14260: Don't set auth_uuid when runtime_token is set.

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <pamstutz@veritasgenetics.com>

diff --git a/services/api/app/controllers/arvados/v1/containers_controller.rb b/services/api/app/controllers/arvados/v1/containers_controller.rb
index 65d8385ad5f5b47619f1e158e674564333e09433..e9ec4123cd6ec25e78b105470fb6d3ca78e43f7a 100644 (file)
--- a/services/api/app/controllers/arvados/v1/containers_controller.rb
+++ b/services/api/app/controllers/arvados/v1/containers_controller.rb
@@ -17,7 +17,14 @@ class Arvados::V1::ContainersController < ApplicationController
     if @object.locked_by_uuid != Thread.current[:api_client_authorization].uuid
       raise ArvadosModel::PermissionDeniedError.new("Not locked by your token")
     end
-    @object = @object.auth
+    if @object.runtime_token.nil?
+      @object = @object.auth
+    else
+      @object = ApiClientAuthorization.validate(token: @object.runtime_token)
+      if @object.nil?
+        raise ArvadosModel::PermissionDeniedError.new("Invalid runtime_token")
+      end
+    end
     show
   end
 

diff --git a/services/api/app/models/container.rb b/services/api/app/models/container.rb
index 86201955aa6a4137f27835a65f5908e4765b5b63..21530888ba7f1fba277f809fa6b4834e22f858f4 100644 (file)
--- a/services/api/app/models/container.rb
+++ b/services/api/app/models/container.rb
@@ -540,7 +540,7 @@ class Container < ArvadosModel
 
   def assign_auth
     if self.auth_uuid_changed?
-      return errors.add :auth_uuid, 'is readonly'
+         return errors.add :auth_uuid, 'is readonly'
     end
     if not [Locked, Running].include? self.state
       # don't need one
@@ -553,6 +553,10 @@ class Container < ArvadosModel
     end
     if self.runtime_token.nil?
       if self.runtime_user_uuid.nil?
+        # legacy behavior, we don't have a runtime_user_uuid so get
+        # the user from the highest priority container request, needed
+        # when performing an upgrade and there are queued containers,
+        # and some tests.
         cr = ContainerRequest.
                where('container_uuid=? and priority>0', self.uuid).
                order('priority desc').
@@ -569,12 +573,6 @@ class Container < ArvadosModel
                     create!(user_id: User.find_by_uuid(self.runtime_user_uuid).id,
                             api_client_id: 0,
                             scopes: self.runtime_auth_scopes)
-    else
-      # using runtime_token
-      self.auth = ApiClientAuthorization.validate(token: self.runtime_token)
-      if self.auth.nil?
-        raise ArgumentError.new "Invalid runtime token"
-      end
     end
   end
 

diff --git a/services/api/test/unit/container_request_test.rb b/services/api/test/unit/container_request_test.rb
index 14fa5796d0de06366b00a2e4525f98216f6a567f..db81c08446dfca5255f330070c8fdb06c8f59c57 100644 (file)
--- a/services/api/test/unit/container_request_test.rb
+++ b/services/api/test/unit/container_request_test.rb
@@ -1082,7 +1082,8 @@ class ContainerRequestTest < ActiveSupport::TestCase
     cr.save!
     c = Container.find_by_uuid cr.container_uuid
     lock_and_run c
-    assert_equal c.auth_uuid, spec.uuid
+    assert_nil c.auth_uuid
+    assert_equal c.runtime_token, spec.token
 
     assert_not_nil ApiClientAuthorization.find_by_uuid(spec.uuid)