fractal-server 2.17.0a0__tar.gz → 2.17.0a2__tar.gz

{fractal_server-2.17.0a0 → fractal_server-2.17.0a2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fractal-server
-Version: 2.17.0a0
+Version: 2.17.0a2
 Summary: Backend component of the Fractal analytics platform
 License-Expression: BSD-3-Clause
 License-File: LICENSE

fractal_server-2.17.0a2/fractal_server/__init__.py

@@ -0,0 +1 @@
+__VERSION__ = "2.17.0a2"

{fractal_server-2.17.0a0 → fractal_server-2.17.0a2}/fractal_server/__main__.py

@@ -136,8 +136,8 @@ def init_db_data(
     from sqlalchemy import select, func
     from fractal_server.app.models.security import UserOAuth
     from fractal_server.app.models import Resource, Profile
-    from fractal_server.app.schemas.v2.resource import validate_resource_data
-    from fractal_server.app.schemas.v2.profile import validate_profile_data
+    from fractal_server.app.schemas.v2.resource import cast_serialize_resource
+    from fractal_server.app.schemas.v2.profile import cast_serialize_profile
 
     init_data_settings = Inject(get_init_data_settings)
 
@@ -203,15 +203,17 @@ def init_db_data(
 
         # Validate resource/profile data
         try:
-            validate_resource_data(resource_data)
+            resource_data = cast_serialize_resource(resource_data)
         except ValidationError as e:
-            print(e)
-            sys.exit("ERROR: Invalid resource data.")
+            sys.exit(
+                f"ERROR: Invalid resource data.\nOriginal error:\n{str(e)}"
+            )
         try:
-            validate_profile_data(profile_data)
+            profile_data = cast_serialize_profile(profile_data)
         except ValidationError as e:
-            print(e)
-            sys.exit("ERROR: Invalid profile data.")
+            sys.exit(
+                f"ERROR: Invalid profile data.\nOriginal error:\n{str(e)}"
+            )
 
         # Create resource/profile db objects
         resource_obj = Resource(**resource_data)

{fractal_server-2.17.0a0 → fractal_server-2.17.0a2}/fractal_server/app/routes/api/__init__.py

@@ -9,6 +9,7 @@ from fractal_server.app.models import UserOAuth
 from fractal_server.app.routes.auth import current_active_superuser
 from fractal_server.config import get_db_settings
 from fractal_server.config import get_email_settings
+from fractal_server.config import get_oauth_settings
 from fractal_server.config import get_settings
 from fractal_server.syringe import Inject
 
@@ -45,3 +46,11 @@ async def view_email_settings(
 ):
     settings = Inject(get_email_settings)
     return settings.model_dump()
+
+
+@router_api.get("/settings/oauth/")
+async def view_oauth_settings(
+    user: UserOAuth = Depends(current_active_superuser),
+):
+    settings = Inject(get_oauth_settings)
+    return settings.model_dump()

fractal_server-2.17.0a2/fractal_server/app/routes/auth/oauth.py

@@ -0,0 +1,72 @@
+from fastapi import APIRouter
+from httpx_oauth.clients.github import GitHubOAuth2
+from httpx_oauth.clients.google import GoogleOAuth2
+from httpx_oauth.clients.openid import OpenID
+
+from . import cookie_backend
+from . import fastapi_users
+from fractal_server.config import get_oauth_settings
+from fractal_server.config import get_settings
+from fractal_server.config import OAuthSettings
+from fractal_server.syringe import Inject
+
+
+def _create_client_github(cfg: OAuthSettings) -> GitHubOAuth2:
+    return GitHubOAuth2(
+        client_id=cfg.OAUTH_CLIENT_ID.get_secret_value(),
+        client_secret=cfg.OAUTH_CLIENT_SECRET.get_secret_value(),
+    )
+
+
+def _create_client_google(cfg: OAuthSettings) -> GoogleOAuth2:
+    return GoogleOAuth2(
+        client_id=cfg.OAUTH_CLIENT_ID.get_secret_value(),
+        client_secret=cfg.OAUTH_CLIENT_SECRET.get_secret_value(),
+    )
+
+
+def _create_client_oidc(cfg: OAuthSettings) -> OpenID:
+    return OpenID(
+        client_id=cfg.OAUTH_CLIENT_ID.get_secret_value(),
+        client_secret=cfg.OAUTH_CLIENT_SECRET.get_secret_value(),
+        openid_configuration_endpoint=cfg.OAUTH_OIDC_CONFIG_ENDPOINT,
+    )
+
+
+def get_oauth_router() -> APIRouter | None:
+    """
+    Get the `APIRouter` object for OAuth endpoints.
+    """
+    router_oauth = APIRouter()
+    settings = Inject(get_settings)
+    oauth_settings = Inject(get_oauth_settings)
+    if not oauth_settings.is_set:
+        return None
+
+    client_name = oauth_settings.OAUTH_CLIENT_NAME
+
+    if client_name == "google":
+        client = _create_client_google(oauth_settings)
+    elif client_name == "github":
+        client = _create_client_github(oauth_settings)
+    else:
+        client = _create_client_oidc(oauth_settings)
+
+    router_oauth.include_router(
+        fastapi_users.get_oauth_router(
+            client,
+            cookie_backend,
+            settings.JWT_SECRET_KEY,
+            is_verified_by_default=False,
+            associate_by_email=True,
+            redirect_url=oauth_settings.OAUTH_REDIRECT_URL,
+        ),
+        prefix=f"/{client_name}",
+    )
+
+    # Add trailing slash to all routes' paths
+    for route in router_oauth.routes:
+        if not route.path.endswith("/"):
+            route.path = f"{route.path}/"
+
+    return router_oauth

