diracx 0.0.1a49__tar.gz → 0.0.1a50__tar.gz

diracx-0.0.1a50/.github/workflows/generate_pixi_tasks_doc.py

@@ -0,0 +1,61 @@
+from __future__ import annotations
+
+import json
+import subprocess
+from collections import defaultdict
+
+
+def get_task_group(task_name):
+    if task_name.startswith("pytest-diracx"):
+        return "DiracX"
+    if task_name.startswith("pytest-gubbins"):
+        return "Gubbins"
+    if task_name.startswith("mkdocs"):
+        return "Documentation"
+    if task_name == "pre-commit":
+        return "Pre-commit"
+    if task_name == "generate-client":
+        return "Client Generation"
+    if task_name == "shellcheck":
+        return "Shellcheck"
+    return "Default"
+
+
+def main():
+    """Generate the pixi-tasks.md file."""
+    result = subprocess.run(
+        ["pixi", "task", "list", "--json"],  # noqa: S607
+        capture_output=True,
+        text=True,
+    )
+    environments = json.loads(result.stdout)
+
+    tasks_by_group = defaultdict(list)
+    for env in environments:
+        for feature in env["features"]:
+            for task in feature["tasks"]:
+                group = get_task_group(task["name"])
+                tasks_by_group[group].append(task)
+
+    with open("docs/dev/reference/pixi-tasks.md", "w") as f:
+        f.write("# Pixi Tasks\n\n")
+        f.write("*This page is auto-generated. Do not edit directly.*\n\n")
+        f.write("DiracX uses [Pixi](https://pixi.dev/) as package manager\n")
+        f.write("This page documents the available pixi tasks.\n\n")
+
+        for group in sorted(tasks_by_group.keys()):
+            f.write(f"## {group} Tasks\n\n")
+            # Remove duplicates
+            tasks = list({v["name"]: v for v in tasks_by_group[group]}.values())
+            for task in sorted(tasks, key=lambda x: x["name"]):
+                description = (
+                    task.get("description") or task.get("cmd") or "No description"
+                )
+                f.write(f"- `{task['name']}`: {description}\n")
+            f.write("\n")
+
+        f.write("Generated by .github/workflows/generate_pixi_tasks_doc.py\n")
+
+
+if __name__ == "__main__":
+    main()

{diracx-0.0.1a49 → diracx-0.0.1a50}/.github/workflows/main.yml

@@ -13,7 +13,6 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-
   shellcheck:
     runs-on: ubuntu-latest
     steps:

{diracx-0.0.1a49 → diracx-0.0.1a50}/.pre-commit-config.yaml

@@ -7,6 +7,9 @@ default_install_hook_types:
 default_language_version:
   python: python3
 
+ci:
+  skip: [generate-pixi-docs]
+
 default_stages: [pre-commit]
 
 repos:
@@ -27,14 +30,14 @@ repos:
       - id: check-added-large-files
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 'v0.12.11'
+    rev: 'v0.13.0'
     hooks:
       - id: ruff
         args: ["--fix", "--show-fixes"]
       - id: ruff-format
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.17.1
+    rev: v1.18.1
     hooks:
       - id: mypy
         additional_dependencies:
@@ -71,3 +74,12 @@ repos:
         entry: '(?i)lollygag'
         language: pygrep
         files: ^diracx
+
+  - repo: local
+    hooks:
+      - id: generate-pixi-docs
+        name: Generate pixi tasks documentation
+        entry: pixi run -e default python .github/workflows/generate_pixi_tasks_doc.py
+        language: system
+        pass_filenames: false
+        files: ^pixi\.toml$|^pixi\.lock$   # only run if pixi files change

