Merge branch '15599-keepstore-iam-role'

closes #15599

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tclegg@veritasgenetics.com>

diff --git a/apps/workbench/Gemfile b/apps/workbench/Gemfile
index ce2a1377d72a3f9f6bbbc3cf92243921eff137cf..bc62407bc5173fa77b63daaa7f6f58882c29be33 100644 (file)
--- a/apps/workbench/Gemfile
+++ b/apps/workbench/Gemfile
@@ -90,9 +90,6 @@ gem 'sshkey'
 # Deploy with Capistrano
 # gem 'capistrano'
 
-# To use debugger
-#gem 'byebug'
-
 gem 'passenger', :group => :production
 gem 'andand'
 gem 'RedCloth'

diff --git a/apps/workbench/Gemfile.lock b/apps/workbench/Gemfile.lock
index 548da1dc049bf32a2abc886e2c451f2b5b1927ab..449f997b5337ec973c1e4c80417e88685ff190c3 100644 (file)
--- a/apps/workbench/Gemfile.lock
+++ b/apps/workbench/Gemfile.lock
@@ -53,12 +53,12 @@ GEM
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    addressable (2.6.0)
-      public_suffix (>= 2.0.2, < 4.0)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
     andand (1.3.3)
     angularjs-rails (1.3.15)
     arel (7.1.4)
-    arvados (1.3.1.20190320201707)
+    arvados (1.3.3.20190320201707)
       activesupport (>= 3)
       andand (~> 1.3, >= 1.3.3)
       arvados-google-api-client (>= 0.7, < 0.8.9)
@@ -127,7 +127,7 @@ GEM
     flamegraph (0.9.5)
     globalid (0.4.2)
       activesupport (>= 4.2.0)
-    googleauth (0.8.1)
+    googleauth (0.9.0)
       faraday (~> 0.12)
       jwt (>= 1.4, < 3.0)
       memoist (~> 0.16)
@@ -153,7 +153,7 @@ GEM
       actionpack (>= 4)
       less (~> 2.6.0)
       sprockets (>= 2)
-    libv8 (3.16.14.19)
+    libv8 (3.16.14.19-x86_64-linux)
     lograge (0.10.0)
       actionpack (>= 4)
       activesupport (>= 4)
@@ -179,7 +179,7 @@ GEM
     morrisjs-rails (0.5.1.2)
       railties (> 3.1, < 6)
     multi_json (1.13.1)
-    multipart-post (2.0.0)
+    multipart-post (2.1.1)
     net-scp (2.0.0)
       net-ssh (>= 2.6.5, < 6.0.0)
     net-sftp (2.1.2)
@@ -192,8 +192,8 @@ GEM
       mini_portile2 (~> 2.4.0)
     npm-rails (0.2.1)
       rails (>= 3.2)
-    oj (3.7.11)
-    os (1.0.0)
+    oj (3.7.12)
+    os (1.0.1)
     passenger (6.0.2)
       rack
       rake (>= 0.8.1)
@@ -206,7 +206,7 @@ GEM
       cliver (~> 0.3.1)
       multi_json (~> 1.0)
       websocket-driver (>= 0.2.0)
-    public_suffix (3.0.3)
+    public_suffix (4.0.1)
     rack (2.0.7)
     rack-mini-profiler (1.0.2)
       rack (>= 1.2.0)

diff --git a/doc/api/methods/containers.html.textile.liquid b/doc/api/methods/containers.html.textile.liquid
index d59c66edc3cbf5f492dbb0c4befac668e209c980..5ec95cee62ab18a7f8b69ac42382a4f42e7ac1cd 100644 (file)
--- a/doc/api/methods/containers.html.textile.liquid
+++ b/doc/api/methods/containers.html.textile.liquid
@@ -110,7 +110,9 @@ table(table table-bordered table-condensed).
 
 h3. delete
 
-Delete an existing Container.
+Delete a Container.
+
+This API requires admin privileges. In normal operation, it should not be used at all. API clients like Workbench might not work correctly when a container request references a container that has been deleted.
 