{fractal_server-2.17.0a0 → fractal_server-2.17.0a2}/fractal_server/app/routes/auth/router.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter
 from .current_user import router_current_user
 from .group import router_group
 from .login import router_login
-from .oauth import router_oauth
+from .oauth import get_oauth_router
 from .register import router_register
 from .users import router_users
 
@@ -14,4 +14,6 @@ router_auth.include_router(router_current_user)
 router_auth.include_router(router_login)
 router_auth.include_router(router_users)
 router_auth.include_router(router_group)
-router_auth.include_router(router_oauth)
+router_oauth = get_oauth_router()
+if router_oauth is not None:
+    router_auth.include_router(router_oauth)

{fractal_server-2.17.0a0 → fractal_server-2.17.0a2}/fractal_server/app/routes/aux/validate_user_profile.py

@@ -6,8 +6,8 @@ from fractal_server.app.db import AsyncSession
 from fractal_server.app.models import Profile
 from fractal_server.app.models import Resource
 from fractal_server.app.models import UserOAuth
-from fractal_server.app.schemas.v2.profile import validate_profile_data
-from fractal_server.app.schemas.v2.resource import validate_resource_data
+from fractal_server.app.schemas.v2.profile import cast_serialize_profile
+from fractal_server.app.schemas.v2.resource import cast_serialize_resource
 from fractal_server.logger import set_logger
 
 logger = set_logger(__name__)
@@ -38,10 +38,10 @@ async def validate_user_profile(
     profile = await db.get(Profile, user.profile_id)
     resource = await db.get(Resource, profile.resource_id)
     try:
-        validate_resource_data(
+        cast_serialize_resource(
             resource.model_dump(exclude={"id", "timestamp_created"}),
         )
-        validate_profile_data(
+        cast_serialize_profile(
             profile.model_dump(exclude={"resource_id", "id"}),
         )
         db.expunge(resource)

{fractal_server-2.17.0a0 → fractal_server-2.17.0a2}/fractal_server/app/schemas/v2/profile.py

@@ -65,8 +65,14 @@ class ProfileRead(BaseModel):
 
 
 @validate_call
-def validate_profile_data(_data: ProfileCreate):
+def cast_serialize_profile(_data: ProfileCreate) -> dict[str, Any]:
     """
-    We use `@validate_call` because `ProfileCreate` is a `Union` type and it
+    Cast/serialize round-trip for `Profile` data.
+
+    We use `@validate_call` because `ProfileeCreate` is a `Union` type and it
     cannot be instantiated directly.
+
+    Return:
+        Serialized version of a valid profile object.
     """
+    return _data.model_dump()

{fractal_server-2.17.0a0 → fractal_server-2.17.0a2}/fractal_server/app/schemas/v2/resource.py

@@ -4,6 +4,7 @@ from typing import Any
 from typing import Literal
 from typing import Self
 
+from pydantic import AfterValidator
 from pydantic import BaseModel
 from pydantic import Discriminator
 from pydantic import model_validator
@@ -25,13 +26,27 @@ class ResourceType(StrEnum):
     LOCAL = "local"
 
