14260: Test container runtime_token

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <pamstutz@veritasgenetics.com>

diff --git a/services/api/app/controllers/arvados/v1/containers_controller.rb b/services/api/app/controllers/arvados/v1/containers_controller.rb
index e1a8a019aa094374a554e40be6b602c7a734c17c..393e004920b66c513ce358ab55171477a4a61a62 100644 (file)
--- a/services/api/app/controllers/arvados/v1/containers_controller.rb
+++ b/services/api/app/controllers/arvados/v1/containers_controller.rb
@@ -19,7 +19,7 @@ class Arvados::V1::ContainersController < ApplicationController
     end
     if @object.auth.nil?
       cr = ContainerRequest.
-             where('container_uuid=? and priority>0', self.uuid).
+             where('container_uuid=? and priority>0', @object.uuid).
              order('priority desc').
              first
       @object = ApiClientAuthorization.validate(token: cr.runtime_token)

diff --git a/services/api/app/models/container_request.rb b/services/api/app/models/container_request.rb
index ede1dca7bf804a3614874f114db7aeb7ffb4bf3b..f3fb220b0063a1290a15cd3585f997e3e60737ed 100644 (file)
--- a/services/api/app/models/container_request.rb
+++ b/services/api/app/models/container_request.rb
@@ -350,7 +350,7 @@ class ContainerRequest < ArvadosModel
         errors.add :runtime_token, "not a v2 token"
         return
       end
-      if ApiClientAuthorization.validate(token: cr.runtime_token).nil?
+      if ApiClientAuthorization.validate(token: runtime_token).nil?
         errors.add :runtime_token, "failed validation"
       end
     end

diff --git a/services/api/test/fixtures/api_client_authorizations.yml b/services/api/test/fixtures/api_client_authorizations.yml
index 2073d8b1bacccfaa0422643a34ddfe5ed0144461..9074c5ffc1d53c8e465d81f6ac415322c188ec07 100644 (file)
--- a/services/api/test/fixtures/api_client_authorizations.yml
+++ b/services/api/test/fixtures/api_client_authorizations.yml
@@ -341,3 +341,10 @@ foo_collection_sharing_token:
   - GET /arvados/v1/collections/zzzzz-4zz18-znfnqtbbv4spc3w
   - GET /arvados/v1/collections/zzzzz-4zz18-znfnqtbbv4spc3w/
   - GET /arvados/v1/keep_services/accessible
+
+container_runtime_token:
+  uuid: zzzzz-gj3su-2nj68s291f50gd9
+  api_client: untrusted
+  user: spectator
+  api_token: 2d19ue6ofx26o3mm7fs9u6t7hov9um0v92dzwk1o2xed3abprw
+  expires_at: 2038-01-01 00:00:00

diff --git a/services/api/test/fixtures/container_requests.yml b/services/api/test/fixtures/container_requests.yml
index 5d3531eead8fb5a90c7ef4b7ef750a937da6ee90..dea98887e9843866b182a7ca054aa60628223fd7 100644 (file)
--- a/services/api/test/fixtures/container_requests.yml
+++ b/services/api/test/fixtures/container_requests.yml
@@ -764,6 +764,26 @@ cr_in_trashed_project:
     vcpus: 1
     ram: 123
 
+runtime_token:
+  uuid: zzzzz-xvhdp-11eklkhy0n4dm86
+  owner_uuid: zzzzz-tpzed-xurymjxw79nv3jz
+  name: queued
+  state: Committed
+  priority: 1
+  created_at: <%= 2.minute.ago.to_s(:db) %>
+  updated_at: <%= 1.minute.ago.to_s(:db) %>
+  modified_at: <%= 1.minute.ago.to_s(:db) %>
+  modified_by_user_uuid: zzzzz-tpzed-xurymjxw79nv3jz
+  container_image: test
+  cwd: test
+  output_path: test
+  command: ["echo", "hello"]
+  container_uuid: zzzzz-dz642-20isqbkl8xwnsao
+  runtime_token: v2/zzzzz-gj3su-2nj68s291f50gd9/2d19ue6ofx26o3mm7fs9u6t7hov9um0v92dzwk1o2xed3abprw
+  runtime_constraints:
+    vcpus: 1
+    ram: 123
+
 
