girder-jsonforms 2.1.2__tar.gz → 2.1.4__tar.gz

{girder_jsonforms-2.1.2/girder_jsonforms.egg-info → girder_jsonforms-2.1.4}/PKG-INFO

@@ -1,11 +1,10 @@
 Metadata-Version: 2.4
 Name: girder-jsonforms
-Version: 2.1.2
+Version: 2.1.4
 Summary: Girder plugin adding forms based on JSON-editor
-License: BSD-3-Clause
+License-Expression: BSD-3-Clause
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Web Environment
-Classifier: License :: OSI Approved :: BSD License
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
@@ -23,14 +22,7 @@ Requires-Dist: google-auth-oauthlib
 Requires-Dist: jsondiff
 Requires-Dist: pandas
 Requires-Dist: openpyxl
-Dynamic: classifier
-Dynamic: description
-Dynamic: description-content-type
-Dynamic: license
 Dynamic: license-file
-Dynamic: requires-dist
-Dynamic: requires-python
-Dynamic: summary
 
 ### Girder JSONForms Plugin
 

{girder_jsonforms-2.1.2 → girder_jsonforms-2.1.4}/girder_jsonforms/lib/igsn_client.py

@@ -19,6 +19,7 @@ Two rules matter here:
 import logging
 
 import requests
+from girder.exceptions import RestException
 from girder.models.setting import Setting
 from requests.adapters import HTTPAdapter
 from urllib3.util.retry import Retry
@@ -29,16 +30,40 @@ logger = logging.getLogger(__name__)
 
 DEFAULT_TIMEOUT = 30
 
+# Upstream statuses that mean "the caller asked for something the registry will
+# not do": a prefix outside the tenant's vocabulary, an identifier that already
+# exists, a published record that cannot be withdrawn. The service's own
+# explanation is the useful part and the person filling in the form can act on
+# it, so these become a 400 carrying that message.
+#
+# Everything else -- our service token rejected, a 5xx, an unreachable host --
+# is this deployment's problem rather than the caller's, so it becomes a 502
+# and the detail is left to the log.
+CLIENT_ERROR_STATUSES = frozenset({400, 404, 409, 422})
 
-class IGSNServiceError(Exception):
+
+def _rest_code(status_code):
+    return 400 if status_code in CLIENT_ERROR_STATUSES else 502
+
+
+class IGSNServiceError(RestException):
     """The IGSN registry service could not satisfy a request.
 
     Deliberately fatal to whatever operation raised it: a Girder deposition must
     never exist without a matching record in the registry.
+
+    It is a ``RestException`` so that the fatality is a *useful* one. Identifier
+    allocation happens several levels below the endpoint -- in
+    ``PrefixCounter.get_next``, and off the ``model.entry.save`` event for the
+    form path -- and most of those call sites have no business knowing about
+    HTTP. Left as a plain exception it reached the REST layer as an unhandled
+    error, so "Institution JH is not permitted for this tenant" showed up in the
+    UI as a bare 500. Subclassing means every path reports the registry's reason
+    without each one having to catch and translate.
     """
 
     def __init__(self, message, status_code=None, detail=None):
-        super().__init__(message)
+        super().__init__(message, code=_rest_code(status_code))
         self.status_code = status_code
         self.detail = detail
 
@@ -82,9 +107,25 @@ class IGSNClient:
                 detail = response.json().get("detail")
             except ValueError:
                 detail = response.text[:500]
+            # The verb and path are what an operator needs, so they go to the
+            # log; the message itself is shown to the user verbatim for a 4xx,
+            # where they would only be noise.
+            logger.warning(
+                "IGSN service returned %s for %s %s: %s",
+                response.status_code,
+                method,
+                path,
+                detail,
+            )
+            if response.status_code in CLIENT_ERROR_STATUSES:
+                message = f"IGSN registry rejected the request: {detail}"
+            else:
+                message = (
+                    f"IGSN service returned {response.status_code} for "
+                    f"{method} {path}: {detail}"
+                )
             raise IGSNServiceError(
-                f"IGSN service returned {response.status_code} for "
-                f"{method} {path}: {detail}",
+                message,
                 status_code=response.status_code,
                 detail=detail,
             )

