Repository: StackStorm/st2

Issue:
`st2 workflow inspect` does not pass auth token to API
##### SUMMARY

`st2 workflow inspect` does not pass the `X-Auth-Token` when making a `POST` call. This results in error messages, making the command unusable. 

##### ISSUE TYPE
 - Bug Report

##### STACKSTORM VERSION
`st2 3.0dev (c592795), on Python 2.7.12`

##### OS / ENVIRONMENT / INSTALL METHOD

one-line install on Ubuntu 16.04, using unstable repos. Same behavior observed on 2.10.4.

##### STEPS TO REPRODUCE

```sh
extreme@ubuntu:~$ st2 whoami
Currently logged in as "st2admin".

Authentication method: authentication token
Authentication token expire time: 2019-03-29T18:43:55Z

RBAC:
 - Enabled: True
 - Roles: system_admin
extreme@ubuntu:~$ st2 workflow inspect --action st2ci.teardown_st2
ERROR: 401 Client Error: Unauthorized
MESSAGE: Unauthorized - One of Token or API key required. for url: http://127.0.0.1:9101/v1/workflows/inspect

extreme@ubuntu:~$
```

Similar results seen with `st2 workflow inspect --file /opt/stackstorm/packs/st2ci/actions/workflows/teardown_st2.yaml`

##### EXPECTED RESULTS

Expected some sort of "OK" or "Validation failed: <reasons>" message.

##### ACTUAL RESULTS

```sh
ERROR: 401 Client Error: Unauthorized
MESSAGE: Unauthorized - One of Token or API key required. for url: http://127.0.0.1:9101/v1/workflows/inspect
```

Looking more closely, we can see that the first `curl` GET call passes X-Auth-Token, but the POST call doesn't:

```sh
extreme@ubuntu:~$ st2 --debug workflow inspect --action st2ci.teardown_st2 2>/dev/null|grep curl
curl -X GET -H  'Connection: keep-alive' -H  'Accept-Encoding: gzip, deflate' -H  'Accept: */*' -H  'User-Agent: python-requests/2.14.2' -H  'X-Auth-Token: fd9a42517802405d907e7f23c7921a1e' http://127.0.0.1:9101/v1/actions/st2ci.teardown_st2
curl -X POST -H  'Connection: keep-alive' -H  'Accept-Encoding: gzip, deflate' -H  'Accept: */*' -H  'User-Agent: python-requests/2.14.2' -H  'content-type: text/plain' -H  'Content-Length: 819' --data-binary '---
extreme@ubuntu:~$
```

If we manually insert the Auth Token, it works:

```sh
extreme@ubuntu:~$ curl -X POST -H  'Connection: keep-alive' -H  'Accept-Encoding: gzip, deflate' -H  'Accept: */*' -H  'User-Agent: python-requests/2.14.2' -H  'content-type: text/plain' -H  'Content-Length: 819' -H  'X-Auth-Token: fd9a42517802405d907e7f23c7921a1e' --data-binary '---
> version: '"'"'1.0'"'"'
> description: Teardown a running instance of StackStorm.
> input:
>   - host
>   - repo
> tasks:
>   stop_service:
>     action: core.remote
>     input:
>       hosts: <% ctx().host %>
>       cmd: <% ctx().repo %>/tools/launchdev.sh stop || true
>     next:
>       - do:
>           - teardown_db
>   teardown_db:
>     action: core.remote
>     input:
>       hosts: <% ctx().host %>
>       cmd: mongo st2 --eval "db.dropDatabase();"
>     next:
>       - when: <% succeeded() %>
>         do:
>           - remove_packs
>   remove_packs:
>     action: core.remote_sudo
>     input:
>       hosts: <% ctx().host %>
>       cmd: rm -rf /opt/stackstorm/packs
>     next:
>       - when: <% succeeded() %>
>         do:
>           - remove_repo
>   remove_repo:
>     action: st2cd.git_clean
>     input:
>       hosts: <% ctx().host %>
>       repo: <% ctx().repo %>
> ' http://127.0.0.1:9101/v1/workflows/inspect
[]extreme@ubuntu:~$
```

I also observed that `st2 workflow inspect` does not allow passing `--token` or `--api-key` the way other `st2 <blah>` commands do. 

My guess is that the problem is somewhere around [here](https://github.com/StackStorm/st2/pull/4320/files#diff-54a4215e9f3a3b420a1b8e629c211716). 

Probably needs something like this added https://github.com/StackStorm/st2/blob/master/st2client/st2client/commands/action.py#L259


Discussion:
Actually I think the problem is about here: https://github.com/StackStorm/st2/blob/master/st2client/st2client/models/core.py#L668

```python
    def inspect(self, definition, **kwargs):
        url = '/inspect'
```

should be

```python
    @add_auth_token_to_kwargs_from_env
    def inspect(self, definition, **kwargs):
        url = '/inspect'
```
Yeah, also missing that decorator on the ``run`` method inside the class.

Resolving patch:
diff --git a/st2client/st2client/commands/workflow.py b/st2client/st2client/commands/workflow.py
--- a/st2client/st2client/commands/workflow.py
+++ b/st2client/st2client/commands/workflow.py
@@ -21,6 +21,7 @@
 import yaml
 
 from st2client import commands
+from st2client.commands.resource import add_auth_token_to_kwargs_from_cli
 
 
 LOG = logging.getLogger(__name__)
@@ -79,6 +80,7 @@ def get_file_content(self, file_path):
 
         return content
 
+    @add_auth_token_to_kwargs_from_cli
     def run(self, args, **kwargs):
         wf_def_file = args.file
 
@@ -98,6 +100,7 @@ def run(self, args, **kwargs):
 
         return self.manager.inspect(wf_def, **kwargs)
 
+    @add_auth_token_to_kwargs_from_cli
     def run_and_print(self, args, **kwargs):
         errors = self.run(args, **kwargs)
 
diff --git a/st2client/st2client/models/core.py b/st2client/st2client/models/core.py
--- a/st2client/st2client/models/core.py
+++ b/st2client/st2client/models/core.py
@@ -665,6 +665,7 @@ def handle_error(response):
 
         response.raise_for_status()
 
+    @add_auth_token_to_kwargs_from_env
     def inspect(self, definition, **kwargs):
         url = '/inspect'
 


Test patch: