Ponos task authentication

Closes #1451 (closed)

Any task or worker that upgrade to the API client after this is merged, and after api-client#34 (closed) is implemented and released, will break, because we have restrictions on using worker run IDs to internal users in some endpoints, and this task authentication will cause imports or workers to run as non-internal.

I tested locally by running make build CLIENT_BRANCH=ponos-auth in tasks after pushing api-client!219 (merged), and found that a random PDF import, which normally runs with my internal user, failed with this error:

apistar.exceptions.ErrorResponse: {'worker_run_id': ['Only an internal user can create an element with a worker run.']}

Which proves that the task was authenticated as the process creator (an instance admin, but not internal) and not the configured internal token.

arkindex/process/serializers/workers.py

@@ -8,6 +8,7 @@ from drf_spectacular.utils import extend_schema_field
 from rest_framework import serializers
 from rest_framework.exceptions import ValidationError
 
+from arkindex.ponos.models import Task
 from arkindex.process.models import (
     Process,
     Repository,
@@ -302,6 +303,12 @@ class WorkerActivitySerializer(serializers.ModelSerializer):
             'worker_version_id',
         )
 
+    def validate_process_id(self, process):
+        request = self.context.get('request')
+        if request and isinstance(request.auth, Task) and process.workflow_id != request.auth.workflow_id:
+            raise serializers.ValidationError('Only WorkerActivities for the process of the currently authenticated task can be updated.')
+        return process
+
 
 class WorkerConfigurationListSerializer(serializers.ModelSerializer):
     configuration = serializers.DictField(allow_empty=False)