[ARVADOS] updated: 1.1.0-166-gbe02efe

[Git user]

Summary of changes:
 services/api/app/middlewares/arvados_api_token.rb | 26 +++++++++++++----------
 1 file changed, 15 insertions(+), 11 deletions(-)

       via  be02efee61062eb6487675351dc8c1446b7a7ce9 (commit)
       via  b81e83807ec568686a4dbb30d31a32cba5996e5f (commit)
      from  b30548921f19177256890ad58b90dbf66d8407ef (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.


commit be02efee61062eb6487675351dc8c1446b7a7ce9
Author: Tom Clegg <tclegg at veritasgenetics.com>
Date:   Thu Nov 23 13:52:46 2017 -0500

    12627: Use first reader_token as primary token, if no primary given.
    
    Workbench relies on this for anonymous access.
    
    Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tclegg at veritasgenetics.com>

diff --git a/services/api/app/middlewares/arvados_api_token.rb b/services/api/app/middlewares/arvados_api_token.rb
index 5eb756b..018f0e8 100644
--- a/services/api/app/middlewares/arvados_api_token.rb
+++ b/services/api/app/middlewares/arvados_api_token.rb
@@ -32,21 +32,25 @@ class ArvadosApiToken
     user = nil
     api_client = nil
     api_client_auth = nil
-    supplied_token =
-      params["api_token"] ||
-      params["oauth_token"] ||
-      env["HTTP_AUTHORIZATION"].andand.match(/OAuth2 ([a-zA-Z0-9]+)/).andand[1]
-    if supplied_token
-      api_client_auth = ApiClientAuthorization.
+    reader_tokens = params["reader_tokens"]
+    if reader_tokens.is_a? String
+      reader_tokens = SafeJSON.load(reader_tokens)
+    end
+    [params["api_token"],
+     params["oauth_token"],
+     env["HTTP_AUTHORIZATION"].andand.match(/OAuth2 ([a-zA-Z0-9]+)/).andand[1],
+     *reader_tokens,
+    ].each do |supplied|
+      next if !supplied
+      try_auth = ApiClientAuthorization.
         includes(:api_client, :user).
-        where('api_token=? and (expires_at is null or expires_at > CURRENT_TIMESTAMP)', supplied_token).
+        where('api_token=? and (expires_at is null or expires_at > CURRENT_TIMESTAMP)', supplied).
         first
-      if api_client_auth.andand.user
+      if try_auth.andand.user
+        api_client_auth = try_auth
         user = api_client_auth.user
         api_client = api_client_auth.api_client
-      else
-        # Token seems valid, but points to a non-existent (deleted?) user.
-        api_client_auth = nil
+        break
       end
     end
     Thread.current[:api_client_ip_address] = remote_ip

-----------------------------------------------------------------------


hooks/post-receive
--