QC-1289 Read BKP client token from a file

This adds a possibility to read a BKP client token from a file `qc_bkp_client_token` provided in the working directory if it was not found as environment variable.

Author: knopers8

Framework/src/Bookkeeping.cxx

@@ -20,6 +20,8 @@
 #include "BookkeepingApi/BkpClientFactory.h"
 #include "BookkeepingApi/BkpClient.h"
 #include <unistd.h>
+#include <filesystem>
+#include <fstream>
 
 using namespace o2::bkp::api;
 
@@ -28,12 +30,33 @@ namespace o2::quality_control::core
 
 std::string readClientToken()
 {
+  // first we try to find the token in the environment variable
   if (auto tokenEnv = std::getenv("QC_BKP_CLIENT_TOKEN"); tokenEnv != NULL && std::strlen(tokenEnv) > 0) {
     ILOG(Info, Ops) << "Using token from environment variable QC_BKP_CLIENT_TOKEN" << ENDM;
     return tokenEnv;
   }
 
-  ILOG(Debug, Devel) << "Could not find an env var QC_BKP_CLIENT_TOKEN, using BKP client without an authentication token" << ENDM;
+  // if the environment variable is not set, we try to read it from a file
+  const std::string tokenFileName = "qc_bkp_client_token.txt";
+  std::filesystem::path tokenPath = std::filesystem::current_path() / tokenFileName;
+
+  std::error_code ec;
+  if (std::filesystem::exists(tokenPath, ec) && !ec.value()) {
+    std::string token;
+    std::ifstream tokenFile(tokenPath);
+    // from now on, we throw if something goes wrong, because the user is clearly trying to use a token file
+    if (!tokenFile.is_open()) {
+      throw std::runtime_error("BKP token file '" + tokenFileName + "' was provided but cannot be opened, check permissions");
+    }
+    std::getline(tokenFile, token);
+    if (token.empty()) {
+      throw std::runtime_error("BKP token file '" + tokenFileName + "' was provided but it is empty, please provide a valid token");
+    }
+    ILOG(Debug, Devel) << "Using token from file qc_bkp_client_token" << ENDM;
+    return token;
+  }
+
+  ILOG(Debug, Devel) << "Could not find an env var QC_BKP_CLIENT_TOKEN nor a qc_bkp_client_token.txt file, using BKP client without an authentication token" << ENDM;
   return "";
 }
 

doc/Framework.md

@@ -587,6 +587,11 @@ If you need the directory structure preserved, add the argument `--preserve-dire
 
 The framework allows to propagate Quality Objects (QOs) produced by Checks and Aggregators to RCT in Bookkeeping.
 The synchronisation is done once, at the end of workflow runtime, i.e. at the End of Run or in the last stage of QC merging on Grid.
+Check results are converted into Flags, which are documented in [O2/DataFormats/QualityControl](https://github.com/AliceO2Group/AliceO2/tree/dev/DataFormats/QualityControl).
+Information about the object validity is preserved, which allows for time-based flagging of good/bad data.
+
+### Configuration details
+
 Propagation can be enabled by adding the following key-value pair to Check/Aggregator configuration:
 
 ```json
@@ -595,10 +600,25 @@ Propagation can be enabled by adding the following key-value pair to Check/Aggre
 
 Using it for Aggregators is discouraged, as the information on which exact Check failed is lost or at least obfuscated.
 
-Also, make sure that the configuration file includes the Bookkeeping URL and there is an env var `QC_BKP_CLIENT_TOKEN` with authentication token for setups external to P2.
+To allow QC to connect to Bookkeeping, include the its URL in the QC configuration file, e.g.:
 
-Check results are converted into Flags, which are documented in [O2/DataFormats/QualityControl](https://github.com/AliceO2Group/AliceO2/tree/dev/DataFormats/QualityControl).
-Information about the object validity is preserved, which allows for time-based flagging of good/bad data.
+```json
+{
+  "qc": {
+    "config": {
+      "bookkeeping": {
+        "url": "bookkeeping.cern.ch:12345"
+      }
+    }
+  }
+}
+```
+
+For setups external to P2, one also needs to provide a BKP client token.
+It can be done by creating a file named `qc_bkp_client_token` in the working directory, containing just the token.
+In such case, please ensure minimal permissions for the file, so that it is not readable by other users.
+Alternatively, it can be provided as an environment variable `QC_BKP_CLIENT_TOKEN`.
+Then, avoid printing the environment variable in the logs.
 
 ### Conversion details