Pass command-line OidcToken option through config rather than env variables, and add lua optionlm/oidctoken-exe-path

5 files changed, 45 insertions, 22 deletions

diff --git a/src/zenserver/storage/projectstore/httpprojectstore.cpp b/src/zenserver/storage/projectstore/httpprojectstore.cpp
index 3a48ef595..1e1899002 100644
--- a/src/zenserver/storage/projectstore/httpprojectstore.cpp
+++ b/src/zenserver/storage/projectstore/httpprojectstore.cpp
@@ -252,7 +252,8 @@ namespace {
 											  size_t					   MaxBlockSize,
 											  size_t					   MaxChunkEmbedSize,
 											  size_t					   MaximumInMemoryDownloadSize,
-											  const std::filesystem::path& TempFilePath)
+											  const std::filesystem::path& TempFilePath,
+											  const std::filesystem::path& OidcTokenExePath)
 	{
 		ZEN_MEMSCOPE(GetProjectHttpTag());
 
@@ -318,7 +319,7 @@ namespace {
 				}
 			}
 
-			std::filesystem::path OidcExePath = FindOidcTokenExePath("");
+			std::filesystem::path OidcExePath = FindOidcTokenExePath(OidcTokenExePath.string());
 
 			std::string_view KeyParam = Cloud["key"sv].AsString();
 			if (KeyParam.empty())
@@ -425,7 +426,7 @@ namespace {
 					AccessToken = GetEnvVariable(AccessTokenEnvVariable);
 				}
 			}
-			std::filesystem::path OidcExePath  = FindOidcTokenExePath("");
+			std::filesystem::path OidcExePath  = FindOidcTokenExePath(OidcTokenExePath.string());
 			std::string_view	  BuildIdParam = Builds["buildsid"sv].AsString();
 			if (BuildIdParam.empty())
 			{
@@ -507,13 +508,14 @@ namespace {
 
 //////////////////////////////////////////////////////////////////////////
 
-HttpProjectService::HttpProjectService(CidStore&		  Store,
-									   ProjectStore*	  Projects,
-									   HttpStatusService& StatusService,
-									   HttpStatsService&  StatsService,
-									   AuthMgr&			  AuthMgr,
-									   OpenProcessCache&  InOpenProcessCache,
-									   JobQueue&		  InJobQueue)
+HttpProjectService::HttpProjectService(CidStore&					Store,
+									   ProjectStore*				Projects,
+									   HttpStatusService&			StatusService,
+									   HttpStatsService&			StatsService,
+									   AuthMgr&						AuthMgr,
+									   OpenProcessCache&			InOpenProcessCache,
+									   JobQueue&					InJobQueue,
+									   const std::filesystem::path& InOidcTokenExePath)
 : m_Log(logging::Get("project"))
 , m_CidStore(Store)
 , m_ProjectStore(Projects)
@@ -522,6 +524,7 @@ HttpProjectService::HttpProjectService(CidStore&		  Store,
 , m_AuthMgr(AuthMgr)
 , m_OpenProcessCache(InOpenProcessCache)
 , m_JobQueue(InJobQueue)
+, m_OidcTokenExePath(InOidcTokenExePath)
 {
 	ZEN_MEMSCOPE(GetProjectHttpTag());
 
@@ -2636,7 +2639,8 @@ HttpProjectService::HandleRpcRequest(HttpRouterRequest& Req)
 																			  MaxBlockSize,
 																			  MaxChunkEmbedSize,
 																			  GetMaxMemoryBufferSize(MaxBlockSize, BoostWorkerMemory),
-																			  Oplog->TempPath());
+																			  Oplog->TempPath(),
+																			  m_OidcTokenExePath);
 
 				if (RemoteStoreResult.Store == nullptr)
 				{
@@ -2706,7 +2710,8 @@ HttpProjectService::HandleRpcRequest(HttpRouterRequest& Req)
 																			  MaxBlockSize,
 																			  MaxChunkEmbedSize,
 																			  GetMaxMemoryBufferSize(MaxBlockSize, BoostWorkerMemory),
-																			  Oplog->TempPath());
+																			  Oplog->TempPath(),
+																			  m_OidcTokenExePath);
 
 				if (RemoteStoreResult.Store == nullptr)
 				{
diff --git a/src/zenserver/storage/projectstore/httpprojectstore.h b/src/zenserver/storage/projectstore/httpprojectstore.h
index b742102a5..5a8bd3c9b 100644
--- a/src/zenserver/storage/projectstore/httpprojectstore.h
+++ b/src/zenserver/storage/projectstore/httpprojectstore.h
@@ -38,13 +38,14 @@ class TransferThreadWorkers;
 class HttpProjectService : public HttpService, public IHttpStatusProvider, public IHttpStatsProvider
 {
 public:
-	HttpProjectService(CidStore&		  Store,
-					   ProjectStore*	  InProjectStore,
-					   HttpStatusService& StatusService,
-					   HttpStatsService&  StatsService,
-					   AuthMgr&			  AuthMgr,
-					   OpenProcessCache&  InOpenProcessCache,
-					   JobQueue&		  InJobQueue);
+	HttpProjectService(CidStore&					Store,
+					   ProjectStore*				InProjectStore,
+					   HttpStatusService&			StatusService,
+					   HttpStatsService&			StatsService,
+					   AuthMgr&						AuthMgr,
+					   OpenProcessCache&			InOpenProcessCache,
+					   JobQueue&					InJobQueue,
+					   const std::filesystem::path& InOidcTokenExePath);
 	~HttpProjectService();
 
 	virtual const char* BaseUri() const override;
@@ -109,6 +110,7 @@ private:
 	metrics::OperationTiming   m_HttpRequests;
 	RwLock					   m_ThreadWorkersLock;
 	Ref<TransferThreadWorkers> m_ThreadWorkers;
+	std::filesystem::path	   m_OidcTokenExePath;
 
