Ponos task authentication

Closes #1451 (closed)

Any task or worker that upgrade to the API client after this is merged, and after api-client#34 (closed) is implemented and released, will break, because we have restrictions on using worker run IDs to internal users in some endpoints, and this task authentication will cause imports or workers to run as non-internal.

I tested locally by running make build CLIENT_BRANCH=ponos-auth in tasks after pushing api-client!219 (merged), and found that a random PDF import, which normally runs with my internal user, failed with this error:

apistar.exceptions.ErrorResponse: {'worker_run_id': ['Only an internal user can create an element with a worker run.']}

Which proves that the task was authenticated as the process creator (an instance admin, but not internal) and not the configured internal token.

arkindex/ponos/tests/test_api.py

@@ -1642,24 +1642,27 @@ class TestAPI(APITestCase):
             image="registry.gitlab.com/test",
         )
 
-        response = self.client.post(
-            reverse("api:task-create"),
-            data={
-                "workflow_id": str(self.workflow.id),
-                "slug": "test_task",
-                "image": "registry.gitlab.com/test",
-                "parents": [str(self.task1.id), str(self.task2.id), str(task3.id)],
-                "command": "echo Test",
-                "env": {"test": "test", "test2": "test2"},
-            },
-            format="json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
-        data = response.json()
-        del data["id"]
+        with self.assertNumQueries(12):
+            response = self.client.post(
+                reverse("api:task-create"),
+                data={
+                    "workflow_id": str(self.workflow.id),
+                    "slug": "test_task",
+                    "image": "registry.gitlab.com/test",
+                    "parents": [str(self.task1.id), str(self.task2.id), str(task3.id)],
+                    "command": "echo Test",
+                    "env": {"test": "test", "test2": "test2"},
+                },
+                format="json",
+            )
+            self.assertEqual(response.status_code, status.HTTP_201_CREATED)
+
+        new_task = self.workflow.tasks.get(slug='test_task')
+
         self.assertDictEqual(
-            data,
+            response.json(),
             {
+                "id": str(new_task.id),
                 "workflow_id": str(self.workflow.id),
                 "slug": "test_task",
                 "parents": [str(self.task1.id), str(self.task2.id), str(task3.id)],
@@ -1669,6 +1672,7 @@ class TestAPI(APITestCase):
                     "test": "test",
                     "top_env_variable": "workflow_variable",
                     "test2": "test2",
+                    "ARKINDEX_TASK_TOKEN": new_task.token,
                 },
                 "run": 0,
                 "depth": 4,
@@ -1684,25 +1688,28 @@ class TestAPI(APITestCase):
             image="registry.gitlab.com/test",
         )
 
-        response = self.client.post(
-            reverse("api:task-create"),
-            data={
-                "workflow_id": str(self.workflow.id),
-                "slug": "test_task",
-                "image": "registry.gitlab.com/test",
-                "parents": [str(self.task1.id), str(self.task2.id), str(task3.id)],
-                "command": "echo Test",
-                "env": {"test": "test", "test2": "test2"},
-                "has_docker_socket": True,
-            },
-            format="json",
-        )
-        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
-        data = response.json()
-        del data["id"]
+        with self.assertNumQueries(12):
+            response = self.client.post(
+                reverse("api:task-create"),
+                data={
+                    "workflow_id": str(self.workflow.id),
+                    "slug": "test_task",
+                    "image": "registry.gitlab.com/test",
+                    "parents": [str(self.task1.id), str(self.task2.id), str(task3.id)],
+                    "command": "echo Test",
+                    "env": {"test": "test", "test2": "test2"},
+                    "has_docker_socket": True,
+                },
+                format="json",
+            )
+            self.assertEqual(response.status_code, status.HTTP_201_CREATED)
+
+        new_task = self.workflow.tasks.get(slug='test_task')
+
         self.assertDictEqual(
-            data,
+            response.json(),
             {
+                "id": str(new_task.id),
                 "workflow_id": str(self.workflow.id),
                 "slug": "test_task",
                 "parents": [str(self.task1.id), str(self.task2.id), str(task3.id)],
@@ -1712,6 +1719,7 @@ class TestAPI(APITestCase):
                     "test": "test",
                     "top_env_variable": "workflow_variable",
                     "test2": "test2",
+                    "ARKINDEX_TASK_TOKEN": new_task.token,
                 },
                 "run": 0,
                 "depth": 4,