feature/rbac

[bwalsh]

This PR:

• uses a forked version of indexclient

Unit Test:

• tests/unit/test_indexclient.py

Deployment:

• build a pypi distribution
• test with Introduce arborist RBAC uc-cdis/indexd#400, https://github.com/ohsu-comp-bio/fence/tree/feature/indexd-rbac

See:

• https://github.com/ohsu-comp-bio/indexclient/tree/feature/rbac
• Introduce arborist RBAC uc-cdis/indexd#400
• https://github.com/ohsu-comp-bio/fence/tree/feature/indexd-rbac

[Copilot]

Pull Request Overview

Adds a new unit test to verify that Gen3Index.get includes the authentication provider and bumps the package version.

• Introduces test_authorization_header_present in tests/unit/test_indexclient.py
• Updates package version to 0.0.7rc15

Reviewed Changes

Copilot reviewed 2 out of 5 changed files in this pull request and generated 1 comment.

File	Description
tests/unit/test_indexclient.py	Added test for auth provider being passed to requests.get
setup.py	Bumped version from 0.0.7rc14 to 0.0.7rc15

Comments suppressed due to low confidence (1)

tests/unit/test_indexclient.py:17

• [nitpick] The test name implies checking an HTTP header but it actually verifies the auth object insertion; consider renaming to test_auth_provider_passed_to_requests for clarity.

def test_authorization_header_present(index_client: Gen3Index):

[bwalsh]

Our first attempt was to fork indexclient - see https://github.com/ohsu-comp-bio/indexclient/tree/feature/rbac
This worked - as far as g3t was concerned

However - because this relied on having a dependency to a git repo, pypi was preventing us from creating a new release see pypi/warehouse#9404

Therefore, we patched indexclient in g3t, thereby removing the dependency on our fork

The same unit test works.

Re-visit this change when/if related PRs are merged:

Feature-change:

• Introduce arborist RBAC uc-cdis/indexd#400

Dependencies:

• adds auth to all gets uc-cdis/indexclient#82
• adds auth header to index uc-cdis/fence#1279
• feature/rbac calypr/calypr_etl_pod#50

[quinnwai]

Works as expected when building from source (pip install -e .) but running into issue using version directly from pypi (pip install gen3-tracker==g3t-0.0.7rc15). Specifically, on g3t push...

Publishing \/Users/wongq/data/cbds-demo/test/g3t-0.0.7rc15/lib/python3.13/site-packages/pydantic/main.py:519: UserWarning: Pydantic serializer warnings:
  PydanticSerializationUnexpectedValue(Expected `<class 'pathlib._local.Path'>` but got `<class 'NoneType'>` with value `'None'` - serialized value may not be as expected.)
  PydanticSerializationUnexpectedValue(Expected `<class 'pathlib._local.Path'>` but got `<class 'NoneType'>` with value `'None'` - serialized value may not be as expected.)
  return self.__pydantic_serializer__.to_json(
[2025-07-17 17:05:00,953][WARNING] backoff: call gen3.jobs.async_create_job(<gen3.jobs.Gen3Jobs object at 0x111812120>, fhir_import_export, {'push': {'commits': [{'commit_id': '307c333a-b442-5c05-b630-3d1177bd24a8', 'object_id': '307c333a-b442-5c05-b630-3d1177bd24a8', 'message': 'From g3t-git', 'resource_counts': None, 'exceptions': None, 'logs': None, 'path': None, 'manifest_sqlite_path': None, 'meta_path': '_cbds-qwqw-20250717-170459_meta.zip'}], 'published_timestamp': None, 'published_job': None}, 'project_id': 'cbds-qwqw', 'method': 'put'}) delay 0.4 seconds after 1 tries
Publishing \[2025-07-17 17:05:01,401][WARNING] backoff: call gen3.jobs.async_create_job(<gen3.jobs.Gen3Jobs object at 0x111812120>, fhir_import_export, {'push': {'commits': [{'commit_id': '307c333a-b442-5c05-b630-3d1177bd24a8', 'object_id': '307c333a-b442-5c05-b630-3d1177bd24a8', 'message': 'From g3t-git', 'resource_counts': None, 'exceptions': None, 'logs': None, 'path': None, 'manifest_sqlite_path': None, 'meta_path': '_cbds-qwqw-20250717-170459_meta.zip'}], 'published_timestamp': None, 'published_job': None}, 'project_id': 'cbds-qwqw', 'method': 'put'}) delay 1.2 seconds after 2 tries
Publishing |[2025-07-17 17:05:02,647][  ERROR] backoff: gave up call gen3.jobs.async_create_job(<gen3.jobs.Gen3Jobs object at 0x111812120>, fhir_import_export, {'push': {'commits': [{'commit_id': '307c333a-b442-5c05-b630-3d1177bd24a8', 'object_id': '307c333a-b442-5c05-b630-3d1177bd24a8', 'message': 'From g3t-git', 'resource_counts': None, 'exceptions': None, 'logs': None, 'path': None, 'manifest_sqlite_path': None, 'meta_path': '_cbds-qwqw-20250717-170459_meta.zip'}], 'published_timestamp': None, 'published_job': None}, 'project_id': 'cbds-qwqw', 'method': 'put'}) after 3 tries; exception: (<class 'aiohttp.client_exceptions.ClientConnectorCertificateError'>, ClientConnectorCertificateError(ConnectionKey(host='calypr-dev.ohsu.edu', port=443, is_ssl=True, ssl=True, proxy=None, proxy_auth=None, proxy_headers_hash=None), SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1028)')), <traceback object at 0x1130e5480>)
Unable to publish project. See logs/publish.log for more info
Cannot connect to host calypr-dev.ohsu.edu:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1028)')]

g3t pull an existing project works (gdc-lung) for both

[bwalsh]

Hmm. That's an ssl certificate error.
Should have nothing to do with this change?

[quinnwai]

Cool repushed, works as expected. Uncertain where that came from. Tested that on calypr-dev with indexd changes applied...

• pushing a single file works
• pulling gdc-esca
• deleting a project

🚢 it