 
+def cast_serialize_pixi_settings(
+    v: dict[NonEmptyStr, Any],
+) -> dict[NonEmptyStr, Any]:
+    """
+    Validate current value, and enrich it with default values.
+    """
+    if v != {}:
+        v = TasksPixiSettings(**v).model_dump()
+    return v
+
+
 class _ValidResourceBase(BaseModel):
     type: ResourceType
     name: NonEmptyStr
 
     # Tasks
     tasks_python_config: TasksPythonSettings
-    tasks_pixi_config: dict[NonEmptyStr, Any]
+    tasks_pixi_config: Annotated[
+        dict[NonEmptyStr, Any],
+        AfterValidator(cast_serialize_pixi_settings),
+    ]
     tasks_local_dir: AbsolutePathStr
 
     # Jobs
@@ -40,16 +55,15 @@ class _ValidResourceBase(BaseModel):
     jobs_poll_interval: int = 5
 
     @model_validator(mode="after")
-    def _tasks_configurations(self) -> Self:
-        if self.tasks_pixi_config != {}:
-            pixi_settings = TasksPixiSettings(**self.tasks_pixi_config)
-            if (
-                self.type == ResourceType.SLURM_SSH
-                and pixi_settings.SLURM_CONFIG is None
-            ):
-                raise ValueError(
-                    "`tasks_pixi_config` must include `SLURM_CONFIG`."
-                )
+    def _pixi_slurm_config(self) -> Self:
+        if (
+            self.tasks_pixi_config != {}
+            and self.type == ResourceType.SLURM_SSH
+            and self.tasks_pixi_config["SLURM_CONFIG"] is None
+        ):
+            raise ValueError(
+                "`tasks_pixi_config` must include `SLURM_CONFIG`."
+            )
         return self
 
 
@@ -110,8 +124,14 @@ class ResourceRead(BaseModel):
 
 
 @validate_call
-def validate_resource_data(_data: ResourceCreate):
+def cast_serialize_resource(_data: ResourceCreate) -> dict[str, Any]:
     """
+    Cast/serialize round-trip for `Resource` data.
+
     We use `@validate_call` because `ResourceCreate` is a `Union` type and it
     cannot be instantiated directly.
+
+    Return:
+        Serialized version of a valid resource object.
     """
+    return _data.model_dump()

{fractal_server-2.17.0a0 → fractal_server-2.17.0a2}/fractal_server/config/__init__.py

@@ -3,6 +3,7 @@ from ._email import EmailSettings
 from ._email import PublicEmailSettings  # noqa F401
 from ._init_data import InitDataSettings
 from ._main import Settings
+from ._oauth import OAuthSettings
 
 
 def get_db_settings(db_settings=DatabaseSettings()) -> DatabaseSettings:
@@ -21,3 +22,7 @@ def get_init_data_settings(
     init_data_settings=InitDataSettings(),
 ) -> InitDataSettings:
     return init_data_settings
+
+
+def get_oauth_settings(oauth_settings=OAuthSettings()) -> OAuthSettings:
+    return oauth_settings

{fractal_server-2.17.0a0 → fractal_server-2.17.0a2}/fractal_server/config/_main.py

@@ -1,12 +1,7 @@
 import logging
-from os import environ
-from os import getenv
 from typing import Literal
 from typing import TypeVar
 
-from pydantic import BaseModel
-from pydantic import Field
-from pydantic import model_validator
 from pydantic import SecretStr
 from pydantic_settings import BaseSettings
 from pydantic_settings import SettingsConfigDict
@@ -22,48 +17,6 @@ class FractalConfigurationError(ValueError):
 T = TypeVar("T")
 
