[zh2311] Remove auth (#2427)

* remove auth

* Remove all auth code

zh2311

* lint

* remove auth from e2e tests conf

backend/server/common/annotations/local_file_csv.py

@@ -6,9 +6,10 @@ from datetime import datetime
 from hashlib import blake2b
 
 import pandas as pd
-from flask import session, has_request_context, current_app
+from flask import session
 
 from backend.server import __version__ as cellxgene_version
+from backend.server.app.session import get_user_id
 from backend.server.common.annotations.annotations import Annotations
 from backend.common.genesets import read_gene_sets_tidycsv
 from backend.common.errors import AnnotationsError, ObsoleteRequest
@@ -60,10 +61,6 @@ class AnnotationsLocalFile(Annotations):
     def read_labels(self, data_adaptor):
         self.check_user_annotations_enabled()  # raises
 
-        if has_request_context():
-            if not current_app.auth.is_user_authenticated():
-                return pd.DataFrame()
-
         fname = self._get_celllabels_filename(data_adaptor)
         with self.label_lock:
             if fname is not None and os.path.exists(fname) and os.path.getsize(fname) > 0:
@@ -111,10 +108,6 @@ class AnnotationsLocalFile(Annotations):
             self.last_labels = df
 
     def read_gene_sets(self, data_adaptor, context=None):
-        if has_request_context():
-            if not current_app.auth.is_user_authenticated():
-                return ({}, self.last_geneset_tid)
-
         fname = self._get_genesets_filename(data_adaptor)
         gene_sets = {}
         tid = None
@@ -177,7 +170,7 @@ class AnnotationsLocalFile(Annotations):
         Return a short hash that weakly identifies the user and dataset.
         Used to create safe annotations output file names.
         """
-        uid = current_app.auth.get_user_id() or ""
+        uid = get_user_id(session)
         id = (uid + data_adaptor.get_location()).encode()
         idhash = base64.b32encode(blake2b(id, digest_size=5).digest()).decode("utf-8")
         return idhash
@@ -275,7 +268,6 @@ class AnnotationsLocalFile(Annotations):
             params["annotations-data-collection-is-read-only"] = not self.user_annotations_enabled()
             params["annotations-data-collection-name"] = collection
 
-        if current_app.auth.is_user_authenticated():
-            params["annotations-user-data-idhash"] = self._get_userdata_idhash(data_adaptor)
+        params["annotations-user-data-idhash"] = self._get_userdata_idhash(data_adaptor)
 
         parameters.update(params)

backend/server/common/config/base_config.py

@@ -22,13 +22,13 @@ class BaseConfig(object):
     def create_mapping(self, config):
         """
         Create a dictionary where the keys are the name of attributes (using double underscore convention)
-        For example: authentication__type
+        For example: app__host
 
         The values are a tuple,
         - the first item of the tuple is a tuple of path elements (location in config 'tree')
         - the second item is the value of the config parameter
 
-        For example: (('authentication', 'type'), 'session'))
+        For example: (("app", "host"), "session"))
         """
         config_copy = copy.deepcopy(config)
         mapping = {}

backend/server/common/config/client_config.py

@@ -9,7 +9,6 @@ def get_client_config(app_config, data_adaptor):
     server_config = app_config.server_config
     dataset_config = data_adaptor.dataset_config
     annotation = dataset_config.user_annotations
-    auth = server_config.auth
 
     # FIXME The current set of config is not consistently presented:
     # we have camalCase, hyphen-text, and underscore_text
@@ -79,41 +78,4 @@ def get_client_config(app_config, data_adaptor):
         "diffexp_cellcount_max": server_config.limits__diffexp_cellcount_max,
     }
 
-    if dataset_config.app__authentication_enable and auth.is_valid_authentication_type():
-        config["authentication"] = {
-            "requires_client_login": auth.requires_client_login(),
-        }
-        if auth.requires_client_login():
-            config["authentication"].update(
-                {
-                    # Todo why are these stored on the data_adaptor?
-                    "login": auth.get_login_url(data_adaptor),
-                    "logout": auth.get_logout_url(data_adaptor),
-                }
-            )
-
     return client_config
-
-
-def get_client_userinfo(app_config, data_adaptor):
-    """
-    Return the userinfo as required by the /userinfo REST route
-    """
-
-    server_config = app_config.server_config
-    dataset_config = data_adaptor.dataset_config
-    auth = server_config.auth
-
-    # make sure the configuration has been checked.
-    app_config.check_config()
-
-    if dataset_config.app__authentication_enable and auth.is_valid_authentication_type():
-        userinfo = {}
-        userinfo["userinfo"] = {
-            "is_authenticated": auth.is_user_authenticated(),
-            "username": auth.get_user_name(),
-            "user_id": auth.get_user_id(),
-            "email": auth.get_user_email(),
-            "picture": auth.get_user_picture(),
-        }
-        return userinfo

backend/server/common/config/dataset_config.py

@@ -16,7 +16,6 @@ class DatasetConfig(BaseConfig):
         try:
             self.app__scripts = default_config["app"]["scripts"]
             self.app__inline_scripts = default_config["app"]["inline_scripts"]
-            self.app__authentication_enable = default_config["app"]["authentication_enable"]
 
             self.presentation__max_categories = default_config["presentation"]["max_categories"]
             self.presentation__custom_colors = default_config["presentation"]["custom_colors"]
@@ -65,7 +64,6 @@ class DatasetConfig(BaseConfig):
     def handle_app(self):
         self.validate_correct_type_of_configuration_attribute("app__scripts", list)
         self.validate_correct_type_of_configuration_attribute("app__inline_scripts", list)
-        self.validate_correct_type_of_configuration_attribute("app__authentication_enable", bool)
 
