* app config bug fix:
When reading a config file that included per_dataset_config,
the dataroot specializations were applied, but not the default config.
This PR fixes that and also includes a test for this case.
* Fixes from frontend/backend url separation
This fixes the CORS and CSP headers.
Also, in thie commit, I removed the cors_supports_credentials config parameter,
which was recently introduced.
Instead, the logic determines the need to use CORS headers if the
web_page_url is set.
#1778
* separate backend base url from frontend
This is needed for auth, and to support a different location for the backend api server,
than the frontend.
part of chanzuckerberg/cellxgene#1778
new server config parameters: app__api_base_url, app__web_base_url
Also changed api_base_url in the oauth config section to "oauth_api_base_url" to
be less confusing with the app's api_base_url
Other minor changes:
changed how the jwt decode options are handled.
Previously they needed to be set in a test case, and there was some extra logic to handle that.
Now they are handled through comfig parameters, which makes it more general.
Also, add a feature to set the CORS support credentials, which seems
to be necessary for the backend/frontend separation, at least when run
locally. This part is sort of experimental, and may be removed or changed later.
When generating a config file, you can do this:
> cellxgene launch --dump-default-config > myconfig.yaml
And then modify the myconfig.yaml.
However, if an upgrade is available then you would get extra lines in the yaml
file, which are not yaml code:
There's a new version of cellxgene available (0.16.4)!
To upgrade, run the following: pip install --upgrade cellxgene
To solve this problem, the upgrade messages are sent to stderr instead,
so they will appear on the screen and not in the config file.
Alternatives:
One workaround is "cellxgene --no-upgrade-check launch --dump-default-config > myconfig.yaml"
But that's a bit verbose and not user friendly.
The way we've setup the upgrade check to be separate and before the launch sub command,
makes other code changes more involved.
#1826
* Fix frontend mishandling of null userinfo
If the authentication is disabled, the userinfo endpoint returns null.
This case needs to be handled.
#1780
* Small fix for handling refesh tokens in auth
* save tiledb array to s3, dont cache user annotations
* Add option to disable annotation filename prompt (#1787)
Co-authored-by: Madison Dunitz <dunitzm@gmail.com>
* set tiledb default context in cxg_adaptor
Co-authored-by: maniarathi <arathi.mani@chanzuckerberg.com>
Co-authored-by: Severiano Badajoz <sbadajoz@chanzuckerberg.com>
* Handle the refresh token in oauth authentication
If the token has expired, then it can be refreshed to get a new token.
This is automatically handled by the server without the client being aware.
Also in the PR:
- refactor the auth_oauth.py file to more simply handle the save/restore of the token,
and the refresh token
- added an end2end test for oauth, which also tests refresh.
* adding python-jose and Authlib to requirements-dev.txt
They are needed in the auth_oauth test
* Separate userinfo from the config endpoint
previously information about if the user was logged in and their username
was part of the config endpoint.
However, the config endpoint was previously static, and has a cache control.
Rather than not caching the config, a new endpoint called "userinfo"
is created to handle that information.
The config endpoint still has the non-changing part of the authentication:
config:
authentication:
requires_client_login: True/False
login: <uri to login endoint if requires_client_login is True>
logout: <uri to logout endoint if requires_client_login is True>
The userinfo endpoint returns this information:
userinfo:
is_authenticated: True/False
username: <string if is_authenticated>
if authentication is not enabled then the config does not have an authentication key,
and userinfo returns None.
Also in the PR are a few minor code improvements and bug fixes
Co-authored-by: Colin Megill <colinmegill@gmail.com>
* Fix error message when datapath and dataroot are not provided
Previously:
$ cellxgene launch
cellxgene] Starting the CLI...
AttributeError: 'NoneType' object has no attribute 'startswith'
With this fix:
$ cellxgene launch
[cellxgene] Starting the CLI...
Error: missing datapath
* lint
* add disclaimer about changing the script
* add hash for obsolete browser script
* add explicit domain img-src
* add single quotes
* add quotes to `data:`
* change order and remove single quotes
* lint, remove extra slash, and make hash an array
* add links to S3
* surround script has in single quotes
* fix logout for auth0
the redirect from logout needs to be registered, and therefore cannot
be an arbitrary path in the server. When the user logs out, they are
redirected to the index page
* no need to provide dataset to logout url
* oauth support, add the token in a configuration specified cookie
Previously, the id token was stored in the session token.
Now, it can be placed in a different cookie with different properties.
* add oauth authentication
Add support for OAuth2.
Change the interface to AuthTypeBase
- better handling of config parameters
- add a complete_setup function for additional setup steps
Added a function wrapper to enforce authentication for the
routes that require authenticaiton.
* change fsspec requirement
fsspec 0.8.0 breaks our tests
it imports a module that is does not require.
* Add basic authentication in the server
A pattern for creating authentication methods is introduced, with three
authentication types defined:
none - no authentication
session - like the current session based auth used for user annotations
test - used to test the login/logout process end to end
The config endpoint now returns informations about the authentication, like if
the user is authenticated and their username. The redirect uri's for login and
logout are also returned if the authentication type requires login
This is the first a several PRs for authentication.
*. Update server tests to avoid hardcoded ports
test_api and test_nan_rest now use a common function for starting a test server,
than will initially choose a random port.
