Repository navigation
Test/upstream merge 2026 10 07 - #9
Merged
Merged
Conversation
Update passport flow for DRS to skip google group sync when accessing files stored in non-GS locations
…nc-on-s3 Don't google group sync on non-GS access
Updates fence to include the DRS endpoint for bulk presigned url generation. Updates fence download api to support bulk presigned-url generation adding support for vector download fix fstring escape add model to vec get change route for vector download update vector return add vec class add debug statement for vec fix requests url fix request protocol for vec signed url adding vector upload fix import and add logging fix function typo remove old code update indexd post params remove more old code fix string in url fix string escape typo ensure md5 is not used for security add bulk download add bulk download bulk download with authz role caching add function definiton fix class call clean up imports update function arguments fix loop actions of bulk to only support download actions of bulk to only support download fix escape quotes no actions for bulk downloads fix bulk actions fix bulk download return reformat bulk response change ems service name change service networking for embedding management service Remove Embeddings work, add TODOs Remove VecIndexdFIleLocation In Progress Finish endpoint in ga4gh.py and fill out indexd.py fix drs input variable name add unit tests Fixes for Kyle extra tests for final changes Add gen3-code-vigil tests address spencer's comments audit, openapi, and some test fixes acl no authz case for auth flow mock index_document instead of endpoint directly One last unit test change to get past 500 (still other errors) move acl-only else block add guard to bulk path, implement UserError Add unit tests for DRS 1.5 bulk presigned url Add docs for pytests addressing more comments relock poetry Remove no longer necessary username = auth_info line Remove BulkObjectAccessRequest and passport support from bulk /download enpdoint separate out data models as requested by Alex Store passport Add __passport endpoint Fix passport Remove old passports when adding new passport move ga4gh data models back into ga4gh.py to top on request from Kyle Revert "Merge branch 'chore/add-passport-to-userinfo' into feat/add-bulk-presigned-url" This reverts commit 4c6fde5, reversing changes made to 96f6284. Co-authored-by: jacob50231 <jacobdaugherty@uchicago.edu> Co-authored-by: MichaelLukowski <mlukowski@uchicago.edu>
…ass, replace file_ids with guids, add docstrings, extract request info at blueprint route level, remove vec encoding)
…aud (uc-cdis#1356) * validate audience = 'gen3' * fix client_id in audience * generate access token with additional aud * add custom exp * update authutils * force adding TES aud to token from API key * fix * query param instead of body * fix for old API keys and tokens * do not force add work_order param * comment * clean up * fix revoke invalid token logic * client can revoke access token * add token revocation and check status endpoints * update swagger doc * update comments * simplify /token/blacklisted endpoint * add log * fix unit tests * unit tests * more expiration checks * add authz check * fix test * latest commit of authutils branch * fix to accept gen3-workflow s3 endpoint auth header * handle blacklisted expired token * fix typo * remove custom revoke endpoint, no regular token revocation, remove scopes from aud * validate_jwt does not check if regular token is blacklisted * authz check * revert 400 to 200 for genwf s3 endpoint use case * rename work order token => task token * update openapi doc * fix getting auth mapping * fix: task token can only be used for the specific task * clean up * Add Caching of Blakclisted tokens, other small improvements. * Update task_tokens.md * Remove accidental commit of release notes.md * Update secrets baseline * Respond to PR comments. * Update `can_user_get_task_token` implementation based on the PR comments. * Clarifying comments and revert `/cdis/access_token` * Respond to PR comments * Add FIFO cache and bring back `EXP_ERR_TOLERANCE` * Prevent audeince mismatch error. * Update `is_task_token` functionality to be based on `claims["context"]["task_token_type"]` * Include api key in test_revoke tests. Rename blacklist to denylist wherever needed. * Replace `aud="gen3"` with a constant ; separate larger unit tests * Provide only default scopes for task token * Add "user" scope to task token * Update config to have Default Task token scopes * Update pyproject and poetry to pin authutils to >=8.0.0 --------- Co-authored-by: Sai Shanmukha <nss10@outlook.com>
feat(content): new endpoint for content retrieval PD-169
chore(version): bump
…token renewel in a valid session
…or-wildcard-permissions Fix issue where presigned-urls could not generate for wild card policies
feat(session): support a new configurable threshold for early access …
update gen3authz to 3.1.2
fix: bump cryptography to >=50.0.0 (CVE-2026-69247)
* update refresh token exp setup * add new tests
fix(google): generate and validate state during linking flow with Google
get_updated_token() was updating _encoded_token with a freshly-signed JWT but leaving session_token (the decoded dict) stale. get_expiration_time() reads session_token["exp"] to set the cookie Expires attribute, so the browser received a cookie that expired at the previous token's exp while the JWT value inside it was valid until a later time. Under normal use the drift grew with each renewal until the browser discarded the cookie early. Fix: decode the new token back into self.session_token immediately after signing so get_expiration_time() always reads the current exp. Also adds a regression test asserting cookie Expires == JWT exp after renewal. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…atches_token_exp Fix issue where session cookie's expiration does not match JWT token's
Version bump 13.3.2
…rkaround [PD-14] remove prometheus workaround
…d_admin policy The `indexd_admin` policy still referenced a deprecated resource for the indexd service (`/programs`). This PR updates the resource in the policy to use the indexd admin subresource under services (`/services/indexd/admin`). The [code describing the reason for this change is here](https://github.com/uc-cdis/indexd/blob/master/indexd/auth/drivers/alchemy.py#L145-L154)
Update base useryaml indexd_admin to use /services/indexd/admin resource
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
14 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.