{girder_jsonforms-2.1.2 → girder_jsonforms-2.1.4}/girder_jsonforms/lib/igsn_vocab.py

@@ -10,6 +10,13 @@ answer briefly. The local settings remain the fallback for local mode and for
 when the service is momentarily unreachable: rejecting a prefix that was valid
 five minutes ago is worse than using a slightly stale vocabulary, since the
 service validates every allocation again anyway.
+
+The registry's vocabulary is global but allocation is tenant-scoped, so the two
+are not the same list. ``GET /vocabularies`` returns every institution the
+registry knows; ``GET /whoami`` says which of them this instance's tenant may
+allocate under. Without the intersection the form happily offers JH to a tenant
+that only holds AB, and the refusal arrives after the metadata has been filled
+in -- readable now, but still a dead end.
 """
 
 import logging
@@ -43,6 +50,41 @@ def invalidate():
         _cache["value"] = None
 
 
+def _permitted(institutions, client):
+    """Narrow the registry's institutions to the ones this tenant may use.
+
+    An empty ``allowed_institutions`` means unrestricted -- the service reads it
+    that way too (``validate_prefix`` only checks when the list is non-empty),
+    and the two must agree or the form offers less than the registry accepts.
+
+    A ``whoami`` that fails is not worth discarding a good vocabulary over: the
+    unfiltered list is what was shown before, and the allocation is validated
+    again at the service anyway.
+    """
+    try:
+        allowed = set((client.whoami() or {}).get("allowed_institutions") or ())
+    except IGSNServiceError:
+        logger.exception("Could not read the tenant from the IGSN service")
+        return institutions
+
+    if not allowed:
+        return institutions
+
+    permitted = {
+        code: value for code, value in institutions.items() if code in allowed
+    }
+    if not permitted:
+        # Nothing the tenant is allowed to use exists in the vocabulary, so the
+        # dropdown will be empty. That is the honest answer -- every prefix
+        # would be refused -- but it is a misconfiguration, not a normal state.
+        logger.warning(
+            "Tenant is allowed institutions %s, none of which the IGSN "
+            "vocabulary defines",
+            sorted(allowed),
+        )
+    return permitted
+
+
 def get_vocabularies():
     """Return ``{"institutions": ..., "materials": ...}``."""
     client = None
@@ -62,7 +104,7 @@ def get_vocabularies():
     try:
         remote = client.vocabularies()
         value = {
-            "institutions": remote["institutions"],
+            "institutions": _permitted(remote["institutions"], client),
             "materials": remote["materials"],
         }
     except (IGSNServiceError, KeyError):

{girder_jsonforms-2.1.2 → girder_jsonforms-2.1.4}/girder_jsonforms/rest/deposition.py

@@ -350,7 +350,11 @@ class Deposition(Resource):
         except pymongo.errors.BulkWriteError as e:
             raise RestException(f"Error creating child depositions: {e.details}")
         except IGSNServiceError as e:
-            raise RestException(f"IGSN registry rejected the batch: {e}")
+            # Re-raised only to name the operation; ``e`` already carries the
+            # registry's reason and the status it should surface as.
+            raise RestException(
+                f"IGSN registry rejected the batch: {e.detail or e}", code=e.code
+            )
         return DepositionModel().load(
             result.inserted_ids[0], user=self.getCurrentUser()
         )