 # Test Helper trims the rest of the file
 

diff --git a/services/api/test/fixtures/containers.yml b/services/api/test/fixtures/containers.yml
index 757adcee1b979af4086d937cc928c1abb5042a1e..ce61c01eed054f7ccb53e284d9f5499f3b58e741 100644 (file)
--- a/services/api/test/fixtures/containers.yml
+++ b/services/api/test/fixtures/containers.yml
@@ -259,3 +259,25 @@ running_to_be_deleted:
   auth_uuid: zzzzz-gj3su-ty6lvu9d7u7c2sq
   secret_mounts: {}
   secret_mounts_md5: 99914b932bd37a50b983c5e7c90ae93b
+
+runtime_token:
+  uuid: zzzzz-dz642-20isqbkl8xwnsao
+  owner_uuid: zzzzz-tpzed-000000000000000
+  state: Queued
+  priority: 1
+  created_at: 2016-01-11 11:11:11.111111111 Z
+  updated_at: 2016-01-11 11:11:11.111111111 Z
+  container_image: test
+  cwd: test
+  output_path: test
+  command: ["echo", "hello"]
+  runtime_constraints:
+    ram: 12000000000
+    vcpus: 4
+  mounts:
+    /tmp:
+      kind: tmp
+      capacity: 24000000000
+    /var/spool/cwl:
+      kind: tmp
+      capacity: 24000000000

diff --git a/services/api/test/functional/arvados/v1/container_requests_controller_test.rb b/services/api/test/functional/arvados/v1/container_requests_controller_test.rb
index 282e09049e63beab2e591ac71f38b47e9484261d..a3252ad7b3fcdaa8fc78294bbb29b794a7107986 100644 (file)
--- a/services/api/test/functional/arvados/v1/container_requests_controller_test.rb
+++ b/services/api/test/functional/arvados/v1/container_requests_controller_test.rb
@@ -81,4 +81,21 @@ class Arvados::V1::ContainerRequestsControllerTest < ActionController::TestCase
     req.reload
     assert_equal 'bar', req.secret_mounts['/foo']['content']
   end
+
+  test "runtime_token not in #create responses" do
+    authorize_with :active
+
+    post :create, {
+           container_request: minimal_cr.merge(
+             runtime_token: api_client_authorizations(:spectator).token)
+         }
+    assert_response :success
+
+    resp = JSON.parse(@response.body)
+    refute resp.has_key?('runtime_token')
+
+    req = ContainerRequest.where(uuid: resp['uuid']).first
+    assert_equal api_client_authorizations(:spectator).token, req.runtime_token
+  end
+
 end

diff --git a/services/api/test/functional/arvados/v1/containers_controller_test.rb b/services/api/test/functional/arvados/v1/containers_controller_test.rb
index 8e2002c75919a68f27b64718e50279907339ce7d..8880967ba2e6a3eaa365c8cf21c7b2b834e202a2 100644 (file)
--- a/services/api/test/functional/arvados/v1/containers_controller_test.rb
+++ b/services/api/test/functional/arvados/v1/containers_controller_test.rb
@@ -151,4 +151,15 @@ class Arvados::V1::ContainersControllerTest < ActionController::TestCase
       end
     end
   end
+
+  test 'get runtime_token auth' do
+    authorize_with :dispatch1
+    c = containers(:runtime_token)
+    assert c.lock, show_errors(c)
+    get :auth, id: c.uuid
+    assert_response :success
+    assert_equal "v2/#{json_response['uuid']}/#{json_response['api_token']}", api_client_authorizations(:container_runtime_token).token
+    assert_equal 'arvados#apiClientAuthorization', json_response['kind']
+  end
+
 end