         # scripts can be string (filename) or dict (attributes). Convert string to dict.
         scripts = []
@@ -100,14 +98,6 @@ class DatasetConfig(BaseConfig):
         )
         self.validate_correct_type_of_configuration_attribute("user_annotations__gene_sets__readonly", bool)
 
-        if self.user_annotations__enable or not self.user_annotations__gene_sets__readonly:
-            server_config = self.app_config.server_config
-            if not self.app__authentication_enable:
-                raise ConfigurationError("user annotations requires authentication to be enabled")
-            if not server_config.auth.is_valid_authentication_type():
-                auth_type = server_config.authentication__type
-                raise ConfigurationError(f"authentication method {auth_type} is not compatible with user annotations")
-
         # Must always have an annotations instance to support genesets. User annotation (cell labels) are optional
         # as are writable gene sets
         if self.user_annotations__type == "local_file_csv":

backend/server/common/config/server_config.py

@@ -4,7 +4,6 @@ import warnings
 from os.path import basename
 from urllib.parse import urlparse
 
-from backend.server.auth.auth import AuthTypeFactory
 from backend.server.common.config.base_config import BaseConfig
 from backend.server.common.config import DEFAULT_SERVER_PORT, BIG_FILE_SIZE_THRESHOLD
 from backend.common.utils.data_locator import discover_s3_region_name
@@ -29,11 +28,6 @@ class ServerConfig(BaseConfig):
             self.app__flask_secret_key = default_config["app"]["flask_secret_key"]
             self.app__generate_cache_control_headers = default_config["app"]["generate_cache_control_headers"]
 
-            self.authentication__type = default_config["authentication"]["type"]
-            self.authentication__insecure_test_environment = default_config["authentication"][
-                "insecure_test_environment"
-            ]
-
             self.single_dataset__datapath = default_config["single_dataset"]["datapath"]
             self.single_dataset__obs_names = default_config["single_dataset"]["obs_names"]
             self.single_dataset__var_names = default_config["single_dataset"]["var_names"]
@@ -52,13 +46,9 @@ class ServerConfig(BaseConfig):
 
         self.data_adaptor = None
 
-        # The authentication object
-        self.auth = None
-
     def complete_config(self, context):
         self.handle_app(context)
         self.handle_data_source()
-        self.handle_authentication()
         self.handle_data_locator()
         self.handle_adaptor()  # may depend on data_locator
         self.handle_single_dataset(context)  # may depend on adaptor
@@ -106,17 +96,6 @@ class ServerConfig(BaseConfig):
         if not self.app__verbose:
             sys.tracebacklimit = 0
 
-    def handle_authentication(self):
-        self.validate_correct_type_of_configuration_attribute("authentication__type", (type(None), str))
-        self.validate_correct_type_of_configuration_attribute("authentication__insecure_test_environment", bool)
-
-        if self.authentication__type == "test" and not self.authentication__insecure_test_environment:
-            raise ConfigurationError("Test auth can only be used in an insecure test environment")
-
-        self.auth = AuthTypeFactory.create(self.authentication__type, self)
-        if self.auth is None:
-            raise ConfigurationError(f"Unknown authentication type: {self.authentication__type}")
-
     def handle_data_locator(self):
         self.validate_correct_type_of_configuration_attribute("data_locator__s3__region_name", (type(None), bool, str))
         if self.data_locator__s3__region_name is True:

backend/server/common/rest.py

@@ -8,7 +8,7 @@ import json
 from flask import make_response, jsonify, current_app, abort
 from werkzeug.urls import url_unquote
 
-from backend.server.common.config.client_config import get_client_config, get_client_userinfo
+from backend.server.common.config.client_config import get_client_config
 from backend.common.constants import Axis, DiffExpMode, JSON_NaN_to_num_warning_msg
 from backend.common.errors import (
     FilterError,
@@ -126,11 +126,6 @@ def config_get(app_config, data_adaptor):
     return make_response(jsonify(config), HTTPStatus.OK)
 
 
-def userinfo_get(app_config, data_adaptor):
-    config = get_client_userinfo(app_config, data_adaptor)
-    return make_response(jsonify(config), HTTPStatus.OK)
-
-
 def annotations_obs_get(request, data_adaptor):
     fields = request.args.getlist("annotation-name", None)
     num_columns_requested = len(data_adaptor.get_obs_keys()) if len(fields) == 0 else len(fields)