 
-class OAuthClientConfig(BaseModel):
-    """
-    OAuth Client Config Model
-
-    This model wraps the variables that define a client against an Identity
-    Provider. As some providers are supported by the libraries used within the
-    server, some attributes are optional.
-
-    Attributes:
-        CLIENT_NAME:
-            The name of the client
-        CLIENT_ID:
-            ID of client
-        CLIENT_SECRET:
-            Secret to authorise against the identity provider
-        OIDC_CONFIGURATION_ENDPOINT:
-            OpenID configuration endpoint,
-            allowing to discover the required endpoints automatically
-        REDIRECT_URL:
-            String to be used as `redirect_url` argument for
-            `fastapi_users.get_oauth_router`, and then in
-            `httpx_oauth.integrations.fastapi.OAuth2AuthorizeCallback`.
-    """
-
-    CLIENT_NAME: str
-    CLIENT_ID: str
-    CLIENT_SECRET: SecretStr
-    OIDC_CONFIGURATION_ENDPOINT: str | None = None
-    REDIRECT_URL: str | None = None
-
-    @model_validator(mode="before")
-    @classmethod
-    def check_configuration(cls, values):
-        if values.get("CLIENT_NAME") not in ["GOOGLE", "GITHUB"]:
-            if not values.get("OIDC_CONFIGURATION_ENDPOINT"):
-                raise FractalConfigurationError(
-                    f"Missing OAUTH_{values.get('CLIENT_NAME')}"
-                    "_OIDC_CONFIGURATION_ENDPOINT"
-                )
-        return values
-
-
 class Settings(BaseSettings):
     """
     Contains all the configuration variables for Fractal Server
@@ -73,8 +26,6 @@ class Settings(BaseSettings):
 
     model_config = SettingsConfigDict(**SETTINGS_CONFIG_DICT)
 
-    OAUTH_CLIENTS_CONFIG: list[OAuthClientConfig] = Field(default_factory=list)
-
     # JWT TOKEN
     JWT_EXPIRE_SECONDS: int = 180
     """
@@ -95,52 +46,6 @@ class Settings(BaseSettings):
     Cookie token lifetime, in seconds.
     """
 
-    @model_validator(mode="before")
-    @classmethod
-    def collect_oauth_clients(cls, values):
-        """
-        Automatic collection of OAuth Clients
-
-        This method collects the environment variables relative to a single
-        OAuth client and saves them within the `Settings` object in the form
-        of an `OAuthClientConfig` instance.
-
-        Fractal can support an arbitrary number of OAuth providers, which are
-        automatically detected by parsing the environment variable names. In
-        particular, to set the provider `FOO`, one must specify the variables
-
-            OAUTH_FOO_CLIENT_ID
-            OAUTH_FOO_CLIENT_SECRET
-            ...
-
-        etc (cf. OAuthClientConfig).
-        """
-        oauth_env_variable_keys = [
-            key for key in environ.keys() if key.startswith("OAUTH_")
-        ]
-        clients_available = {
-            var.split("_")[1] for var in oauth_env_variable_keys
-        }
-
-        values["OAUTH_CLIENTS_CONFIG"] = []
-        for client in clients_available:
-            prefix = f"OAUTH_{client}"
-            oauth_client_config = OAuthClientConfig(
-                CLIENT_NAME=client,
-                CLIENT_ID=getenv(f"{prefix}_CLIENT_ID", None),
-                CLIENT_SECRET=getenv(f"{prefix}_CLIENT_SECRET", None),
-                OIDC_CONFIGURATION_ENDPOINT=getenv(
-                    f"{prefix}_OIDC_CONFIGURATION_ENDPOINT", None
-                ),
-                REDIRECT_URL=getenv(f"{prefix}_REDIRECT_URL", None),
-            )
-            values["OAUTH_CLIENTS_CONFIG"].append(oauth_client_config)
-        return values
-
-    ###########################################################################
-    # FRACTAL SPECIFIC
-    ###########################################################################
-
     # Note: we do not use ResourceType here to avoid circular imports
     FRACTAL_RUNNER_BACKEND: Literal[
         "local", "slurm_ssh", "slurm_sudo"