{diracx-0.0.1a49 → diracx-0.0.1a50}/.readthedocs.yaml

@@ -8,9 +8,17 @@
    # This is just a quick example to get started.
    # https://docs.readthedocs.io/page/guides/reproducible-builds.html
    jobs:
-     pre_install:
-       - pip install mkdocs-material
-       - pip install mkdocs-diracx-plugin@git+https://github.com/DIRACGrid/mkdocs-diracx-plugin
+      create_environment:
+        - asdf plugin add pixi
+        - asdf install pixi latest
+        - asdf global pixi latest
+
+      install:
+        - pixi install -e mkdocs
+
+      build:
+        html:
+          - pixi run -e mkdocs mkdocs-build --site-dir $READTHEDOCS_OUTPUT/html
 
  mkdocs:
    configuration: mkdocs.yml

{diracx-0.0.1a49 → diracx-0.0.1a50}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: diracx
-Version: 0.0.1a49
+Version: 0.0.1a50
 Summary: Client installation for users of DiracX installations
 License: GPL-3.0-only
 License-File: LICENSE

{diracx-0.0.1a49 → diracx-0.0.1a50}/diracx-core/pyproject.toml

@@ -23,7 +23,7 @@ dependencies = [
     "pydantic-settings",
     "pyyaml",
     "sh",
-    "diraccommon >=9.0.0a67",
+    "diraccommon >=9.0.0",
 ]
 dynamic = ["version"]
 

{diracx-0.0.1a49 → diracx-0.0.1a50}/diracx-core/src/diracx/core/config/schema.py

@@ -147,20 +147,29 @@ class JobDescriptionConfig(BaseModel):
     AllowedJobTypes: list[str] = ["User", "Test", "Hospital"]
 
 
-class InputDataPolicyConfig(BaseModel):
-    InputDataModule: str = "LocalInputData"
+class InputDataPolicyProtocolsConfig(BaseModel):
+    Remote: list[str] = []
+    Local: list[str] = []
 
 
-class ExternalsPolicyConfig(BaseModel):
-    SoftwareDistModule: str = "LocalSoftwareDist"
+class InputDataPolicyConfig(BaseModel):
+    # TODO: Remove this once the model is extended to support everything
+    model_config = ConfigDict(extra="ignore", frozen=True)
+
+    Default: str = "Default = DIRAC.WorkloadManagementSystem.Client.InputDataByProtocol"
+    Download: str = "DIRAC.WorkloadManagementSystem.Client.DownloadInputData"
+    Protocol: str = "DIRAC.WorkloadManagementSystem.Client.InputDataByProtocol"
+    AllReplicas: bool = True
+    Protocols: InputDataPolicyProtocolsConfig = InputDataPolicyProtocolsConfig()
+    InputDataModule: str = "DIRAC.Core.Utilities.InputDataResolution"
 
 
 class OperationsConfig(BaseModel):
     EnableSecurityLogging: bool = False
-    ExternalsPolicy: ExternalsPolicyConfig = ExternalsPolicyConfig()
     InputDataPolicy: InputDataPolicyConfig = InputDataPolicyConfig()
     JobDescription: JobDescriptionConfig = JobDescriptionConfig()
     Services: ServicesConfig = ServicesConfig()
+    SoftwareDistModule: str = "LocalSoftwareDist"
 
     Cloud: MutableMapping[str, Any] | None = None
     DataConsistency: MutableMapping[str, Any] | None = None

{diracx-0.0.1a49 → diracx-0.0.1a50}/diracx-db/src/diracx/db/sql/auth/schema.py

@@ -10,7 +10,12 @@ from sqlalchemy import (
 )
 from sqlalchemy.orm import declarative_base
 
-from diracx.db.sql.utils import Column, DateNowColumn, EnumColumn, NullColumn
+from diracx.db.sql.utils import (
+    Column,
+    DateNowColumn,
+    EnumColumn,
+    NullColumn,
+)
 
 USER_CODE_LENGTH = 8
 
@@ -92,7 +97,6 @@ class RefreshTokens(Base):
     status = EnumColumn(
         "Status", RefreshTokenStatus, server_default=RefreshTokenStatus.CREATED.name
     )
-    creation_time = DateNowColumn("CreationTime", index=True)
     scope = Column("Scope", String(1024))
 
     # User attributes bound to the refresh token

{diracx-0.0.1a49 → diracx-0.0.1a50}/diracx-db/src/diracx/db/sql/utils/__init__.py

