Skip to content

Hotfix: every request authenticates as its own user #265

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fcollman merged 1 commit into from
Oct 27, 2026
Merged

Hotfix: every request authenticates as its own user #265

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions materializationengine/app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
from materializationengine.blueprints.deltalake.api import deltalake_bp
from materializationengine.blueprints.admin.api import admin_bp, can_see_admin_page
from materializationengine.blueprints.materialize.api import mat_bp
from materializationengine.blueprints.reset_auth import init_reset_auth
from materializationengine.blueprints.upload.api import spatial_lookup_bp, upload_bp
from materializationengine.blueprints.upload.models import init_staging_database
from materializationengine.blueprints.upload.storage import StorageService
Expand Down Expand Up @@ -76,6 +77,9 @@ def create_app(config_name: str = None):
logging.getLogger("root").setLevel(app.config["LOGGING_LEVEL"])
logging.getLogger("python_jsonschema_objects").setLevel(app.config["LOGGING_LEVEL"])

# No request inherits the previous request's user (see reset_auth.py)
init_reset_auth(app)

# Initialize request-scoped database session cleanup
init_request_db_cleanup(app)

Expand Down
13 changes: 0 additions & 13 deletions materializationengine/blueprints/admin/api.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@
from middle_auth_client.decorators import dataset_from_table_id_from_request

from materializationengine import __version__
from materializationengine.blueprints.reset_auth import reset_auth
from materializationengine.redis_client import get_redis_client

admin_bp = Blueprint("mat_admin", __name__, url_prefix="/materialize/admin")
Expand Down Expand Up @@ -75,7 +74,6 @@ def can_see_admin_page() -> bool:


@admin_bp.route("/")
@reset_auth
@auth_required
def admin_page():
if not can_see_admin_page():
Expand All @@ -84,14 +82,12 @@ def admin_page():


@admin_bp.route("/api/capabilities")
@reset_auth
@auth_required
def user_capabilities():
return jsonify(capabilities())


@admin_bp.route("/api/databases")
@reset_auth
@auth_requires_admin
def databases():
from materializationengine.workflows.table_maintenance import list_databases
Expand All @@ -115,7 +111,6 @@ def _require_datastack_admin(datastack: str):


@admin_bp.route("/api/datastack/<string:datastack>/versions")
@reset_auth
@auth_required
def frozen_versions(datastack: str):
"""Frozen versions of the datastack whose databases exist (for choosing one to export)."""
Expand All @@ -126,7 +121,6 @@ def frozen_versions(datastack: str):


@admin_bp.route("/api/datastack/<string:datastack>/version/<int:version>/tables")
@reset_auth
@auth_required
def version_tables(datastack: str, version: int):
"""Tables and views of one frozen version's database."""
Expand All @@ -143,7 +137,6 @@ def version_tables(datastack: str, version: int):


@admin_bp.route("/api/datastack/<string:datastack>/version/<int:version>/annotation_tables")
@reset_auth
@auth_required
def version_annotation_tables(datastack: str, version: int):
"""The annotation tables recorded for a frozen version (what a virtual version may include)."""
Expand Down Expand Up @@ -214,7 +207,6 @@ def virtual_target_status(source: str, name: str) -> dict:


@admin_bp.route("/api/datastack/<string:datastack>/virtual_targets")
@reset_auth
@auth_required
def virtual_targets(datastack: str):
"""Other datastacks on this datastack's aligned volume, which can hold its virtual versions."""
Expand All @@ -237,7 +229,6 @@ def virtual_targets(datastack: str):


@admin_bp.route("/api/datastack/<string:datastack>/virtual_target/<string:name>")
@reset_auth
@auth_required
def virtual_target(datastack: str, name: str):
"""Readiness of one (possibly new) datastack name to hold virtual versions."""
Expand Down Expand Up @@ -281,14 +272,12 @@ def upload_jobs(datastack: str = None) -> list:


@admin_bp.route("/api/uploads")
@reset_auth
@auth_requires_admin
def uploads():
return jsonify({"jobs": upload_jobs(request.args.get("datastack") or None)})


