nmdc-runtime 2.9.0__py3-none-any.whl → 2.10.0__py3-none-any.whl

nmdc_runtime/api/endpoints/runs.py

@@ -0,0 +1,98 @@
+from fastapi import APIRouter, Depends, HTTPException
+from pymongo.database import Database as MongoDatabase
+from starlette import status
+from toolz import concat
+
+from nmdc_runtime.api.core.util import raise404_if_none
+from nmdc_runtime.api.db.mongo import get_mongo_db
+from nmdc_runtime.api.endpoints.util import _request_dagster_run
+from nmdc_runtime.api.models.run import (
+    RunSummary,
+    RunEvent,
+    RunUserSpec,
+)
+from nmdc_runtime.api.models.user import User, get_current_active_user
+from nmdc_runtime.api.models.util import ListResponse
+
+router = APIRouter()
+
+
+@router.post("/runs", response_model=RunSummary)
+def request_run(
+    run_user_spec: RunUserSpec = Depends(),
+    mdb: MongoDatabase = Depends(get_mongo_db),
+    user: User = Depends(get_current_active_user),
+):
+    requested = _request_dagster_run(
+        nmdc_workflow_id=run_user_spec.job_id,
+        nmdc_workflow_inputs=run_user_spec.inputs,
+        extra_run_config_data=run_user_spec.run_config,
+        mdb=mdb,
+        user=user,
+    )
+    if requested["type"] == "success":
+        return _get_run_summary(requested["detail"]["run_id"], mdb)
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=(
+                f"Runtime failed to start {run_user_spec.job_id} job. "
+                f'Detail: {requested["detail"]}'
+            ),
+        )
+
+
+def _get_run_summary(run_id, mdb) -> RunSummary:
+    events_in_order = list(mdb.run_events.find({"run.id": run_id}, sort=[("time", 1)]))
+    raise404_if_none(events_in_order or None)
+    # TODO put relevant outputs in outputs! (for get_study_metadata job)
+    return RunSummary(
+        id=run_id,
+        status=events_in_order[-1]["type"],
+        started_at_time=events_in_order[0]["time"],
+        was_started_by=events_in_order[0]["producer"],
+        inputs=list(concat(e["inputs"] for e in events_in_order)),
+        outputs=list(concat(e["outputs"] for e in events_in_order)),
+        job=events_in_order[-1]["job"],
+        producer=events_in_order[-1]["producer"],
+        schemaURL=events_in_order[-1]["schemaURL"],
+    )
+
+
+@router.get(
+    "/runs/{run_id}", response_model=RunSummary, response_model_exclude_unset=True
+)
+def get_run_summary(
+    run_id: str,
+    mdb: MongoDatabase = Depends(get_mongo_db),
+):
+    return _get_run_summary(run_id, mdb)
+
+
+@router.get("/runs/{run_id}/events", response_model=ListResponse[RunEvent])
+def list_events_for_run(
+    run_id: str,
+    mdb: MongoDatabase = Depends(get_mongo_db),
+):
+    """List events for run, in reverse chronological order."""
+    raise404_if_none(mdb.run_events.find_one({"run.id": run_id}))
+    return {
+        "resources": list(mdb.run_events.find({"run.id": run_id}, sort=[("time", -1)]))
+    }
+
+
+@router.post(
+    "/runs/{run_id}/events", response_model=RunEvent, response_model_exclude_unset=True
+)
+def post_run_event(
+    run_id: str,
+    run_event: RunEvent = Depends(),
+    mdb: MongoDatabase = Depends(get_mongo_db),
+):
+    if run_id != run_event.run.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f"Supplied run_event.run.id does not match run_id given in request URL.",
+        )
+    mdb.run_events.insert_one(run_event.model_dump())
+    return _get_run_summary(run_event.run.id, mdb)