@@ -1,16 +1,6 @@
 from __future__ import annotations
 
-from .base import (
-    BaseSQLDB,
-    SQLDBUnavailableError,
-    _get_columns,
-    apply_search_filters,
-    apply_sort_constraints,
-)
-from .functions import hash, substract_date, utcnow
-from .types import Column, DateNowColumn, EnumBackedBool, EnumColumn, NullColumn
-
-__all__ = (
+__all__ = [
     "_get_columns",
     "utcnow",
     "Column",
@@ -24,4 +14,18 @@ __all__ = (
     "substract_date",
     "hash",
     "SQLDBUnavailableError",
+    "uuid7_from_datetime",
+    "uuid7_to_datetime",
+]
+
+from .base import (
+    BaseSQLDB,
+    SQLDBUnavailableError,
+    _get_columns,
+    apply_search_filters,
+    apply_sort_constraints,
+    uuid7_from_datetime,
+    uuid7_to_datetime,
 )
+from .functions import hash, substract_date, utcnow
+from .types import Column, DateNowColumn, EnumBackedBool, EnumColumn, NullColumn

{diracx-0.0.1a49 → diracx-0.0.1a50}/diracx-db/src/diracx/db/sql/utils/base.py

@@ -7,13 +7,15 @@ import re
 from abc import ABCMeta
 from collections.abc import AsyncIterator
 from contextvars import ContextVar
-from datetime import datetime
+from datetime import datetime, timezone
 from typing import Any, Self, cast
+from uuid import UUID as StdUUID  # noqa: N811
 
 from pydantic import TypeAdapter
 from sqlalchemy import DateTime, MetaData, func, select
 from sqlalchemy.exc import OperationalError
 from sqlalchemy.ext.asyncio import AsyncConnection, AsyncEngine, create_async_engine
+from uuid_utils import UUID, uuid7
 
 from diracx.core.exceptions import InvalidQueryError
 from diracx.core.extensions import select_from_extension
@@ -416,3 +418,33 @@ def apply_sort_constraints(column_mapping, stmt, sorts):
     if sort_columns:
         stmt = stmt.order_by(*sort_columns)
     return stmt
+
+
+def uuid7_to_datetime(uuid: UUID | StdUUID | str) -> datetime:
+    """Convert a UUIDv7 to a datetime."""
+    if isinstance(uuid, StdUUID):
+        # Convert stdlib UUID to uuid_utils.UUID
+        uuid = UUID(str(uuid))
+    elif not isinstance(uuid, UUID):
+        # Convert string or other types to uuid_utils.UUID
+        uuid = UUID(uuid)
+    if uuid.version != 7:
+        raise ValueError(f"UUID {uuid} is not a UUIDv7")
+    return datetime.fromtimestamp(uuid.timestamp / 1000.0, tz=timezone.utc)
+
+
+def uuid7_from_datetime(dt: datetime, *, randomize: bool = True) -> UUID:
+    """Generate a UUIDv7 corresponding to the given datetime.
+
+    If randomize is True, the standard uuid7 function is used resulting in the
+    lowest 62-bits being random. If randomize is False, the UUIDv7 will be the
+    lowest possible UUIDv7 for the given datetime.
+    """
+    timestamp = dt.timestamp()
+    if randomize:
+        uuid = uuid7(int(timestamp), int((timestamp % 1) * 1e9))
+    else:
+        time_high = int(timestamp * 1000) >> 16
+        time_low = int(timestamp * 1000) & 0xFFFF
+        uuid = UUID.from_fields((time_high, time_low, 0x7000, 0x80, 0, 0))
+    return uuid

{diracx-0.0.1a49 → diracx-0.0.1a50}/diracx-db/tests/auth/test_refresh_token.py

@@ -56,7 +56,6 @@ async def test_get(auth_db: AuthDB):
             refresh_token_details["sub"],
             refresh_token_details["scope"],
         )
-        creation_time = (await auth_db.get_refresh_token(jti))["CreationTime"]
 
     # Enrich the dict with the generated refresh token attributes
     expected_refresh_token = {
@@ -64,7 +63,6 @@ async def test_get(auth_db: AuthDB):
         "Scope": refresh_token_details["scope"],
         "JTI": jti,
         "Status": RefreshTokenStatus.CREATED,
-        "CreationTime": creation_time,
     }
 
