5824: Use ARVADOS_API_TOKEN=foo + -allow-anonymous instead of -anonymous-token=foo.

diff --git a/doc/install/install-keep-web.html.textile.liquid b/doc/install/install-keep-web.html.textile.liquid
index 823a600a209d0d1d967a03e2f1f5115bd8bf5e32..11a425d3476d5ae69ba74f0e81ab8dcd14d219fa 100644 (file)
--- a/doc/install/install-keep-web.html.textile.liquid
+++ b/doc/install/install-keep-web.html.textile.liquid
@@ -36,8 +36,8 @@ Verify that @keep-web@ is functional:
 <notextile>
 <pre><code>~$ <span class="userinput">keep-web -h</span>
 Usage of keep-web:
-  -anonymous-token value
-        API token to try when none of the tokens provided in an HTTP request succeed in reading the desired collection. If this flag is used more than once, each token will be attempted in turn until one works. (default [])
+  -allow-anonymous
+        Serve public data to anonymous clients. Try the token supplied in the ARVADOS_API_TOKEN environment variable when none of the tokens provided in an HTTP request succeed in reading the desired collection. (default false)
   -attachment-only-host string
         Accept credentials, and add "Content-Disposition: attachment" response headers, for requests at this hostname:port. Prohibiting inline display makes it possible to serve untrusted and non-public content from a single origin, i.e., without wildcard DNS or SSL.
   -listen string
@@ -58,11 +58,12 @@ We recommend running @keep-web@ under "runit":https://packages.debian.org/search
 
 <notextile>
 <pre><code>export ARVADOS_API_HOST=<span class="userinput">uuid_prefix</span>.your.domain
-exec sudo -u nobody keep-web -listen=<span class="userinput">:9002</span> -anonymous-token=<span class="userinput">hoShoomoo2bai3Ju1xahg6aeng1siquuaZ1yae2gi2Uhaeng2r</span> 2&gt;&amp;1
+export ARVADOS_API_TOKEN="<span class="userinput">hoShoomoo2bai3Ju1xahg6aeng1siquuaZ1yae2gi2Uhaeng2r</span>"
+exec sudo -u nobody keep-web -listen=<span class="userinput">:9002</span> -allow-anonymous 2&gt;&amp;1
 </code></pre>
 </notextile>
 
-Omit the @-anonymous-token@ arguments if you do not want to serve public data.
+Omit the @-allow-anonymous@ argument if you do not want to serve public data.
 
 Set @ARVADOS_API_HOST_INSECURE=1@ if your API server's SSL certificate is not signed by a recognized CA.
 

diff --git a/services/keep-web/anonymous.go b/services/keep-web/anonymous.go
index bfc716f2b2b865d9a12577bcca41812e7252f4e9..15a98c2f361ef62f2ddfd313da5d5402ea718c56 100644 (file)
--- a/services/keep-web/anonymous.go
+++ b/services/keep-web/anonymous.go
@@ -3,22 +3,33 @@ package main
 import (
        "flag"
        "fmt"
+       "os"
+       "strconv"
 )
 
 var anonymousTokens tokenSet
 
 type tokenSet []string
 
-func (ts *tokenSet) Set(t string) error {
-       *ts = append(*ts, t)
-       return nil
+func (ts *tokenSet) Set(s string) error {
+       v, err := strconv.ParseBool(s)
+       if v && len(*ts) == 0 {
+               *ts = append(*ts, os.Getenv("ARVADOS_API_TOKEN"))
+       } else if !v {
+               *ts = (*ts)[:0]
+       }
+       return err
 }
 
 func (ts *tokenSet) String() string {
-       return fmt.Sprintf("%+v", (*ts)[:])
+       return fmt.Sprintf("%v", len(*ts) > 0)
+}
+
+func (ts *tokenSet) IsBoolFlag() bool {
+       return true
 }
 
 func init() {
-       flag.Var(&anonymousTokens, "anonymous-token",
-               "API token to try when none of the tokens provided in an HTTP request succeed in reading the desired collection. Multiple anonymous tokens can be provided by using this flag more than once; each token will be attempted in turn until one works.")
+       flag.Var(&anonymousTokens, "allow-anonymous",
+               "Serve public data to anonymous clients. Try the token supplied in the ARVADOS_API_TOKEN environment variable when none of the tokens provided in an HTTP request succeed in reading the desired collection.")
 }

diff --git a/services/keep-web/doc.go b/services/keep-web/doc.go
index 4c447332d3963946584213bd99e8395821369892..4207d7bfc7344cb72dfedbb176000bced1966077 100644 (file)
--- a/services/keep-web/doc.go
+++ b/services/keep-web/doc.go
@@ -48,10 +48,12 @@
 //
 // Anonymous downloads
 //
-// Use the -anonymous-token option to specify a token to use when clients
-// try to retrieve files without providing their own Arvados API token.
+// Use the -allow-anonymous flag with an ARVADOS_API_TOKEN environment
+// variable to specify a token to use when clients try to retrieve
+// files without providing their own Arvados API token.
 //
-//   keep-web [...] -anonymous-token=zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
+//   export ARVADOS_API_TOKEN=zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
+//   keep-web [...] -allow-anonymous
 //
 // See http://doc.arvados.org/install/install-keep-web.html for examples.
 //

diff --git a/services/keep-web/main.go b/services/keep-web/main.go
index 751543e8fa81a0af389a5dcfc2c744a3c66ea503..135f01b394720efba18dc8082744637bfaf3a7c1 100644 (file)
--- a/services/keep-web/main.go
+++ b/services/keep-web/main.go
@@ -12,7 +12,9 @@ func init() {
        // different token before doing anything with the client). We
        // set this dummy value during init so it doesn't clobber the
        // one used by "run test servers".
-       os.Setenv("ARVADOS_API_TOKEN", "xxx")
+       if os.Getenv("ARVADOS_API_TOKEN") == "" {
+               os.Setenv("ARVADOS_API_TOKEN", "xxx")
+       }
 }
 
 func main() {