 	Ref<TransferThreadWorkers> GetThreadWorkers(bool BoostWorkers, bool SingleThreaded);
 };
diff --git a/src/zenserver/storage/storageconfig.cpp b/src/zenserver/storage/storageconfig.cpp
index 0f8ab1e98..98167b4f6 100644
--- a/src/zenserver/storage/storageconfig.cpp
+++ b/src/zenserver/storage/storageconfig.cpp
@@ -496,6 +496,7 @@ ZenStorageServerConfigurator::AddConfigOptions(LuaConfig::Options& LuaOptions)
 	LuaOptions.AddOption("security.encryptionaeskey"sv, ServerOptions.EncryptionKey, "encryption-aes-key"sv);
 	LuaOptions.AddOption("security.encryptionaesiv"sv, ServerOptions.EncryptionIV, "encryption-aes-iv"sv);
 	LuaOptions.AddOption("security.openidproviders"sv, ServerOptions.AuthConfig);
+	LuaOptions.AddOption("security.oidctokenexecutable"sv, ServerOptions.OidcTokenExecutable, "oidctoken-exe-path"sv);
 
 	////// workspaces
 	LuaOptions.AddOption("workspaces.enabled"sv, ServerOptions.WorksSpacesConfig.Enabled, "workspaces-enabled"sv);
@@ -649,6 +650,12 @@ ZenStorageServerCmdLineOptions::AddSecurityOptions(cxxopts::Options& options, Ze
 
 	options.add_option("security", "", "openid-provider-url", "Open ID provider URL", cxxopts::value<std::string>(OpenIdProviderUrl), "");
 	options.add_option("security", "", "openid-client-id", "Open ID client ID", cxxopts::value<std::string>(OpenIdClientId), "");
+	options.add_option("security",
+					   "",
+					   "oidctoken-exe-path",
+					   "Path to OidcToken executable",
+					   cxxopts::value<std::string>(OidcTokenExecutable),
+					   "");
 }
 
 void
@@ -1045,7 +1052,8 @@ ZenStorageServerCmdLineOptions::ApplyOptions(cxxopts::Options& options, ZenStora
 			{.Name = OpenIdProviderName, .Url = OpenIdProviderUrl, .ClientId = OpenIdClientId});
 	}
 
-	ServerOptions.ObjectStoreConfig = ParseBucketConfigs(BucketConfigs);
+	ServerOptions.ObjectStoreConfig	  = ParseBucketConfigs(BucketConfigs);
+	ServerOptions.OidcTokenExecutable = MakeSafeAbsolutePath(OidcTokenExecutable);
 }
 
 }  // namespace zen
diff --git a/src/zenserver/storage/storageconfig.h b/src/zenserver/storage/storageconfig.h
index d59d05cf6..b265572cc 100644
--- a/src/zenserver/storage/storageconfig.h
+++ b/src/zenserver/storage/storageconfig.h
@@ -157,6 +157,7 @@ struct ZenStorageServerConfig : public ZenServerConfig
 	std::filesystem::path	 PluginsConfigFile;	 // Path to plugins config file
 	bool					 ObjectStoreEnabled = false;
 	std::string				 ScrubOptions;
+	std::filesystem::path	 OidcTokenExecutable;
 };
 
 struct ZenStorageServerCmdLineOptions
@@ -174,6 +175,7 @@ struct ZenStorageServerCmdLineOptions
 	std::string OpenIdProviderName;
 	std::string OpenIdProviderUrl;
 	std::string OpenIdClientId;
+	std::string OidcTokenExecutable;
 
 	void AddSecurityOptions(cxxopts::Options& options, ZenStorageServerConfig& ServerOptions);
 
diff --git a/src/zenserver/storage/zenstorageserver.cpp b/src/zenserver/storage/zenstorageserver.cpp
index 559695a94..381ef028a 100644
--- a/src/zenserver/storage/zenstorageserver.cpp
+++ b/src/zenserver/storage/zenstorageserver.cpp
@@ -204,8 +204,14 @@ ZenStorageServer::InitializeServices(const ZenStorageServerConfig& ServerOptions
 	m_OpenProcessCache = std::make_unique<OpenProcessCache>();
 
 	m_ProjectStore = new ProjectStore(*m_CidStore, m_DataRoot / "projects", m_GcManager, ProjectStore::Configuration{});
-	m_HttpProjectService.reset(
-		new HttpProjectService{*m_CidStore, m_ProjectStore, m_StatusService, m_StatsService, *m_AuthMgr, *m_OpenProcessCache, *m_JobQueue});
+	m_HttpProjectService.reset(new HttpProjectService{*m_CidStore,
+													  m_ProjectStore,
+													  m_StatusService,
+													  m_StatsService,
+													  *m_AuthMgr,
+													  *m_OpenProcessCache,
+													  *m_JobQueue,
+													  ServerOptions.OidcTokenExecutable});
 
 	if (ServerOptions.WorksSpacesConfig.Enabled)
 	{