     # Get refresh token details

diracx-0.0.1a50/diracx-db/tests/utils/test_uuid.py

@@ -0,0 +1,221 @@
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+from uuid import UUID as StdUUID  # noqa: N811
+
+import freezegun
+import pytest
+from uuid_utils import UUID, uuid7
+
+from diracx.db.sql.utils import uuid7_from_datetime, uuid7_to_datetime
+
+
+def frozen_uuid7() -> UUID:
+    """Create a UUID7 in a way which respects the freezegun context."""
+    timestamp = datetime.now(tz=timezone.utc).timestamp()
+    return uuid7(int(timestamp), int((timestamp % 1) * 1e9))
+
+
+class TestDatetimeToUuid7:
+    """Test cases for the datetime_to_uuid7 function."""
+
+    def test_datetime_to_uuid7_random(self):
+        """Test that the datetime_to_uuid7 function returns a UUID7 with the current timestamp."""
+        dt = datetime.fromisoformat("2024-01-15T12:30:45.123456+00:00")
+        result = uuid7_from_datetime(dt, randomize=True)
+        assert str(result)[:15] == "018d0d1a-5183-7"
+        assert len(set(str(result)[15:])) > 4
+
+    def test_datetime_to_uuid7_deterministic(self):
+        """Test that the datetime_to_uuid7 function returns a UUID7 with the current timestamp."""
+        dt = datetime.fromisoformat("2024-01-15T12:30:45.123456+00:00")
+        result = uuid7_from_datetime(dt, randomize=False)
+        assert str(result) == "018d0d1a-5183-7000-8000-000000000000"
+
+
+class TestUuid7ToDatetime:
+    """Test cases for the uuid7_to_datetime function."""
+
+    def test_uuid7_now(self):
+        """Test that the uuid7 function returns a UUID7 with the current timestamp."""
+        test_uuid = frozen_uuid7()
+        result = uuid7_to_datetime(test_uuid)
+        assert result.tzinfo == timezone.utc
+        assert result - datetime.now(tz=timezone.utc) < timedelta(milliseconds=2)
+
+    @freezegun.freeze_time("2024-01-15 12:30:45.123456")
+    def test_uuid7_to_datetime_with_uuid_utils_uuid(self):
+        """Test conversion with uuid_utils.UUID object."""
+        test_uuid = frozen_uuid7()
+        result = uuid7_to_datetime(test_uuid)
+
+        assert isinstance(result, datetime)
+        assert result.tzinfo == timezone.utc
+        assert result.isoformat() == "2024-01-15T12:30:45.123000+00:00"
+
+    @freezegun.freeze_time("2024-01-15 12:30:45.123456")
+    def test_uuid7_to_datetime_with_stdlib_uuid(self):
+        """Test conversion with standard library UUID object."""
+        test_uuid = frozen_uuid7()
+        stdlib_uuid = StdUUID(str(test_uuid))
+
+        result = uuid7_to_datetime(stdlib_uuid)
+        assert isinstance(result, datetime)
+        assert result.tzinfo == timezone.utc
+
+    @freezegun.freeze_time("2024-01-15 12:30:45.123456")
+    def test_uuid7_to_datetime_with_string_uuid(self):
+        """Test conversion with string UUID that gets converted to uuid_utils.UUID."""
+        test_uuid = frozen_uuid7()
+        uuid_string = str(test_uuid)
+
+        result = uuid7_to_datetime(uuid_string)
+        assert isinstance(result, datetime)
+        assert result.tzinfo == timezone.utc
+
+    @freezegun.freeze_time("2024-01-15 12:30:45.123456")
+    def test_uuid7_to_datetime_precision(self):
+        """Test that the conversion maintains reasonable precision."""
+        test_uuid = frozen_uuid7()
+        result = uuid7_to_datetime(test_uuid)
+
+        assert isinstance(result, datetime)
+        assert result.tzinfo == timezone.utc
+        assert result.isoformat() == "2024-01-15T12:30:45.123000+00:00"
+
+    @freezegun.freeze_time("1970-01-01 00:00:00.000000")
+    def test_uuid7_to_datetime_epoch_boundary(self):
+        """Test conversion with UUID7 at epoch boundary."""
+        test_uuid = frozen_uuid7()
+        result = uuid7_to_datetime(test_uuid)
+
+        assert isinstance(result, datetime)
+        assert result.tzinfo == timezone.utc
+        assert result.isoformat() == "1970-01-01T00:00:00+00:00"
+
+    @freezegun.freeze_time("2100-01-01 00:00:00.000000")
+    def test_uuid7_to_datetime_future_timestamp(self):
+        """Test conversion with future timestamp."""
+        test_uuid = frozen_uuid7()
+        result = uuid7_to_datetime(test_uuid)
+
+        assert isinstance(result, datetime)
+        assert result.tzinfo == timezone.utc
+        assert result.isoformat() == "2100-01-01T00:00:00+00:00"
+
+    @freezegun.freeze_time("2024-01-15 12:30:45.123456")
+    def test_uuid7_to_datetime_consistency(self):
+        """Test that multiple calls with the same UUID return the same result."""
