Send a SubmitQueue token from the environment as a bearer token - #332
Open
mnoah1 wants to merge 1 commit into
Open
Send a SubmitQueue token from the environment as a bearer token#332mnoah1 wants to merge 1 commit into
mnoah1 wants to merge 1 commit into
Conversation
mnoah1
force-pushed
the
mnoah1/minion_1b8dd461
branch
from
September 2, 2026 02:39
cf31762 to
901951e
Compare
mnoah1
changed the title
mnoah1
marked this pull request as ready for review
September 2, 2026 02:41
Summary:
Adds a SUBMITQUEUE_TOKEN_ENV ('ARC_SUBMITQUEUE_TOKEN') constant to
UberSubmitQueueClient, reads it into a new private $submitQueueToken
property, and in callMethod() adds an 'Authorization: Bearer <token>'
header on the outbound request whenever that string is non-empty.
Accessors getConduitToken() / getSubmitQueueToken() are added for
tests, along with UberSubmitQueueClientTestCase.php and the two
corresponding __phutil_library_map__.php entries.
The conduitToken query parameter is UNCHANGED: it still carries
whatever Conduit token arcanist already had. The environment token is
delivered ONLY as an additional Authorization: Bearer header. When
ARC_SUBMITQUEUE_TOKEN is unset, the outbound request is byte-identical
to before. (An earlier revision of this PR instead replaced the
conduitToken value with the env token; that is no longer what this
change does.)
Background: java-code c31c03bae432a ("[submitqueue] fix conduit
validator", #865) made ConduitAPIImpl.validate authenticate
user.whoami with the caller's token rather than SubmitQueue's service
token, so missing/stale tokens that used to pass now fail. Sending the
env token as a bearer header lets headless callers (CI, devpods,
containers, automation) authenticate without an arc
install-certificate round trip.
Test Plan:
Added UberSubmitQueueClientTestCase.php covering the bearer-header
behavior; existing CI/build validation.
Jira Issues: None
Revert Plan: Revert this commit.
API Changes: N/A
Monitoring and Alerts: N/A
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
mnoah1
force-pushed
the
mnoah1/minion_1b8dd461
branch
from
September 2, 2026 02:47
901951e to
dfbdfa6
Compare
mnoah1
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a SUBMITQUEUE_TOKEN_ENV ('ARC_SUBMITQUEUE_TOKEN') constant to
UberSubmitQueueClient, reads it into a new private $submitQueueToken
property, and in callMethod() adds an 'Authorization: Bearer '
header on the outbound request whenever that string is non-empty.
Accessors getConduitToken() / getSubmitQueueToken() are added for
tests, along with UberSubmitQueueClientTestCase.php and the two
corresponding phutil_library_map.php entries.
The conduitToken query parameter is UNCHANGED: it still carries
whatever Conduit token arcanist already had. The environment token is
delivered ONLY as an additional Authorization: Bearer header. When
ARC_SUBMITQUEUE_TOKEN is unset, the outbound request is byte-identical
to before. (An earlier revision of this PR instead replaced the
conduitToken value with the env token; that is no longer what this
change does.)
Background: java-code c31c03bae432a ("[submitqueue] fix conduit
validator", #865) made ConduitAPIImpl.validate authenticate
user.whoami with the caller's token rather than SubmitQueue's service
token, so missing/stale tokens that used to pass now fail. Sending the
env token as a bearer header lets headless callers (CI, devpods,
containers, automation) authenticate without an arc
install-certificate round trip.
Test Plan
Added UberSubmitQueueClientTestCase.php covering the bearer-header
behavior; existing CI/build validation.
Revert Plan
Revert this commit.
API Changes
N/A
Monitoring and Alerts
N/A
Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Issues