fractal_server-2.17.0a2/fractal_server/config/_oauth.py

@@ -0,0 +1,69 @@
+from typing import Annotated
+from typing import Self
+
+from pydantic import model_validator
+from pydantic import SecretStr
+from pydantic import StringConstraints
+from pydantic_settings import BaseSettings
+from pydantic_settings import SettingsConfigDict
+
+from ._settings_config import SETTINGS_CONFIG_DICT
+from fractal_server.types import NonEmptyStr
+
+
+class OAuthSettings(BaseSettings):
+    """
+    Minimal set of configurations needed for operating on the database (e.g
+    for schema migrations).
+    """
+
+    model_config = SettingsConfigDict(**SETTINGS_CONFIG_DICT)
+
+    OAUTH_CLIENT_NAME: (
+        Annotated[
+            NonEmptyStr,
+            StringConstraints(to_lower=True),
+        ]
+        | None
+    ) = None
+    """
+    The name of the client.
+    """
+    OAUTH_CLIENT_ID: SecretStr | None = None
+    """
+    ID of client.
+    """
+    OAUTH_CLIENT_SECRET: SecretStr | None = None
+    """
+    Secret to authorise against the identity provider.
+    """
+    OAUTH_OIDC_CONFIG_ENDPOINT: str | None = None
+    """
+    OpenID configuration endpoint, for autodiscovery of relevant endpoints.
+    """
+    OAUTH_REDIRECT_URL: str | None = None
+    """
+    String to be used as `redirect_url` argument in
+    `fastapi_users.get_oauth_router`, and then in
+    `httpx_oauth.integrations.fastapi.OAuth2AuthorizeCallback`
+    """
+
+    @model_validator(mode="after")
+    def check_configuration(self: Self) -> Self:
+        if (
+            self.OAUTH_CLIENT_NAME not in ["google", "github", None]
+            and self.OAUTH_OIDC_CONFIG_ENDPOINT is None
+        ):
+            raise ValueError(
+                f"{self.OAUTH_OIDC_CONFIG_ENDPOINT=} but "
+                f"{self.OAUTH_CLIENT_NAME=}"
+            )
+        return self
+
+    @property
+    def is_set(self) -> bool:
+        return None not in (
+            self.OAUTH_CLIENT_NAME,
+            self.OAUTH_CLIENT_ID,
+            self.OAUTH_CLIENT_SECRET,
+        )

{fractal_server-2.17.0a0 → fractal_server-2.17.0a2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fractal-server"
-version = "2.17.0a0"
+version = "2.17.0a2"
 description = "Backend component of the Fractal analytics platform"
 authors = [
     { name="Tommaso Comparin", email="tommaso.comparin@exact-lab.it" },
@@ -96,7 +96,7 @@ filterwarnings = [
 markers = ["container", "ssh", "fails_on_macos"]
 
 [tool.bumpver]
-current_version = "2.17.0a0"
+current_version = "2.17.0a2"
 version_pattern = "MAJOR.MINOR.PATCH[PYTAGNUM]"
 commit_message = "bump version {old_version} -> {new_version}"
 commit = true

fractal_server-2.17.0a0/fractal_server/__init__.py

@@ -1 +0,0 @@
-__VERSION__ = "2.17.0a0"

fractal_server-2.17.0a0/fractal_server/app/routes/auth/oauth.py

@@ -1,65 +0,0 @@
-from fastapi import APIRouter
-
-from . import cookie_backend
-from . import fastapi_users
-from ....config import get_settings
-from ....syringe import Inject
-
-router_oauth = APIRouter()
-
-
-# OAUTH CLIENTS
-
-# NOTE: settings.OAUTH_CLIENTS are collected by
-# Settings.collect_oauth_clients(). If no specific client is specified in the
-# environment variables (e.g. by setting OAUTH_FOO_CLIENT_ID and
-# OAUTH_FOO_CLIENT_SECRET), this list is empty
-
-# Note: dependency injection should be wrapped within a function call to make
-# it truly lazy. This function could then be called on startup of the FastAPI
-# app (cf. fractal_server.main)
-settings = Inject(get_settings)
-
-for client_config in settings.OAUTH_CLIENTS_CONFIG:
-    client_name = client_config.CLIENT_NAME.lower()
-
-    if client_name == "google":
-        from httpx_oauth.clients.google import GoogleOAuth2
-
-        client = GoogleOAuth2(
-            client_config.CLIENT_ID,
-            client_config.CLIENT_SECRET.get_secret_value(),
-        )
-    elif client_name == "github":
-        from httpx_oauth.clients.github import GitHubOAuth2
-
-        client = GitHubOAuth2(
-            client_config.CLIENT_ID,
-            client_config.CLIENT_SECRET.get_secret_value(),
-        )
-    else:
-        from httpx_oauth.clients.openid import OpenID
-
-        client = OpenID(
-            client_config.CLIENT_ID,
-            client_config.CLIENT_SECRET.get_secret_value(),
-            client_config.OIDC_CONFIGURATION_ENDPOINT,
-        )
-
-    router_oauth.include_router(
-        fastapi_users.get_oauth_router(
-            client,
-            cookie_backend,
-            settings.JWT_SECRET_KEY,
-            is_verified_by_default=False,
-            associate_by_email=True,
-            redirect_url=client_config.REDIRECT_URL,
-        ),
-        prefix=f"/{client_name}",
-    )
-
-
-# Add trailing slash to all routes' paths
-for route in router_oauth.routes:
-    if not route.path.endswith("/"):
-        route.path = f"{route.path}/"