+        test_uuid = frozen_uuid7()
+
+        result1 = uuid7_to_datetime(test_uuid)
+        result2 = uuid7_to_datetime(test_uuid)
+
+        assert result1.isoformat() == result2.isoformat()
+        assert result1 == result2
+
+    @freezegun.freeze_time("2024-01-15 12:30:45.123456")
+    def test_uuid7_to_datetime_different_input_types_same_result(self):
+        """Test that different input types representing the same UUID return the same result."""
+        test_uuid = frozen_uuid7()
+        uuid_string = str(test_uuid)
+        stdlib_uuid = StdUUID(uuid_string)
+
+        result_from_uuid_utils = uuid7_to_datetime(test_uuid)
+        result_from_string = uuid7_to_datetime(uuid_string)
+        result_from_stdlib = uuid7_to_datetime(stdlib_uuid)
+
+        # All results should be identical
+        assert result_from_uuid_utils == result_from_string == result_from_stdlib
+
+    def test_uuid7_to_datetime_invalid_input_type(self):
+        """Test that invalid input types raise appropriate errors."""
+        with pytest.raises(TypeError):
+            uuid7_to_datetime(123)  # type: ignore
+
+        with pytest.raises(TypeError):
+            uuid7_to_datetime(123.45)  # type: ignore
+
+        with pytest.raises(TypeError):
+            uuid7_to_datetime([])  # type: ignore
+
+        with pytest.raises(TypeError):
+            uuid7_to_datetime({})  # type: ignore
+
+    def test_uuid7_to_datetime_invalid_uuid_string(self):
+        """Test that invalid UUID strings raise appropriate errors."""
+        with pytest.raises(ValueError):
+            uuid7_to_datetime("not-a-uuid")
+
+        with pytest.raises(ValueError):
+            uuid7_to_datetime("12345")
+
+        with pytest.raises(ValueError):
+            uuid7_to_datetime("")
+
+    def test_uuid7_to_datetime_non_uuid7_uuid(self):
+        """Test behavior with non-UUID7 UUIDs."""
+        uuid4 = StdUUID("550e8400-e29b-41d4-a716-446655440000")
+
+        with pytest.raises(ValueError, match="is not a UUIDv7"):
+            uuid7_to_datetime(uuid4)
+
+    @freezegun.freeze_time("2024-01-15 12:30:45.123456")
+    def test_uuid7_to_datetime_timezone_awareness(self):
+        """Test that the returned datetime is always timezone-aware and in UTC."""
+        test_uuid = frozen_uuid7()
+        result = uuid7_to_datetime(test_uuid)
+
+        assert result.tzinfo is not None
+
+        assert result.tzinfo == timezone.utc
+
+        assert result.tzinfo.utcoffset(result) is not None
+
+    @freezegun.freeze_time("2024-01-15 12:30:45.123456")
+    def test_uuid7_to_datetime_millisecond_precision(self):
+        """Test that the conversion handles millisecond precision correctly."""
+        uuids = [frozen_uuid7() for _ in range(5)]
+        results = [uuid7_to_datetime(uuid) for uuid in uuids]
+
+        for result in results:
+            assert isinstance(result, datetime)
+            assert result.tzinfo == timezone.utc
+
+        timestamps = [r.timestamp() for r in results]
+        assert timestamps == sorted(timestamps)
+
+    @freezegun.freeze_time("2024-01-15 12:30:45.123456")
+    def test_uuid7_to_datetime_timestamp_property(self):
+        """Test that the function correctly uses the timestamp property."""
+        test_uuid = frozen_uuid7()
+        result = uuid7_to_datetime(test_uuid)
+
+        expected_timestamp = test_uuid.timestamp / 1000.0
+        actual_timestamp = result.timestamp()
+
+        assert abs(actual_timestamp - expected_timestamp) < 0.001
+
+    @freezegun.freeze_time("2024-01-15 12:30:45.123456")
+    def test_uuid7_to_datetime_deterministic_with_freeze(self):
+        """Test that the function works deterministically with freezegun."""
+        with freezegun.freeze_time("2024-01-15 12:30:45.123000"):
+            uuid1 = frozen_uuid7()
+            result1 = uuid7_to_datetime(uuid1)
+
+        with freezegun.freeze_time("2024-01-15 12:30:45.123000"):
+            uuid2 = frozen_uuid7()
+            result2 = uuid7_to_datetime(uuid2)
+
+        time_diff = abs((result1 - result2).total_seconds())
+        assert time_diff < 1.0
+
+    @freezegun.freeze_time("1970-01-01 00:00:00")
+    def test_uuid7_to_datetime_edge_case_zero_timestamp(self):
+        """Test edge case with very small timestamp values."""
+        test_uuid = frozen_uuid7()
+        result = uuid7_to_datetime(test_uuid)
+
+        assert isinstance(result, datetime)
+        assert result.tzinfo == timezone.utc
+        assert result.isoformat() == "1970-01-01T00:00:00+00:00"

