Validate ui request via auth token instead of auth strategy

https://bugzilla.redhat.com/show_bug.cgi?id=1632416

app/controllers/api/mixins/service_templates.rb

@@ -17,16 +17,6 @@ def order_service_template(id, data, scheduled_time = nil)
 
       private
 
-      def request_from_ui?
-        return false if request.headers["x-auth-token"].blank?
-        token_info.present?
-      end
-
-      def token_info
-        requester_type = params['requester_type'] || 'api'
-        Environment.user_token_service.token_mgr(requester_type).token_get_info(request.headers["x-auth-token"])
-      end
-
       def service_template_ident(st)
         "Service Template id:#{st.id} name:'#{st.name}'"
       end
@@ -37,7 +27,13 @@ def api_request_allowed?
       end
 
       def request_from_ui?
-        !request.authorization.try(:downcase).try(:starts_with?, "basic")
+        return false if request.headers["x-auth-token"].blank?
+        !token_info.empty?
+      end
+
+      def token_info
+        requester_type = params['requester_type'] || 'api'
+        Environment.user_token_service.token_mgr(requester_type).token_get_info(request.headers["x-auth-token"])
       end
     end
   end

spec/requests/service_catalogs_spec.rb

@@ -377,6 +377,9 @@ def sc_template_url(id, st_id = nil)
 
     before do
       stub_settings_merge(:product => double(:allow_api_service_ordering => true))
+      userid = User.first.userid
+      test_token = Api::UserTokenService.new.generate_token(userid, "api")
+      request_headers["x-auth-token"] = test_token
     end
 
     def init_st(service_template, resource_action)

spec/requests/service_templates_spec.rb

@@ -471,6 +471,9 @@
 
     before do
       stub_settings_merge(:product => product_settings)
+      userid = User.first.userid
+      test_token = Api::UserTokenService.new.generate_token(userid, "api")
+      request_headers["x-auth-token"] = test_token
     end
 
     it "is forbidden without appropriate role" do
@@ -585,10 +588,13 @@
 
     context "with the product setting not allowing automate to run on submit" do
       let(:template_no_display) { FactoryGirl.create(:service_template, :display => false) }
+      let(:allow_api_service_ordering) { false }
+
       context "if the token info is blank" do
         before do
           request_headers["x-auth_token"] = ""
         end
+
         it "rejects the request" do
           api_basic_authorize action_identifier(:service_templates, :order, :resource_actions, :post)
           post(api_service_template_url(nil, template_no_display), :params => { :action => "order" })