nmdc_runtime/api/endpoints/search.py

@@ -0,0 +1,38 @@
+import json
+
+from fastapi import APIRouter, Depends
+from pymongo.database import Database as MongoDatabase
+
+from nmdc_runtime.api.db.mongo import get_mongo_db
+from nmdc_runtime.api.endpoints.nmdcschema import strip_oid
+from nmdc_runtime.api.endpoints.util import list_resources
+from nmdc_runtime.api.models.nmdc_schema import (
+    DataObject,
+    DataObjectListRequest,
+    list_request_filter_to_mongo_filter,
+)
+from nmdc_runtime.api.models.util import ListResponse, ListRequest
+
+router = APIRouter()
+
+
+@router.get(
+    "/data_objects",
+    response_model=ListResponse[DataObject],
+    response_model_exclude_unset=True,
+)
+def data_objects(
+    req: DataObjectListRequest = Depends(),
+    mdb: MongoDatabase = Depends(get_mongo_db),
+):
+    filter_ = list_request_filter_to_mongo_filter(req.model_dump(exclude_unset=True))
+    max_page_size = filter_.pop("max_page_size", None)
+    page_token = filter_.pop("page_token", None)
+    req = ListRequest(
+        filter=json.dumps(filter_),
+        max_page_size=max_page_size,
+        page_token=page_token,
+    )
+    rv = list_resources(req, mdb, "data_objects")
+    rv["resources"] = [strip_oid(d) for d in rv["resources"]]
+    return rv