{diracx-0.0.1a49 → diracx-0.0.1a50}/diracx-logic/pyproject.toml

@@ -14,7 +14,7 @@ classifiers = [
 ]
 dependencies = [
     "cachetools",
-    "diraccommon >=9.0.0a67",
+    "diraccommon >=9.0.0",
     "diracx-core",
     "diracx-db",
     "joserfc",

{diracx-0.0.1a49 → diracx-0.0.1a50}/diracx-logic/src/diracx/logic/auth/token.py

@@ -28,6 +28,7 @@ from diracx.core.properties import SecurityProperty
 from diracx.core.settings import AuthSettings
 from diracx.db.sql import AuthDB
 from diracx.db.sql.auth.schema import FlowStatus, RefreshTokenStatus
+from diracx.db.sql.utils import uuid7_to_datetime
 from diracx.db.sql.utils.functions import substract_date
 
 from .utils import (
@@ -315,12 +316,11 @@ async def exchange_token(
     # Merge the VO with the subject to get a unique DIRAC sub
     sub = f"{vo}:{sub}"
 
-    creation_time = datetime.now(timezone.utc)
     refresh_payload: RefreshTokenPayload | None = None
     if include_refresh_token:
         # Insert the refresh token with user details into the RefreshTokens table
         # User details are needed to regenerate access tokens later
-        jti, creation_time = await insert_refresh_token(
+        refresh_jti = await insert_refresh_token(
             auth_db=auth_db,
             subject=sub,
             scope=scope,
@@ -329,9 +329,12 @@ async def exchange_token(
         # Generate refresh token payload
         if refresh_token_expire_minutes is None:
             refresh_token_expire_minutes = settings.refresh_token_expire_minutes
+        refresh_exp = uuid7_to_datetime(refresh_jti) + timedelta(
+            minutes=refresh_token_expire_minutes
+        )
         refresh_payload = {
-            "jti": str(jti),
-            "exp": creation_time + timedelta(minutes=refresh_token_expire_minutes),
+            "jti": str(refresh_jti),
+            "exp": refresh_exp,
             # legacy_exchange is used to indicate that the original refresh token
             # was obtained from the legacy_exchange endpoint
             "legacy_exchange": legacy_exchange,
@@ -341,15 +344,19 @@ async def exchange_token(
     # Generate access token payload
     # For now, the access token is only used to access DIRAC services,
     # therefore, the audience is not set and checked
+    access_jti = uuid7()
+    access_exp = uuid7_to_datetime(access_jti) + timedelta(
+        minutes=settings.access_token_expire_minutes
+    )
     access_payload: AccessTokenPayload = {
         "sub": sub,
         "vo": vo,
         "iss": settings.token_issuer,
         "dirac_properties": list(properties),
-        "jti": str(uuid7()),
+        "jti": str(access_jti),
         "preferred_username": preferred_username,
         "dirac_group": dirac_group,
-        "exp": creation_time + timedelta(minutes=settings.access_token_expire_minutes),
+        "exp": access_exp,
         "dirac_policies": {},
     }
 
