2/") {
+			return fmt.Errorf("%s: unacceptable characters in token (only a-z, A-Z, 0-9 are acceptable)", label)
+		}
+		ldr.Logger.Warnf("%s: token is a full V2 token, should just be a secret (remove everything up to and including the last forward slash)", label)
+		if !acceptableTokenRe.MatchString(tmp[2]) {
+			return fmt.Errorf("%s: unacceptable characters in V2 token secret (only a-z, A-Z, 0-9 are acceptable)", label)
+		}
 	} else if len(token) < acceptableTokenLength {
 		if ldr.Logger != nil {
 			ldr.Logger.Warnf("%s: token is too short (should be at least %d characters)", label, acceptableTokenLength)
@@ -431,6 +463,17 @@ func checkKeyConflict(label string, m map[string]string) error {
 	return nil
 }
 
+func removeNullKeys(m map[string]interface{}) {
+	for k, v := range m {
+		if v == nil {
+			delete(m, k)
+		}
+		if v, _ := v.(map[string]interface{}); v != nil {
+			removeNullKeys(v)
+		}
+	}
+}
+
 func removeSampleKeys(m map[string]interface{}) {
 	delete(m, "SAMPLE")
 	for _, v := range m {