nmdc_runtime/api/endpoints/sites.py

@@ -0,0 +1,229 @@
+from typing import List, Annotated
+
+import botocore
+import pymongo.database
+from fastapi import APIRouter, Depends, status, HTTPException, Path, Query
+from starlette.status import HTTP_403_FORBIDDEN
+
+from nmdc_runtime.api.core.auth import (
+    ClientCredentials,
+    get_password_hash,
+)
+from nmdc_runtime.api.core.idgen import generate_one_id, local_part
+from nmdc_runtime.api.core.util import (
+    raise404_if_none,
+    expiry_dt_from_now,
+    dotted_path_for,
+    generate_secret,
+    API_SITE_ID,
+)
+from nmdc_runtime.api.db.mongo import get_mongo_db
+from nmdc_runtime.api.db.s3 import (
+    get_s3_client,
+    presigned_url_to_put,
+    presigned_url_to_get,
+    S3_ID_NS,
+)
+from nmdc_runtime.api.endpoints.util import exists, list_resources
+from nmdc_runtime.api.models.object import (
+    AccessMethod,
+    AccessURL,
+    DrsObjectBase,
+    DrsObjectIn,
+)
+from nmdc_runtime.api.models.operation import Operation, ObjectPutMetadata
+from nmdc_runtime.api.models.site import (
+    get_current_client_site,
+    Site,
+    SiteInDB,
+)
+from nmdc_runtime.api.models.user import get_current_active_user, User
+from nmdc_runtime.api.models.util import ListResponse, ListRequest
+from nmdc_runtime.minter.bootstrap import refresh_minter_requesters_from_sites
+
+router = APIRouter()
+
+
+@router.post("/sites", status_code=status.HTTP_201_CREATED, response_model=SiteInDB)
+def create_site(
+    site: Site,
+    mdb: pymongo.database.Database = Depends(get_mongo_db),
+    user: User = Depends(get_current_active_user),
+):
+    if exists(mdb.sites, {"id": site.id}):
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail=f"site with supplied id {site.id} already exists",
+        )
+    mdb.sites.insert_one(site.model_dump())
+    refresh_minter_requesters_from_sites()
+    rv = mdb.users.update_one(
+        {"username": user.username},
+        {"$addToSet": {"site_admin": site.id}},
+    )
+    if rv.modified_count != 1:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"failed to register user {user.username} as site_admin for site {site.id}.",
+        )
+    return mdb.sites.find_one({"id": site.id})
+
+
+@router.get(
+    "/sites", response_model=ListResponse[Site], response_model_exclude_unset=True
+)
+def list_sites(
+    req: Annotated[ListRequest, Query()],
+    mdb: pymongo.database.Database = Depends(get_mongo_db),
+):
+    return list_resources(req, mdb, "sites")
+
+
+@router.get("/sites/{site_id}", response_model=Site, response_model_exclude_unset=True)
+def get_site(
+    site_id: str,
+    mdb: pymongo.database.Database = Depends(get_mongo_db),
+):
+    return raise404_if_none(mdb.sites.find_one({"id": site_id}))
+
+
+@router.patch("/sites/{site_id}", include_in_schema=False)
+def update_site():
+    """Not yet implemented"""
+    pass
+
+
+@router.put("/sites/{site_id}", include_in_schema=False)
+def replace_site():
+    """Not yet implemented"""
+    pass
+
+
+@router.get("/sites/{site_id}/capabilities", include_in_schema=False)
+def list_site_capabilities(site_id: str):
+    """Not yet implemented"""
+    pass
+
+
+@router.put("/sites/{site_id}/capabilities", include_in_schema=False)
+def replace_site_capabilities(site_id: str, capability_ids: List[str]):
+    """Not yet implemented"""
+    pass
+
+
+def verify_client_site_pair(
+    site_id: str,
+    mdb: pymongo.database.Database = Depends(get_mongo_db),
+    client_site: Site = Depends(get_current_client_site),
+):
+    site = raise404_if_none(
+        mdb.sites.find_one({"id": site_id}), detail=f"no site with ID '{site_id}'"
+    )
+    if site["id"] != client_site.id:
+        raise HTTPException(
+            status_code=HTTP_403_FORBIDDEN,
+            detail=f"client authorized for different site_id than {site_id}",
+        )
+
+
+@router.post(
+    "/sites/{site_id}:putObject",
+    response_model=Operation[DrsObjectIn, ObjectPutMetadata],
+    dependencies=[Depends(verify_client_site_pair)],
+)
+def put_object_in_site(
+    site_id: str,
+    object_in: DrsObjectBase,
+    mdb: pymongo.database.Database = Depends(get_mongo_db),
+    s3client: botocore.client.BaseClient = Depends(get_s3_client),
+):
+    if site_id != API_SITE_ID:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"API-mediated object storage for site {site_id} is not enabled.",
+        )
+    expires_in = 300
+    object_id = generate_one_id(mdb, S3_ID_NS)
+    url = presigned_url_to_put(
+        f"{S3_ID_NS}/{object_id}",
+        client=s3client,
+        mime_type=object_in.mime_type,
+        expires_in=expires_in,
+    )
+    # XXX ensures defaults are set, e.g. done:false
+    op = Operation[DrsObjectIn, ObjectPutMetadata](
+        **{
+            "id": generate_one_id(mdb, "op"),
+            "expire_time": expiry_dt_from_now(days=30, seconds=expires_in),
+            "metadata": {
+                "object_id": object_id,
+                "site_id": site_id,
+                "url": url,
+                "expires_in_seconds": expires_in,
+                "model": dotted_path_for(ObjectPutMetadata),
+            },
+        }
+    )
+    mdb.operations.insert_one(op.model_dump())
+    return op
+
+
+@router.post(
+    "/sites/{site_id}:getObjectLink",
+    response_model=AccessURL,
+    dependencies=[Depends(verify_client_site_pair)],
+)
+def get_site_object_link(
+    site_id: str,
+    access_method: AccessMethod,
+    s3client: botocore.client.BaseClient = Depends(get_s3_client),
+):
+    if site_id != API_SITE_ID:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"API-mediated object storage for site {site_id} is not enabled.",
+        )
+    url = presigned_url_to_get(
+        f"{S3_ID_NS}/{access_method.access_id}",
+        client=s3client,
+    )
+    return {"url": url}
+
+
+@router.post("/sites/{site_id}:generateCredentials", response_model=ClientCredentials)
+def generate_credentials_for_site_client(
+    site_id: str = Path(
+        ...,
+        description="The ID of the site.",
+    ),
+    mdb: pymongo.database.Database = Depends(get_mongo_db),
+    user: User = Depends(get_current_active_user),
+):
+    """
+    Generate a client_id and client_secret for the given site.
+
+    You must be authenticated as a user who is registered as an admin of the given site.
+    """
+    raise404_if_none(
+        mdb.sites.find_one({"id": site_id}), detail=f"no site with ID '{site_id}'"
+    )
+    site_admin = mdb.users.find_one({"username": user.username, "site_admin": site_id})
+    if not site_admin:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You're not registered as an admin for this site",
+        )
+
+    # XXX client_id must not contain a ':' because HTTPBasic auth splits on ':'.
+    client_id = local_part(generate_one_id(mdb, "site_clients"))
+    client_secret = generate_secret()
+    hashed_secret = get_password_hash(client_secret)
+    mdb.sites.update_one(
+        {"id": site_id},
+        {"$push": {"clients": {"id": client_id, "hashed_secret": hashed_secret}}},
+    )
+
+    return {
+        "client_id": client_id,
+        "client_secret": client_secret,
+    }

