Revert "Allow token to come via X-IRI-Facility-Project header" (insecure)

app/demo_adapter.py

@@ -29,7 +29,6 @@
 from .routers.status import models as status_models
 from .routers.task import facility_adapter as task_adapter
 from .routers.task import models as task_models
-from .request_context import get_iri_facility_project
 from .types.models import Capability
 from .types.user import User
 from .types.scalars import AllocationUnit
@@ -562,16 +561,14 @@ async def submit_job(
         user: User,
         job_spec: compute_models.JobSpec,
     ) -> compute_models.Job:
-        facility_project = get_iri_facility_project()
-        account = facility_project or (job_spec.attributes.account if job_spec.attributes else None)
         return compute_models.Job(
             id="job_123",
             status=compute_models.JobStatus(
                 state=compute_models.JobState.NEW,
                 time=utc_timestamp(),
                 message="job submitted",
                 exit_code=0,
-                meta_data={"account": account},
+                meta_data={"account": "account1"},
             ),
         )
 
@@ -582,16 +579,14 @@ async def update_job(
         job_spec: compute_models.JobSpec,
         job_id: str,
     ) -> compute_models.Job:
-        facility_project = get_iri_facility_project()
-        account = facility_project or (job_spec.attributes.account if job_spec.attributes else None)
         return compute_models.Job(
             id=job_id,
             status=compute_models.JobStatus(
                 state=compute_models.JobState.ACTIVE,
                 time=utc_timestamp(),
                 message="job updated",
                 exit_code=0,
-                meta_data={"account": account},
+                meta_data={"account": "account1"},
             ),
         )
 

app/main.py

@@ -17,7 +17,7 @@
 
 from . import config
 from .apilogger import configure_logging
-from .request_context import _api_url_base, _iri_facility_project, set_api_url_base
+from .request_context import set_api_url_base, _api_url_base
 
 from app.routers.error_handlers import install_error_handlers
 from app.routers.facility import facility
@@ -58,14 +58,12 @@
 
 class _ExternalRequestContextMiddleware(BaseHTTPMiddleware):
     async def dispatch(self, request: Request, call_next):
-        url_token = _api_url_base.set(None)
-        facility_project_token = _iri_facility_project.set(None)
+        token = _api_url_base.set(None)
         try:
             set_api_url_base(request)
             return await call_next(request)
         finally:
-            _api_url_base.reset(url_token)
-            _iri_facility_project.reset(facility_project_token)
+            _api_url_base.reset(token)
 
 
 APP.add_middleware(_ExternalRequestContextMiddleware)

app/request_context.py

@@ -6,7 +6,6 @@
 from . import config
 
 _api_url_base: ContextVar[str | None] = ContextVar("_api_url_base", default=None)
-_iri_facility_project: ContextVar[str | None] = ContextVar("_iri_facility_project", default=None)
 
 
 def _first_header_value(value: str | None) -> str:
@@ -23,8 +22,6 @@ def set_api_url_base(request: Request) -> None:
     api_url = config.API_URL.strip("/")
     if host:
         _api_url_base.set(f"{proto}://{host}{prefix}{api_prefix}/{api_url}")
-    facility_project = _first_header_value(request.headers.get("x-iri-facility-project"))
-    _iri_facility_project.set(facility_project or None)
 
 
 def get_url_prefix() -> str:
@@ -33,8 +30,3 @@ def get_url_prefix() -> str:
     if value:
         return value
     return f"{config.API_URL_ROOT}{config.API_PREFIX}{config.API_URL}"
-
-
-def get_iri_facility_project() -> str | None:
-    """Return the facility-native project/account identifier forwarded by RIG."""
-    return _iri_facility_project.get()

app/routers/compute/compute.py

@@ -5,7 +5,6 @@
 from ...types.http import forbidExtraQueryParams
 from ...types.scalars import StrictHTTPBool
 from ...types.user import User
-from ...request_context import get_iri_facility_project
 from .. import iri_router
 from ..error_handlers import DEFAULT_RESPONSES
 from ..iri_meta import iri_meta_dict
@@ -35,22 +34,6 @@ async def get_resources(
     return await status_router.adapter.get_resources_for_endpoint(status_models.Endpoint.compute)
 
 
-def _validate_project_account_source(job_spec: models.JobSpec) -> None:
-    """Require exactly one project/account source: job spec account or forwarded header."""
-    spec_account = job_spec.attributes.account if job_spec.attributes else None
-    header_account = get_iri_facility_project()
-    if spec_account and header_account:
-        raise HTTPException(
-            status_code=400,
-            detail="Specify project/account in exactly one place: job_spec.attributes.account or X-IRI-Facility-Project, not both.",
-        )
-    if not spec_account and not header_account:
-        raise HTTPException(
-            status_code=400,
-            detail="Project/account must be specified in exactly one place: job_spec.attributes.account or X-IRI-Facility-Project.",
-        )
-
-
 @router.post(
     "/job/{resource_id:str}",
     response_model=models.Job,
@@ -74,8 +57,6 @@ async def submit_job(
 
     This command will attempt to submit a job and return its id.
     """
-    _validate_project_account_source(job_spec)
-
     # look up the resource (todo: maybe ensure it's available)
     resource = await status_router.adapter.get_resource(resource_id)
 
@@ -108,8 +89,6 @@ async def update_job(
     - **job_request**: a PSIJ job spec as defined <a href="https://exaworks.org/psij-python/docs/v/0.9.11/.generated/tree.html#jobspec">here</a>
 
     """
-    _validate_project_account_source(job_spec)
-
     # look up the resource (todo: maybe ensure it's available)
     resource = await status_router.adapter.get_resource(resource_id)