diff --git a/services/api/test/integration/remote_user_test.rb b/services/api/test/integration/remote_user_test.rb
index c812348a2ec279360f0d2ba7224199e75ead2739..84e8a94395ebb3222f85e7e963bb1b19103a03ba 100644 (file)
--- a/services/api/test/integration/remote_user_test.rb
+++ b/services/api/test/integration/remote_user_test.rb
@@ -251,23 +251,36 @@ class RemoteUsersTest < ActionDispatch::IntegrationTest
     assert_equal 'barney', json_response['username']
   end
 
-  test "validate unsalted token for remote cluster zbbbb" do
+  test "validate unsalted v2 token for remote cluster zbbbb" do
     auth = api_client_authorizations(:active)
     token = "v2/#{auth.uuid}/#{auth.api_token}"
     get '/arvados/v1/users/current', {format: 'json', remote: 'zbbbb'}, {
           "HTTP_AUTHORIZATION" => "Bearer #{token}"
         }
-    assert_response 200
+    assert_response :success
     assert_equal(users(:active).uuid, json_response['uuid'])
   end
 
-
-  # test 'container request with remote runtime_token' do
-  #   auth = api_client_authorizations(:active)
-  #   token = "v2/#{auth.uuid.sub('zzzzz-', 'zbbbb-')}/#{auth.api_token}"
-
-  #   post '/arvados/v1/container_requests', {"container_request": {}}, {"HTTP_AUTHORIZATION" => "Bearer #{token}"}
-  #   assert_response :success
-  # end
+  test 'container request with runtime_token' do
+    [["valid local", "v2/#{api_client_authorizations(:active).uuid}/#{api_client_authorizations(:active).api_token}"],
+     ["valid remote", "v2/zbbbb-gj3su-000000000000000/abc"],
+     ["invalid local", "v2/#{api_client_authorizations(:active).uuid}/fakefakefake"]
+    ].each do |label, runtime_token|
+      post '/arvados/v1/container_requests', {
+             "container_request" => {
+               "command" => ["echo"],
+               "container_image" => "xyz",
+               "output_path" => "/",
+               "cwd" => "/",
+               "runtime_token" => runtime_token
+             }
+           }, {"HTTP_AUTHORIZATION" => "Bearer #{api_client_authorizations(:active).api_token}"}
+      if label.include? "invalid"
+        assert_response 422
+      else
+        assert_response :success
+      end
+    end
+  end
 
 end

diff --git a/services/api/test/unit/container_request_test.rb b/services/api/test/unit/container_request_test.rb
index 81b49ff4fcce525b5e7fba88ff0c6f78087e7686..408df0dd89578c8ccd70b5d2bfaad9e2b99bae59 100644 (file)
--- a/services/api/test/unit/container_request_test.rb
+++ b/services/api/test/unit/container_request_test.rb
@@ -1074,4 +1074,22 @@ class ContainerRequestTest < ActiveSupport::TestCase
                                              secret_mounts: sm)
     assert_equal [:secret_mounts], cr.errors.messages.keys
   end
+
+  test "valid runtime_token" do
+    set_user_from_auth :active
+    spec = api_client_authorizations(:spectator)
+    cr = create_minimal_req!(state: "Committed", runtime_token: spec.token)
+    cr.save!
+    c = Container.find_by_uuid cr.container_uuid
+    assert_nil c.auth_uuid
+  end
+
+  test "invalid runtime_token" do
+    set_user_from_auth :active
+    spec = api_client_authorizations(:spectator)
+    assert_raises(ActiveRecord::RecordInvalid) do
+      cr = create_minimal_req!(state: "Committed", runtime_token: "#{spec.token}xx")
+      cr.save!
+    end
+  end
 end