nmdc_runtime/api/endpoints/triggers.py

@@ -0,0 +1,25 @@
+from typing import List
+
+import pymongo
+from fastapi import APIRouter, Depends
+
+from nmdc_runtime.api.core.util import raise404_if_none
+from nmdc_runtime.api.db.mongo import get_mongo_db
+from nmdc_runtime.api.models.trigger import Trigger
+
+router = APIRouter()
+
+
+@router.get("/triggers", response_model=List[Trigger])
+def list_triggers(
+    mdb: pymongo.database.Database = Depends(get_mongo_db),
+):
+    return list(mdb.triggers.find())
+
+
+@router.get("/triggers/{trigger_id}", response_model=Trigger)
+def get_trigger(
+    trigger_id: str,
+    mdb: pymongo.database.Database = Depends(get_mongo_db),
+):
+    return raise404_if_none(mdb.triggers.find_one({"id": trigger_id}))

nmdc_runtime/api/endpoints/users.py

@@ -0,0 +1,214 @@
+import json
+from datetime import timedelta
+from typing import Annotated
+
+import pymongo.database
+import requests
+from fastapi import Depends, APIRouter, HTTPException, status, Cookie
+from jose import jws, JWTError
+from starlette.requests import Request
+from starlette.responses import RedirectResponse, PlainTextResponse
+
+from nmdc_runtime.api.core.auth import (
+    OAuth2PasswordOrClientCredentialsRequestForm,
+    Token,
+    ACCESS_TOKEN_EXPIRES,
+    create_access_token,
+    ORCID_NMDC_CLIENT_ID,
+    ORCID_JWK,
+    ORCID_JWS_VERITY_ALGORITHM,
+    credentials_exception,
+    ORCID_NMDC_CLIENT_SECRET,
+    ORCID_BASE_URL,
+)
+from nmdc_runtime.api.core.auth import get_password_hash
+from nmdc_runtime.api.core.util import generate_secret
+from nmdc_runtime.api.db.mongo import get_mongo_db
+from nmdc_runtime.api.endpoints.util import BASE_URL_EXTERNAL
+from nmdc_runtime.api.models.site import authenticate_site_client
+from nmdc_runtime.api.models.user import UserInDB, UserIn, get_user
+from nmdc_runtime.api.models.user import (
+    authenticate_user,
+    User,
+    get_current_active_user,
+)
+
+router = APIRouter()
+
+
+@router.get("/orcid_code", response_class=RedirectResponse, include_in_schema=False)
+async def receive_orcid_code(request: Request, code: str, state: str | None = None):
+    rv = requests.post(
+        f"{ORCID_BASE_URL}/oauth/token",
+        data=(
+            f"client_id={ORCID_NMDC_CLIENT_ID}&client_secret={ORCID_NMDC_CLIENT_SECRET}&"
+            f"grant_type=authorization_code&code={code}&redirect_uri={BASE_URL_EXTERNAL}/orcid_code"
+        ),
+        headers={
+            "Content-type": "application/x-www-form-urlencoded",
+            "Accept": "application/json",
+        },
+    )
+    token_response = rv.json()
+    response = RedirectResponse(state or request.url_for("custom_swagger_ui_html"))
+    for key in ["user_orcid", "user_name", "user_id_token"]:
+        response.set_cookie(
+            key=key,
+            value=token_response[key.replace("user_", "")],
+            max_age=2592000,
+        )
+    return response
+
+
+@router.get("/orcid_jwt")
+async def get_orcid_jwt(user_id_token: Annotated[str | None, Cookie()] = None):
+    if user_id_token:
+        return PlainTextResponse(content=user_id_token)
+    else:
+        return PlainTextResponse(content="No ORCiD cookie found. Did you log in?")
+
+
+@router.post("/token", response_model=Token)
+async def login_for_access_token(
+    form_data: OAuth2PasswordOrClientCredentialsRequestForm = Depends(),
+    mdb: pymongo.database.Database = Depends(get_mongo_db),
+):
+    if form_data.grant_type == "password":
+        user = authenticate_user(mdb, form_data.username, form_data.password)
+        if not user:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Incorrect username or password",
+                headers={"WWW-Authenticate": "Bearer"},
+            )
+        access_token_expires = timedelta(**ACCESS_TOKEN_EXPIRES.model_dump())
+        access_token = create_access_token(
+            data={"sub": f"user:{user.username}"}, expires_delta=access_token_expires
+        )
+    else:  # form_data.grant_type == "client_credentials"
+        # If the HTTP request didn't include a Client Secret, we validate the Client ID as an ORCID JWT.
+        # We get a username from that ORCID JWT and fetch the corresponding user record from our database,
+        # creating that user record if it doesn't already exist.
+        if not form_data.client_secret:
