Syncing to upstream repo

.deepsource.toml

@@ -0,0 +1,9 @@
+version = 1
+
+[[analyzers]]
+name = "python"
+enabled = true
+
+  [analyzers.meta]
+  runtime_version = "3.x.x"
+  max_line_length = 200

.github/workflows/api-validation.yml

@@ -0,0 +1,132 @@
+name: API Validation with Schemathesis
+
+on:
+  pull_request:
+  push:
+    branches: [ main ]
+
+jobs:
+  schemathesis:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Checkout schema validator repository
+      uses: actions/checkout@v4
+      with:
+        repository: doe-iri/iri-facility-api-docs
+        ref: main
+        path: schema-validator
+        token: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.13"
+
+    - name: Install uv
+      run: pip install uv
+
+    - name: Build an image
+      run: docker build --platform=linux/amd64 -t iri-facility-api-base .
+
+    - name: Run Facility API container
+      run: |
+        docker run -d \
+          -p 8000:8000 \
+          --platform=linux/amd64 \
+          --name iri-facility-api-base \
+          -e IRI_API_ADAPTER_facility=app.demo_adapter.DemoAdapter \
+          -e IRI_API_ADAPTER_status=app.demo_adapter.DemoAdapter \
+          -e IRI_API_ADAPTER_account=app.demo_adapter.DemoAdapter \
+          -e IRI_API_ADAPTER_compute=app.demo_adapter.DemoAdapter \
+          -e IRI_API_ADAPTER_filesystem=app.demo_adapter.DemoAdapter \
+          -e IRI_API_ADAPTER_task=app.demo_adapter.DemoAdapter \
+          -e API_URL_ROOT=http://127.0.0.1:8000 \
+          -e IRI_API_TOKEN=12345 \
+          iri-facility-api-base
+
+    - name: Wait for API to be ready
+      run: |
+        for i in {1..60}; do
+          if curl -fs http://127.0.0.1:8000/openapi.json; then
+            echo "API ready"
+            exit 0
+          fi
+          sleep 2
+        done
+        echo "API did not start"
+        exit 1
+
+    - name: Create venv & install validator dependencies
+      run: |
+        uv venv
+        source .venv/bin/activate
+        uv pip install -r schema-validator/verification/requirements.txt
+
+    - name: Run Schemathesis validation (local spec)
+      id: schemathesis_local
+      env:
+        IRI_API_TOKEN: "12345" # This is dummy token for testing (mock adapter)
+      run: |
+        set +e
+        source .venv/bin/activate
+        python schema-validator/verification/api-validator.py \
+          --baseurl http://127.0.0.1:8000 \
+          --report-name schemathesis-local
+        echo "exitcode=$?" >> $GITHUB_OUTPUT
+
+    - name: Run Schemathesis validation (official spec)
+      id: schemathesis_official
+      env:
+        IRI_API_TOKEN: "12345"
+      run: |
+        set +e
+        source .venv/bin/activate
+        python schema-validator/verification/api-validator.py \
+          --baseurl http://localhost:8000 \
+          --schema-url https://raw.githubusercontent.com/doe-iri/iri-facility-api-docs/refs/heads/main/specification/openapi/all_spec.yaml \
+          --report-name schemathesis-official
+        echo "exitcode=$?" >> $GITHUB_OUTPUT
+
+    - name: Fail if any Schemathesis run failed
+      if: always()
+      run: |
+        if [ "${{ steps.schemathesis_local.outputs.exitcode }}" != "0" ] || \
+          [ "${{ steps.schemathesis_official.outputs.exitcode }}" != "0" ]; then
+          echo "One or more Schemathesis validations failed"
+          exit 1
+        else
+          echo "Both Schemathesis validations passed"
+        fi
+
+    - name: Upload Schemathesis report # This only works on git actions
+      if: always() && env.ACT != 'true'
+      uses: actions/upload-artifact@v4
+      with:
+        if-no-files-found: warn
+        name: schemathesis-report
+        path: |
+          schemathesis-local.html
+          schemathesis-local.xml
+          schemathesis-official.html
+          schemathesis-official.xml
+
+    - name: Save Schemathesis reports locally # This only works if run locally with act
+      if: always() && env.ACT == 'true'
+      run: |
+        mkdir -p artifacts
+        cp schemathesis-local.html schemathesis-local.xml artifacts/ || true
+        cp schemathesis-official.html schemathesis-official.xml artifacts/ || true
+
+    - name: Dump API logs
+      if: always()
+      run: docker logs iri-facility-api-base || true
+
+    - name: Stop container
+      if: always()
+      run: docker stop iri-facility-api-base || true

.gitignore

@@ -6,8 +6,6 @@ iri_sandbox
 .env
 uv.lock
 docs/
-Makefile
-pyproject.toml
 .DS_Store
 data/
 app/s3df/coact-models.py
@@ -16,4 +14,5 @@ app/s3df/clients/IMPLEMENTATION.md
 set_env.sh
 test_compute.sh
 fastapi.log
-compute-tests/
+compute-tests/
+local.env

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.13-slim
+FROM python:3.13
 
 RUN mkdir /app
 COPY . /app
@@ -14,4 +14,3 @@ ENV DEX_ISSUER="https://dex.slac.stanford.edu"
 