 Arguments:
 

diff --git a/sdk/cwl/tests/wf/runin-reqs-wf.cwl b/sdk/cwl/tests/wf/runin-reqs-wf.cwl
index e8bbc08d8a27ae12deee011d7e93d9dca24cc5fe..3cc52936eaa89781599920d43fe2130b322bd46b 100644 (file)
--- a/sdk/cwl/tests/wf/runin-reqs-wf.cwl
+++ b/sdk/cwl/tests/wf/runin-reqs-wf.cwl
@@ -34,7 +34,7 @@ steps:
     hints:
       - class: arv:RunInSingleContainer
       - class: ResourceRequirement
-        ramMin: $(inputs.count*32)
+        ramMin: $(96+inputs.count*32)
       - class: arv:APIRequirement
     scatter: count
     run:
@@ -58,4 +58,4 @@ steps:
                 type: int
               script: File
             outputs: []
-            arguments: [python, $(inputs.script), $(inputs.count * 32)]
+            arguments: [python, $(inputs.script), $(96+inputs.count * 32)]

diff --git a/sdk/cwl/tests/wf/runin-reqs-wf2.cwl b/sdk/cwl/tests/wf/runin-reqs-wf2.cwl
index 15cc8df6a229e351f0be880dbd7be69c8b78c152..7d06cb308cf6ba8c65d51882865e90b39acae6c4 100644 (file)
--- a/sdk/cwl/tests/wf/runin-reqs-wf2.cwl
+++ b/sdk/cwl/tests/wf/runin-reqs-wf2.cwl
@@ -44,7 +44,7 @@ steps:
       outputs: []
       hints:
         - class: ResourceRequirement
-          ramMin: $(inputs.count*32)
+          ramMin: $(96+inputs.count*32)
       steps:
         sleep1:
           in:
@@ -59,4 +59,4 @@ steps:
                 type: int
               script: File
             outputs: []
-            arguments: [python, $(inputs.script), $(inputs.count * 32)]
+            arguments: [python, $(inputs.script), $(96+inputs.count * 32)]

diff --git a/sdk/cwl/tests/wf/runin-reqs-wf3.cwl b/sdk/cwl/tests/wf/runin-reqs-wf3.cwl
index e07ff8deff08514669df5a5010d0027e5448a5ce..c13b7a0bc6aa7b1caebcae0db1426d17bc0625f6 100644 (file)
--- a/sdk/cwl/tests/wf/runin-reqs-wf3.cwl
+++ b/sdk/cwl/tests/wf/runin-reqs-wf3.cwl
@@ -50,10 +50,10 @@ steps:
             id: subtool
             hints:
               - class: ResourceRequirement
-                ramMin: $(inputs.count*32)
+                ramMin: $(96+inputs.count*32)
             inputs:
               count:
                 type: int
               script: File
             outputs: []
-            arguments: [python, $(inputs.script), $(inputs.count * 32)]
+            arguments: [python, $(inputs.script), $(96+inputs.count * 32)]

diff --git a/sdk/cwl/tests/wf/runin-reqs-wf4.cwl b/sdk/cwl/tests/wf/runin-reqs-wf4.cwl
index 05e73c8df5c6f5cbbf709bf6b9831c1420978622..9a26d01132cf07d6ae1cb11aff97a627807ddca5 100644 (file)
--- a/sdk/cwl/tests/wf/runin-reqs-wf4.cwl
+++ b/sdk/cwl/tests/wf/runin-reqs-wf4.cwl
@@ -53,10 +53,10 @@ steps:
             id: subtool
             hints:
               - class: ResourceRequirement
-                ramMin: 32
+                ramMin: 128
             inputs:
               count:
                 type: int
               script: File
             outputs: []
-            arguments: [python, $(inputs.script), "32"]
+            arguments: [python, $(inputs.script), "128"]

diff --git a/services/api/app/models/container.rb b/services/api/app/models/container.rb
index 8999b3e14e123b78f8ecfaaa2ea821d8fa6e3490..376be55ffbf1a762ae81c2ed3fbbf76292b87883 100644 (file)
--- a/services/api/app/models/container.rb
+++ b/services/api/app/models/container.rb
@@ -423,6 +423,10 @@ class Container < ArvadosModel
     current_user.andand.is_admin
   end
 
