bootstrapping app-level authentication with limited user breaks deploy of REST apps

[grtjn]

If bootstrapping with application-level authentication with a default user that only had rest-reader role (and not rest-writer), then deploy won't work.

Doing bootstrap twice to switch default user is a workaround, but cumbersome. It may be necessary to allow deployment of rest apps through xcc..

[grtjn]

Workaround:

class ServerConfig
  alias_method :original_deploy_modules, :deploy_modules
  def deploy_modules()
    r = execute_query(%Q{
        xquery version "1.0-ml";

        import module namespace admin="http://marklogic.com/xdmp/admin" 
           at "/MarkLogic/admin.xqy";

        let $config := admin:get-configuration()
        let $config :=
          admin:appserver-set-default-user($config, xdmp:server("#{@properties["ml.app-name"]}"), xdmp:user("#{@properties["ml.user"]}"))
        return
          admin:save-configuration-without-restart($config)
      },
      :app_name => @properties["ml.app-name"]
    )

    original_deploy_modules

    r = execute_query(%Q{
        xquery version "1.0-ml";

        import module namespace admin="http://marklogic.com/xdmp/admin" 
           at "/MarkLogic/admin.xqy";

        let $config := admin:get-configuration()
        let $config :=
          admin:appserver-set-default-user($config, xdmp:server("#{@properties["ml.app-name"]}"), xdmp:user("#{@properties["ml.default-user"]}"))
        return
          admin:save-configuration-without-restart($config)
      },
      :app_name => @properties["ml.app-name"]
    )
  end
end

[grtjn]

An alternative solution is probably to bypass the REST api web interface to get the extensions installed, but if the rest-api XQuery modules aren't designed to be used as internal module, then that creates an undesirable dependency..

[grtjn]

I think this was discussed in sufficient length in #668 already. I also added this wiki page to grab some example code from to solve this: https://github.com/marklogic/roxy/wiki/Switching-app-level-auth-during-deployment