16349: Test token expiry using actual token validation func.

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@tomclegg.ca>

diff --git a/services/api/app/models/container.rb b/services/api/app/models/container.rb
index 376be55ffbf1a762ae81c2ed3fbbf76292b87883..912a801a6fb1820724489216f0ec38d99bd80210 100644 (file)
--- a/services/api/app/models/container.rb
+++ b/services/api/app/models/container.rb
@@ -570,8 +570,13 @@ class Container < ArvadosModel
          return errors.add :auth_uuid, 'is readonly'
     end
     if not [Locked, Running].include? self.state
-      # don't need one
-      self.auth.andand.update_attributes(expires_at: db_current_time)
+      # Don't need one. If auth already exists, expire it.
+      #
+      # We use db_transaction_time here (not db_current_time) to
+      # ensure the token doesn't validate later in the same
+      # transaction (e.g., in a test case) by satisfying expires_at >
+      # transaction timestamp.
+      self.auth.andand.update_attributes(expires_at: db_transaction_time)
       self.auth = nil
       return
     elsif self.auth

diff --git a/services/api/lib/db_current_time.rb b/services/api/lib/db_current_time.rb
index fdb66415210aed9b95338f6dafc6e377de45ec50..80516521b4524f79950522325c945b22220d3538 100644 (file)
--- a/services/api/lib/db_current_time.rb
+++ b/services/api/lib/db_current_time.rb
@@ -8,4 +8,8 @@ module DbCurrentTime
   def db_current_time
     Time.parse(ActiveRecord::Base.connection.select_value(CURRENT_TIME_SQL)).to_time
   end
+
+  def db_transaction_time
+    Time.parse(ActiveRecord::Base.connection.select_value('SELECT current_timestamp')).to_time
+  end
 end

diff --git a/services/api/test/unit/container_test.rb b/services/api/test/unit/container_test.rb
index 5f17efc4452c3ac24e5e53f9d532da1ce3b9d673..0bbbc17b0cc14fd07d8c4b072f18cbc8bded3e18 100644 (file)
--- a/services/api/test/unit/container_test.rb
+++ b/services/api/test/unit/container_test.rb
@@ -605,6 +605,10 @@ class ContainerTest < ActiveSupport::TestCase
   end
 
   test "Lock and unlock" do
+    # The "token is expired" check (at the end of this test case)
+    # requires a west-of-UTC time zone in order to be effective.
+    ActiveRecord::Base.connection.select_value("SET TIME ZONE '-4'")
+
     set_user_from_auth :active
     c, cr = minimal_new priority: 0
 
@@ -663,6 +667,8 @@ class ContainerTest < ActiveSupport::TestCase
 
     auth_exp = ApiClientAuthorization.find_by_uuid(auth_uuid_was).expires_at
     assert_operator auth_exp, :<, db_current_time
+
+    assert_nil ApiClientAuthorization.validate(token: ApiClientAuthorization.find_by_uuid(auth_uuid_was).token)
   end
 
   test "Exceed maximum lock-unlock cycles" do