Change: GET /work, POST /worker use access token to identify worker

1 files changed, 10 insertions, 2 deletions

diff --git a/ick2/workapi.py b/ick2/workapi.py
index 1f8c827..32c988e 100644
--- a/ick2/workapi.py
+++ b/ick2/workapi.py
@@ -30,7 +30,7 @@ class WorkAPI(ick2.APIbase):
         return [
             {
                 'method': 'GET',
-                'path': '{}/<worker>'.format(path),
+                'path': '{}'.format(path),
                 'callback': self.GET(self.get_work),
             },
             {
@@ -40,7 +40,8 @@ class WorkAPI(ick2.APIbase):
             },
         ]
 
-    def get_work(self, worker, **kwargs):
+    def get_work(self, **kwargs):
+        worker = self._get_client_id(**kwargs)
         worker_state = self._workers.get_worker(worker)
         if not worker_state.get('doing'):
             project = self._pick_triggered_project()
@@ -73,6 +74,13 @@ class WorkAPI(ick2.APIbase):
 
         return worker_state['doing']
 
+    def _get_client_id(self, **kwargs):
+        claims = kwargs.get('claims', {})
+        client_id = claims.get('aud')
+        if client_id is None:   # pragma: no cover
+            raise ick2.ClientIdMissing()
+        return client_id
+
     def _pick_build_number(self, project):
         old_build_no = project.get('next_build_id')
         build_no = (old_build_no or 0) + 1