@@ -382,8 +389,8 @@ async def insert_refresh_token(
     auth_db: AuthDB,
     subject: str,
     scope: str,
-) -> tuple[UUID, datetime]:
-    """Insert a refresh token into the database and return the JWT ID and creation time."""
+) -> UUID:
+    """Insert a refresh token into the database and return the JWT ID."""
     # Generate a JWT ID
     jti = uuid7()
 
@@ -393,10 +400,7 @@ async def insert_refresh_token(
         subject=subject,
         scope=scope,
     )
-
-    # Get the creation time of the refresh token
-    refresh_token = await auth_db.get_refresh_token(jti)
-    return jti, refresh_token["CreationTime"]
+    return jti
 
 
 async def get_device_flow(auth_db: AuthDB, device_code: str, max_validity: int):

{diracx-0.0.1a49 → diracx-0.0.1a50}/diracx-logic/src/diracx/logic/jobs/utils.py

@@ -39,7 +39,7 @@ def make_check_and_prepare_job_config(config: Config, vo: str):
     ops = config.Operations[vo]
     return {
         "inputDataPolicyForVO": ops.InputDataPolicy.InputDataModule,
-        "softwareDistModuleForVO": ops.ExternalsPolicy.SoftwareDistModule,
+        "softwareDistModuleForVO": ops.SoftwareDistModule,
         "defaultCPUTimeForOwnerGroup": ops.JobDescription.DefaultCPUTime,
         "getDIRACPlatform": partial(find_compatible_platforms, config=config),
     }

{diracx-0.0.1a49 → diracx-0.0.1a50}/diracx-routers/src/diracx/routers/auth/authorize_code_flow.py

@@ -1,35 +1,6 @@
 """Authorization code flow.
 
-Client Application                   DIRAC Auth Service                IAM (Identity Access Management)
-------------------                   ------------------                --------------------------------
-       |                                     |                                         |
-       |---(A)--- Authorization Request ---->|                                         |
-       |                                     |---(B)--- Authorization Request -------->|
-       |                                     |                                         |
-       |                                     |<--(C)--- Authorization Grant -----------|
-       |                                     |                                         |
-       |                                     |---(D)--- ID Token Request ------------->|
-       |                                     |                                         |
-       |                                     |<--(E)--- ID Token ----------------------|
-       |<--(F)--- Authorization Grant -------|                                         |
-       |                                     |                                         |
-       |---(G)--- Access Token Request ----->|                                         |
-       |                                     |                                         |
-       |<--(H)--- Access Token --------------|                                         |
-       |                                     |                                         |
-
-
-* (A) The flow is initiated by the client making a request to the DIRAC auth service (GET /authorize) with PKCE.
-* (B) The DIRAC auth service stores the request details and redirects the user to the IAM's authorization flow
-by performing an authorization request on behalf of the user.
-* (C) Once done, the IAM redirects the user back to the DIRAC auth service (GET /authorize/complete).
-* (D) The DIRAC auth service exchanges the code for an ID token by making a token request to the IAM.
-* (E) The IAM responds with an access, a refresh and an ID tokens.
-* (F) The DIRAC auth service only stores the ID token and redirects the user to the client's redirect URI.
-* (G) The client requests an access token from the DIRAC auth service by making a request to
-the token endpoint (POST /token).
-* (H) The DIRAC auth service responds with a DIRAC access token, based on the ID token.
-* The client can then use the access token to access the DIRAC services.
+See docs/admin/explanations/authentication.md
 """
 
 from __future__ import annotations