+  def permission_to_destroy
+    current_user.andand.is_admin
+  end
+
   def ensure_owner_uuid_is_permitted
     # validate_change ensures owner_uuid can't be changed at all --
     # except during create, which requires admin privileges. Checking

diff --git a/services/api/test/unit/container_test.rb b/services/api/test/unit/container_test.rb
index 88fd5feb6ad27c3c55dd5531c0a2566422239f41..5f17efc4452c3ac24e5e53f9d532da1ce3b9d673 100644 (file)
--- a/services/api/test/unit/container_test.rb
+++ b/services/api/test/unit/container_test.rb
@@ -980,6 +980,15 @@ class ContainerTest < ActiveSupport::TestCase
     end
   end
 
+  test "user cannot delete" do
+    set_user_from_auth :active
+    c, _ = minimal_new
+    assert_raises ArvadosModel::PermissionDeniedError do
+      c.destroy
+    end
+    assert Container.find_by_uuid(c.uuid)
+  end
+
   [
     {state: Container::Complete, exit_code: 0, output: '1f4b0bc7583c2a7f9102c395f4ffc5e3+45'},
     {state: Container::Cancelled},

diff --git a/services/login-sync/Gemfile.lock b/services/login-sync/Gemfile.lock
index 70b666af8460a6ca7731d590cf6e8bf77a4af31a..5f163e87c32188e04ac4a05573ad9d922f185a07 100644 (file)
--- a/services/login-sync/Gemfile.lock
+++ b/services/login-sync/Gemfile.lock
@@ -1,8 +1,9 @@
 PATH
   remote: .
   specs:
-    arvados-login-sync (1.4.0.20190729193732)
+    arvados-login-sync (1.4.1.20190930204434)
       arvados (~> 1.3.0, >= 1.3.0)
+      faraday (< 0.16)
 
 GEM
   remote: https://rubygems.org/
@@ -12,8 +13,8 @@ GEM
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    addressable (2.6.0)
-      public_suffix (>= 2.0.2, < 4.0)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
     andand (1.3.3)
     arvados (1.3.3.20190320201707)
       activesupport (>= 3)
@@ -41,7 +42,7 @@ GEM
     extlib (0.9.16)
     faraday (0.15.4)
       multipart-post (>= 1.2, < 3)
-    googleauth (0.8.1)
+    googleauth (0.9.0)
       faraday (~> 0.12)
       jwt (>= 1.4, < 3.0)
       memoist (~> 0.16)
@@ -62,7 +63,7 @@ GEM
     multi_json (1.13.1)
     multipart-post (2.1.1)
     os (1.0.1)
-    public_suffix (3.1.1)
+    public_suffix (4.0.1)
     rake (12.3.2)
     retriable (1.4.1)
     signet (0.11.0)

diff --git a/tools/arvbox/lib/arvbox/docker/service/composer/run-service b/tools/arvbox/lib/arvbox/docker/service/composer/run-service
index f0733e0c2b86ded24445a968670169ca80c953eb..4235bcd0c864761701d0f98febf9f80def47aabf 100755 (executable)
--- a/tools/arvbox/lib/arvbox/docker/service/composer/run-service
+++ b/tools/arvbox/lib/arvbox/docker/service/composer/run-service
@@ -10,7 +10,7 @@ set -ex -o pipefail
 
 cd /usr/src/composer
 
-npm -d install --prefix /usr/local --global yarn
+npm -d install --prefix /usr/local --global yarn@1.17.3
 
 yarn install
 

diff --git a/tools/arvbox/lib/arvbox/docker/service/workbench2/run-service b/tools/arvbox/lib/arvbox/docker/service/workbench2/run-service
index e9e1ca4f8c8b0901c1e3792f2eb50d25f74c8fc3..85c03399f79e1410582ec21a844558dcf4c2708c 100755 (executable)
--- a/tools/arvbox/lib/arvbox/docker/service/workbench2/run-service
+++ b/tools/arvbox/lib/arvbox/docker/service/workbench2/run-service
@@ -10,7 +10,7 @@ set -ex -o pipefail
 
 cd /usr/src/workbench2
 
-npm -d install --prefix /usr/local --global yarn
+npm -d install --prefix /usr/local --global yarn@1.17.3
 
 yarn install