girder_jsonforms-2.1.4/girder_jsonforms/scripts/reconcile_igsn.py

@@ -0,0 +1,118 @@
+"""Pull IGSN registry state onto local depositions.
+
+Publication is asynchronous the whole way down: Girder queues it with the
+registry, the registry queues it with DataCite, and nothing pushes the outcome
+back. ``publish_deposition`` polls for a while after queuing one, which covers
+the ordinary case, but not a record published straight against the registry's
+API, not one that settled while Girder was down, and not one that took longer
+than that poll chain was willing to wait. This is the backstop for those, and
+is meant to run on a timer::
+
+    */15 * * * *  girder-jsonforms-reconcile-igsn --quiet
+
+It runs the ``reconcile`` task in-process -- no broker, no worker -- against
+whatever database the local Girder configuration points at, so it is also the
+quickest way to repair one record by hand.
+
+By default it only looks at depositions that have not settled locally, which is
+what a timer is for and what keeps ``--limit`` meaningful: the scan has no
+ordering, so a flat limit over every deposition would re-check the same first
+thousand for ever. ``--all`` does the full pass, which is the one that also
+reports depositions the registry has never heard of.
+
+Usage::
+
+    girder-jsonforms-reconcile-igsn                       # unsettled records
+    girder-jsonforms-reconcile-igsn --all                 # full audit, to --limit
+    girder-jsonforms-reconcile-igsn --prefix JHAMAL
+    girder-jsonforms-reconcile-igsn --igsn JHAMAL00001 --igsn JHAMAL00002
+    girder-jsonforms-reconcile-igsn --quiet               # summary only on trouble
+
+Exits non-zero when a record could not be read from the registry, so a cron
+run that hit a broken service says so. A deposition the registry has never
+heard of is logged and counted, but is not a failure: it is a finding for a
+human, and reconcile deliberately does not invent the missing record.
+"""
+
+import argparse
+import logging
+import sys
+
+logger = logging.getLogger("girder_jsonforms.reconcile_igsn")
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument(
+        "--prefix",
+        help="Only reconcile depositions whose IGSN starts with this prefix.",
+    )
+    parser.add_argument(
+        "--igsn",
+        action="append",
+        dest="igsns",
+        metavar="IGSN",
+        help="Reconcile one IGSN. Repeatable; overrides --prefix.",
+    )
+    parser.add_argument(
+        "--all",
+        action="store_true",
+        dest="check_all",
+        help=(
+            "Also re-check records that have already settled locally, and "
+            "report any the registry does not have."
+        ),
+    )
+    parser.add_argument(
+        "--limit",
+        type=int,
+        default=1000,
+        help="Maximum number of depositions to check (default: 1000).",
+    )
+    parser.add_argument(
+        "-q",
+        "--quiet",
+        action="store_true",
+        help="Log warnings and errors only -- a quiet cron run stays quiet.",
+    )
+    parser.add_argument("-v", "--verbose", action="store_true", help="Debug logging.")
+    args = parser.parse_args(argv)
+
+    level = logging.INFO
+    if args.quiet:
+        level = logging.WARNING
+    if args.verbose:
+        level = logging.DEBUG
+    logging.basicConfig(level=level, format="%(levelname)s %(message)s")
+
+    # Imported here so ``--help`` works without a configured Girder/DB.
+    from girder_jsonforms.worker_plugin.igsn_registry import reconcile
+
+    summary = reconcile(
+        prefix=args.prefix,
+        igsns=args.igsns,
+        limit=args.limit,
+        pending_only=not args.check_all,
+    )
+    if summary is None:
+        # Local mode. Not an error: an instance that allocates its own IGSNs has
+        # no registry to reconcile against, and a cron entry left behind after
+        # switching modes should not start failing.
+        logger.warning("No IGSN registry is configured; nothing to reconcile.")
+        return 0
+
+    logger.info(
+        "Reconciled: %(updated)s updated, %(unchanged)s unchanged, "
+        "%(missing)s missing, %(errors)s error(s).",
+        summary,
+    )
+    if summary["missing"]:
+        logger.warning(
+            "%s deposition(s) are not in the registry; see the lines above.",
+            summary["missing"],
+        )
+    return 1 if summary["errors"] else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())