[ARVADOS] updated: 5eb91e8f604121776c7c04cb5adbf7fe32d7f8d2
git at public.curoverse.com
git at public.curoverse.com
Mon Jun 23 15:17:15 EDT 2014
Summary of changes:
.../app/controllers/application_controller.rb | 148 ++++++++++-----------
.../app/controllers/collections_controller.rb | 2 +-
.../app/controllers/sessions_controller.rb | 4 +-
apps/workbench/test/integration/errors_test.rb | 19 +++
apps/workbench/test/integration/logins_test.rb | 15 +--
apps/workbench/test/integration_helper.rb | 14 +-
6 files changed, 109 insertions(+), 93 deletions(-)
create mode 100644 apps/workbench/test/integration/errors_test.rb
via 5eb91e8f604121776c7c04cb5adbf7fe32d7f8d2 (commit)
via f2756832f844d78d782ff35e46b650c5501b0c47 (commit)
via c73e7333d5b55808c68d4f9a39501869e7baf009 (commit)
via 07b681140d714b8df660ba247380e33208fa74cf (commit)
via 36dcc9443ab7a079e6bcb6f874a19c740e5b8441 (commit)
via cf2a30aa6449f7ed9ac6c455842a23af44fb1509 (commit)
via bdc88877d3b4df3e9196e112b7e0bdce2f731998 (commit)
from 6f51251bb17cee4d5ee4a92e00bc817e2c67f575 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
commit 5eb91e8f604121776c7c04cb5adbf7fe32d7f8d2
Merge: 6f51251 f275683
Author: radhika <radhika at curoverse.com>
Date: Mon Jun 23 15:17:01 2014 -0400
Merge branch 'master' into 2659-anonymous-group
Conflicts:
apps/workbench/app/controllers/application_controller.rb
diff --cc apps/workbench/app/controllers/application_controller.rb
index cd1277f,d0496cb..56fe9f2
--- a/apps/workbench/app/controllers/application_controller.rb
+++ b/apps/workbench/app/controllers/application_controller.rb
@@@ -8,9 -8,10 +8,11 @@@ class ApplicationController < ActionCon
ERROR_ACTIONS = [:render_error, :render_not_found]
around_filter :thread_clear
- around_filter :thread_with_mandatory_api_token, except: ERROR_ACTIONS
- around_filter :thread_with_optional_api_token
+ around_filter :set_thread_api_token
+ # Methods that don't require login should
+ # skip_around_filter :require_thread_api_token
+ around_filter :require_thread_api_token, except: ERROR_ACTIONS
+ around_filter :use_anonymous_token_if_necessary
before_filter :check_user_agreements, except: ERROR_ACTIONS
before_filter :check_user_notifications, except: ERROR_ACTIONS
before_filter :find_object_by_uuid, except: [:index, :choose] + ERROR_ACTIONS
@@@ -366,64 -371,51 +380,58 @@@
Rails.cache.delete_matched(/^request_#{Thread.current.object_id}_/)
end
- def thread_with_api_token(login_optional = false)
+ # Save the session API token in thread-local storage, and yield.
+ # This method also takes care of session setup if the request
+ # provides a valid api_token parameter.
+ # If a token is unavailable or expired, the block is still run, with
+ # a nil token.
+ def set_thread_api_token
+ # If an API token has already been found, pass it through.
+ if Thread.current[:arvados_api_token]
+ yield
+ return
+ end
+
begin
- try_redirect_to_login = true
- if params[:api_token]
- try_redirect_to_login = false
- Thread.current[:arvados_api_token] = params[:api_token]
- # Before copying the token into session[], do a simple API
- # call to verify its authenticity.
- if verify_api_token
- session[:arvados_api_token] = params[:api_token]
- u = User.current
- session[:user] = {
- uuid: u.uuid,
- email: u.email,
- first_name: u.first_name,
- last_name: u.last_name,
- is_active: u.is_active,
- is_admin: u.is_admin,
- prefs: u.prefs
- }
- if !request.format.json? and request.method.in? ['GET', 'HEAD']
- # Repeat this request with api_token in the (new) session
- # cookie instead of the query string. This prevents API
- # tokens from appearing in (and being inadvisedly copied
- # and pasted from) browser Location bars.
- redirect_to request.fullpath.sub(%r{([&\?]api_token=)[^&\?]*}, '')
- else
- yield
- end
- else
- @errors = ['Invalid API token']
- self.render_error status: 401
- end
- elsif session[:arvados_api_token]
- # In this case, the token must have already verified at some
- # point, but it might have been revoked since. We'll try
- # using it, and catch the exception if it doesn't work.
- try_redirect_to_login = false
- Thread.current[:arvados_api_token] = session[:arvados_api_token]
- begin
- yield
- rescue ArvadosApiClient::NotLoggedInException
- try_redirect_to_login = true
+ # If there's a valid api_token parameter, use it to set up the session.
+ if (Thread.current[:arvados_api_token] = params[:api_token]) and
+ verify_api_token
+ session[:arvados_api_token] = params[:api_token]
+ u = User.current
+ session[:user] = {
+ uuid: u.uuid,
+ email: u.email,
+ first_name: u.first_name,
+ last_name: u.last_name,
+ is_active: u.is_active,
+ is_admin: u.is_admin,
+ prefs: u.prefs
+ }
+ if !request.format.json? and request.method.in? ['GET', 'HEAD']
+ # Repeat this request with api_token in the (new) session
+ # cookie instead of the query string. This prevents API
+ # tokens from appearing in (and being inadvisedly copied
+ # and pasted from) browser Location bars.
+ redirect_to strip_token_from_path(request.fullpath)
+ return
end
- elsif Rails.configuration.anonymous_user_token
++ elsif Rails.configuration.anonymous_user_token && !session[:arvados_api_token]
+ check_anonymous_token
+ if Thread.current[:arvados_api_token]
+ try_redirect_to_login = false
- yield
+ end
+ else
+ logger.debug "No token received, session is #{session.inspect}"
end
- if try_redirect_to_login
- unless login_optional
- redirect_to_login
- else
- # login is optional for this route so go on to the regular controller
+
+ # With setup done, handle the request using the session token.
+ Thread.current[:arvados_api_token] = session[:arvados_api_token]
+ begin
+ yield
+ rescue ArvadosApiClient::NotLoggedInException
+ # If we got this error with a token, it must've expired.
+ # Retry the request without a token.
+ unless Thread.current[:arvados_api_token].nil?
Thread.current[:arvados_api_token] = nil
yield
end
-----------------------------------------------------------------------
hooks/post-receive
--
More information about the arvados-commits
mailing list