[ARVADOS] updated: 1.1.0-179-g7ad3a74

[Git user]

Summary of changes:
 .../api/app/controllers/application_controller.rb  |  2 +-
 services/api/app/middlewares/arvados_api_token.rb  | 34 +++++++++++++++-------
 .../api/test/integration/reader_tokens_test.rb     |  4 +--
 3 files changed, 26 insertions(+), 14 deletions(-)

       via  7ad3a743e6dfa9f6084affc34346f42f9db8c3fb (commit)
       via  9c627105e9634249cd303f46c3b81ecdcbaead39 (commit)
       via  c33a21739019843a5408ad11eec57cdd850decad (commit)
      from  3737e05681b6cfb22ea0af0da08598e458da16f0 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.


commit 7ad3a743e6dfa9f6084affc34346f42f9db8c3fb
Merge: 3737e05 9c62710
Author: Tom Clegg <tclegg at veritasgenetics.com>
Date:   Fri Nov 24 10:29:25 2017 -0500

    Merge branch '12627-token-scope'
    
    fixes #12627
    
    Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tclegg at veritasgenetics.com>


commit 9c627105e9634249cd303f46c3b81ecdcbaead39
Author: Tom Clegg <tclegg at veritasgenetics.com>
Date:   Fri Nov 24 01:10:56 2017 -0500

    12627: Any token can permit scope, if acting as the right user.
    
    Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tclegg at veritasgenetics.com>

diff --git a/services/api/app/controllers/application_controller.rb b/services/api/app/controllers/application_controller.rb
index ba0efa7..6bdba7a 100644
--- a/services/api/app/controllers/application_controller.rb
+++ b/services/api/app/controllers/application_controller.rb
@@ -365,7 +365,7 @@ class ApplicationController < ActionController::Base
   end
 
   def require_auth_scope
-    if @read_auths.empty? || @read_auths[0] != current_api_client_authorization
+    unless current_user && @read_auths.any? { |auth| auth.user.andand.uuid == current_user.uuid }
       if require_login != false
         send_error("Forbidden", status: 403)
       end
diff --git a/services/api/app/middlewares/arvados_api_token.rb b/services/api/app/middlewares/arvados_api_token.rb
index 1d47718..6a37631 100644
--- a/services/api/app/middlewares/arvados_api_token.rb
+++ b/services/api/app/middlewares/arvados_api_token.rb
@@ -32,7 +32,7 @@ class ArvadosApiToken
     user = nil
     api_client = nil
     api_client_auth = nil
-    if request.get?
+    if request.get? || params["_method"] == 'GET'
       reader_tokens = params["reader_tokens"]
       if reader_tokens.is_a? String
         reader_tokens = SafeJSON.load(reader_tokens)

commit c33a21739019843a5408ad11eec57cdd850decad
Author: Tom Clegg <tclegg at veritasgenetics.com>
Date:   Thu Nov 23 13:52:46 2017 -0500

    12627: Set current_user from first valid reader_token
    
    ...if primary session token is missing or invalid.
    
    Workbench relies on this for anonymous access.
    
    Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tclegg at veritasgenetics.com>

diff --git a/services/api/app/middlewares/arvados_api_token.rb b/services/api/app/middlewares/arvados_api_token.rb
index 5eb756b..1d47718 100644
--- a/services/api/app/middlewares/arvados_api_token.rb
+++ b/services/api/app/middlewares/arvados_api_token.rb
@@ -32,21 +32,33 @@ class ArvadosApiToken
     user = nil
     api_client = nil
     api_client_auth = nil
-    supplied_token =
-      params["api_token"] ||
-      params["oauth_token"] ||
-      env["HTTP_AUTHORIZATION"].andand.match(/OAuth2 ([a-zA-Z0-9]+)/).andand[1]
-    if supplied_token
-      api_client_auth = ApiClientAuthorization.
+    if request.get?
+      reader_tokens = params["reader_tokens"]
+      if reader_tokens.is_a? String
+        reader_tokens = SafeJSON.load(reader_tokens)
+      end
+    else
+      reader_tokens = nil
+    end
+
+    # Set current_user etc. based on the primary session token if a
+    # valid one is present. Otherwise, use the first valid token in
+    # reader_tokens.
+    [params["api_token"],
+     params["oauth_token"],
+     env["HTTP_AUTHORIZATION"].andand.match(/OAuth2 ([a-zA-Z0-9]+)/).andand[1],
+     *reader_tokens,
+    ].each do |supplied|
+      next if !supplied
+      try_auth = ApiClientAuthorization.
         includes(:api_client, :user).
-        where('api_token=? and (expires_at is null or expires_at > CURRENT_TIMESTAMP)', supplied_token).
+        where('api_token=? and (expires_at is null or expires_at > CURRENT_TIMESTAMP)', supplied).
         first
-      if api_client_auth.andand.user
+      if try_auth.andand.user
+        api_client_auth = try_auth
         user = api_client_auth.user
         api_client = api_client_auth.api_client
-      else
-        # Token seems valid, but points to a non-existent (deleted?) user.
-        api_client_auth = nil
+        break
       end
     end
     Thread.current[:api_client_ip_address] = remote_ip
diff --git a/services/api/test/integration/reader_tokens_test.rb b/services/api/test/integration/reader_tokens_test.rb
index 60b06a9..a60be09 100644
--- a/services/api/test/integration/reader_tokens_test.rb
+++ b/services/api/test/integration/reader_tokens_test.rb
@@ -51,9 +51,9 @@ class ReaderTokensTest < ActionDispatch::IntegrationTest
   [nil, :active_noscope].each do |main_auth|
     [:spectator, :spectator_specimens].each do |read_auth|
       [:to_a, :to_json].each do |formatter|
-        test "#{main_auth.inspect} auth with #{formatter} reader token #{read_auth} can't read" do
+        test "#{main_auth.inspect} auth with #{formatter} reader token #{read_auth} can#{"'t" if main_auth} read" do
           get_specimens(main_auth, read_auth)
-          assert_response(if main_auth then 403 else 302 end)
+          assert_response(if main_auth then 403 else 200 end)
         end
 
         test "#{main_auth.inspect} auth with #{formatter} reader token #{read_auth} can't write" do

-----------------------------------------------------------------------


hooks/post-receive
--