@admin_bp.route("/api/repack/jobs")
@reset_auth
@auth_requires_admin
def repack_jobs():
from materializationengine.workflows.table_maintenance import list_repack_jobs
Expand Down Expand Up @@ -321,14 +310,12 @@ def queue_status() -> dict:


@admin_bp.route("/api/queues")
@reset_auth
@auth_requires_admin
def queues():
return jsonify(queue_status())


@admin_bp.route("/api/datastacks")
@reset_auth
@auth_requires_admin
def datastacks():
"""Datastacks this deployment materializes (the workflows on the Materialization tab take one)."""
Expand Down
9 changes: 0 additions & 9 deletions materializationengine/blueprints/client/api.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@
add_warnings_to_headers,
update_notice_text_warnings,
)
from materializationengine.blueprints.reset_auth import reset_auth
from materializationengine.database import db_manager, dynamic_annotation_cache
from materializationengine.info_client import (
get_aligned_volumes,
Expand Down Expand Up @@ -111,7 +110,6 @@ def check_aligned_volume(aligned_volume):

@client_bp.route("/datastack/<string:datastack_name>/versions")
class DatastackVersions(Resource):
@reset_auth
@auth_requires_permission("view", table_arg="datastack_name")
@client_bp.doc("datastack_versions", security="apikey")
def get(self, datastack_name: str):
Expand Down Expand Up @@ -142,7 +140,6 @@ def get(self, datastack_name: str):

@client_bp.route("/datastack/<string:datastack_name>/version/<int:version>")
class DatastackVersion(Resource):
@reset_auth
@auth_requires_permission("view", table_arg="datastack_name")
@client_bp.doc("version metadata", security="apikey")
def get(self, datastack_name: str, version: int):
Expand Down Expand Up @@ -174,7 +171,6 @@ def get(self, datastack_name: str, version: int):

@client_bp.route("/datastack/<string:datastack_name>/metadata")
class DatastackMetadata(Resource):
@reset_auth
@auth_requires_permission("view", table_arg="datastack_name")
@client_bp.doc("all valid version metadata", security="apikey")
def get(self, datastack_name: str):
Expand Down Expand Up @@ -204,7 +200,6 @@ def get(self, datastack_name: str):

@client_bp.route("/datastack/<string:datastack_name>/version/<int:version>/tables")
class FrozenTableVersions(Resource):
@reset_auth
@auth_requires_permission("view", table_arg="datastack_name")
@client_bp.doc("get_frozen_tables", security="apikey")
def get(self, datastack_name: str, version: int):
Expand Down Expand Up @@ -246,7 +241,6 @@ def get(self, datastack_name: str, version: int):
"/datastack/<string:datastack_name>/version/<int:version>/table/<string:table_name>/metadata"
)
class FrozenTableMetadata(Resource):
@reset_auth
@auth_requires_permission("view", table_arg="datastack_name")
@client_bp.doc("get_frozen_table_metadata", security="apikey")
def get(self, datastack_name: str, version: int, table_name: str):
Expand Down Expand Up @@ -293,7 +287,6 @@ def get(self, datastack_name: str, version: int, table_name: str):
"/datastack/<string:datastack_name>/version/<int:version>/table/<string:table_name>/count"
)
class FrozenTableCount(Resource):
@reset_auth
@auth_requires_permission("view", table_arg="datastack_name")
@validate_datastack
@client_bp.doc("simple_query", security="apikey")
Expand Down Expand Up @@ -336,7 +329,6 @@ def get(
"/datastack/<string:datastack_name>/version/<int:version>/table/<string:table_name>/query"
)
class FrozenTableQuery(Resource):
@reset_auth
@auth_requires_permission("view", table_arg="datastack_name")
@validate_datastack
@client_bp.doc("simple_query", security="apikey")
Expand Down Expand Up @@ -425,7 +417,6 @@ def post(
@client_bp.expect(query_parser)
@client_bp.route("/datastack/<string:datastack_name>/version/<int:version>/query")
class FrozenQuery(Resource):
@reset_auth
@auth_requires_permission("view", table_arg="datastack_name")
@validate_datastack
@client_bp.doc("complex_query", security="apikey")
Expand Down
Loading
Loading