+            try:
+                payload = jws.verify(
+                    form_data.client_id,
+                    ORCID_JWK,
+                    algorithms=[ORCID_JWS_VERITY_ALGORITHM],
+                )
+                payload = json.loads(payload.decode())
+                issuer: str = payload.get("iss")
+                if issuer != ORCID_BASE_URL:
+                    raise credentials_exception
+                subject: str = payload.get("sub")
+                user = get_user(mdb, subject)
+                if user is None:
+                    mdb.users.insert_one(
+                        UserInDB(
+                            username=subject,
+                            hashed_password=get_password_hash(generate_secret()),
+                        ).model_dump(exclude_unset=True)
+                    )
+                    user = get_user(mdb, subject)
+                assert user is not None, "failed to create orcid user"
+                access_token_expires = timedelta(**ACCESS_TOKEN_EXPIRES.model_dump())
+                access_token = create_access_token(
+                    data={"sub": f"user:{user.username}"},
+                    expires_delta=access_token_expires,
+                )
+
+            except JWTError:
+                raise credentials_exception
+        else:  # form_data.client_secret
+            site = authenticate_site_client(
+                mdb, form_data.client_id, form_data.client_secret
+            )
+            if not site:
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail="Incorrect client_id or client_secret",
+                    headers={"WWW-Authenticate": "Bearer"},
+                )
+            # TODO make below an absolute time
+            access_token_expires = timedelta(**ACCESS_TOKEN_EXPIRES.model_dump())
+            access_token = create_access_token(
+                data={"sub": f"client:{form_data.client_id}"},
+                expires_delta=access_token_expires,
+            )
+    return {
+        "access_token": access_token,
+        "token_type": "bearer",
+        "expires": ACCESS_TOKEN_EXPIRES.model_dump(),
+    }
+
+
+@router.get(
+    "/users/me",
+    response_model=User,
+    response_model_exclude_unset=True,
+    name="Get User Information",
+    description="Get information about the logged-in user",
+)
+async def read_users_me(current_user: User = Depends(get_current_active_user)):
+    return current_user
+
+
+def check_can_create_user(requester: User):
+    if "nmdc-runtime-useradmin" not in requester.site_admin:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="only admins for site nmdc-runtime-useradmin are allowed to create users.",
+        )
+
+
+@router.post(
+    "/users",
+    status_code=status.HTTP_201_CREATED,
+    response_model=User,
+    name="Create User",
+    description="Create new user (Admin Only)",
+)
+def create_user(
+    user_in: UserIn,
+    requester: User = Depends(get_current_active_user),
+    mdb: pymongo.database.Database = Depends(get_mongo_db),
+):
+    check_can_create_user(requester)
+    mdb.users.insert_one(
+        UserInDB(
+            **user_in.model_dump(),
+            hashed_password=get_password_hash(user_in.password),
+        ).model_dump(exclude_unset=True)
+    )
+    return mdb.users.find_one({"username": user_in.username})
+
+
+@router.put(
+    "/users",
+    status_code=status.HTTP_200_OK,
+    response_model=User,
+    name="Update User",
+    description="Update information about the user having the specified username (Admin Only)",
+)
+def update_user(
+    user_in: UserIn,
+    requester: User = Depends(get_current_active_user),
+    mdb: pymongo.database.Database = Depends(get_mongo_db),
+):
+    check_can_create_user(requester)
+    username = user_in.username
+
+    if user_in.password:
+        user_dict = UserInDB(
+            **user_in.model_dump(),
+            hashed_password=get_password_hash(
+                user_in.password
+            ),  # Store the password hash
+        ).model_dump(exclude_unset=True)
+    else:
+        user_dict = UserIn(
+            **user_in.model_dump(),
+        ).model_dump(exclude_unset=True)
+
+    mdb.users.update_one({"username": username}, {"$set": user_dict})
+    return mdb.users.find_one({"username": user_in.username})