 
 CMD ["fastapi", "run", "app/main.py", "--port", "8000"]
-

Makefile

@@ -1,47 +1,104 @@
-dev : .venv
-	@source ./.venv/bin/activate && \
-		IRI_API_ADAPTER_status=app.demo_adapter.DemoAdapter \
-		IRI_API_ADAPTER_account=app.demo_adapter.DemoAdapter \
-		IRI_API_ADAPTER_compute=app.demo_adapter.DemoAdapter \
-		IRI_API_ADAPTER_filesystem=app.demo_adapter.DemoAdapter \
-		IRI_API_ADAPTER_task=app.demo_adapter.DemoAdapter \
-		API_URL_ROOT='http://127.0.0.1:8000' fastapi dev
+PYTHON      := python3.13
+VENV        := .venv
+BIN         := $(VENV)/bin
+UV          := uv
+PIP         := $(BIN)/pip
 
+STAMP_VENV  := $(VENV)/.created
+STAMP_DEPS  := $(VENV)/.deps
 
-dev-s3df : .venv
-	@source ./.venv/bin/activate && \
-		IRI_API_ADAPTER_account=app.s3df.account_adapter.S3DFAccountAdapter \
-		COACT_API_URL='https://coact-dev.slac.stanford.edu/graphql-service-dev' \
-		IRI_SHOW_MISSING_ROUTES='true' \
-		API_URL_ROOT='http://127.0.0.1:8000' fastapi dev
+.DEFAULT_GOAL := dev
 
+$(STAMP_VENV):
+	$(UV) venv $(VENV)
+	touch $(STAMP_VENV)
+
+.venv: $(STAMP_VENV)
+
+$(STAMP_DEPS): $(STAMP_VENV) pyproject.toml
+	$(UV) pip install --python $(BIN)/python -e .
+	$(UV) pip install --python $(BIN)/python \
+		ruff \
+		pylint \
+		bandit
+	touch $(STAMP_DEPS)
+
+deps: $(STAMP_DEPS)
+
+dev: deps
+	@source $(BIN)/activate && \
+	[ -f local.env ] && source local.env || true && \
+	IRI_API_ADAPTER_facility=app.demo_adapter.DemoAdapter \
+	IRI_API_ADAPTER_status=app.demo_adapter.DemoAdapter \
+	IRI_API_ADAPTER_account=app.demo_adapter.DemoAdapter \
+	IRI_API_ADAPTER_compute=app.demo_adapter.DemoAdapter \
+	IRI_API_ADAPTER_filesystem=app.demo_adapter.DemoAdapter \
+	IRI_API_ADAPTER_task=app.demo_adapter.DemoAdapter \
+	DEMO_QUEUE_UPDATE_SECS=2 \
+	OPENTELEMETRY_ENABLED=true \
+	API_URL_ROOT='http://localhost:8000' fastapi dev
+
+dev-s3df: deps
+	@source $(BIN)/activate && \
+	IRI_API_ADAPTER_account=app.s3df.account_adapter.S3DFAccountAdapter \
+	COACT_API_URL='https://coact-dev.slac.stanford.edu/graphql-service-dev' \
+	IRI_SHOW_MISSING_ROUTES='true' \
+	API_URL_ROOT='http://127.0.0.1:8000' fastapi dev
 
 # --- Docker / GHCR targets ---
 GHCR_USERNAME ?= ""
 GHCR_IMAGE ?= ghcr.io/$(GHCR_USERNAME)/iri-s3df
 IMAGE_TAG  ?= dev
 
-# build for linux/amd64 (for now, since coact client only works on linux)
 docker-build:
 	docker build --platform linux/amd64 -t $(GHCR_IMAGE):$(IMAGE_TAG) .
 
 docker-push: docker-build
 	docker push $(GHCR_IMAGE):$(IMAGE_TAG)
 
-# Test coact client locally inside the container (needs password)
 docker-test-coact:
 	@docker run --rm -it \
 		-e COACT_SERVICE_PASSWORD \
 		$(GHCR_IMAGE):$(IMAGE_TAG) \
 		python -m app.s3df.clients.example
 
+.PHONY: clean
+clean:
+	rm -rf iri_sandbox
+	rm -rf .venv
 
-.venv:
-	@uv venv
-	@uv pip install -e .
+# Format and lint
+format: deps
+	$(BIN)/ruff format --line-length 200 .
 
+ruff: deps
+	$(BIN)/ruff check . --fix || true
 
-.PHONY: clean
-clean:
-	@rm -rf iri_sandbox
-	@rm -rf .venv
+pylint: deps
+	find . -path ./$(VENV) -prune -o -type f -name "*.py" -print0 | while IFS= read -r -d '' f; do \
+		echo "Pylint $$f"; \
+		$(BIN)/pylint $$f --rcfile pylintrc || true; \
+	done
+
+# Security
+audit: deps
+	uv pip compile pyproject.toml -o requirements.txt
+	uv pip sync requirements.txt
+	uv pip install pip-audit
+	$(BIN)/pip-audit || true
+	rm -f requirements.txt
+
+bandit: deps
+	$(BIN)/bandit -r app || true
+
+# Full validation bundle
+lint: clean format ruff pylint audit bandit
+
+globus: deps
+	@source local.env && $(BIN)/python ./tools/globus.py
+
+ARGS ?=
+
+# call it via: make manage-globus ARGS=scopes-show
+manage-globus: deps
+	@source local.env && $(BIN)/python ./tools/manage_globus.py $(ARGS)

README.md

@@ -5,7 +5,7 @@ See it live:
 
 - NERSC instance:
    - API docs: https://api.iri.nersc.gov
-   - API requests: https://api.iri.nersc.gov/nersc/api/v1/
+   - API requests: https://api.iri.nersc.gov/api/v1/
 - ALCF instance:
    - API docs: https://api.alcf.anl.gov
    - API requests: https://api.alcf.anl.gov/api/v1/
@@ -51,6 +51,8 @@ If using docker (see next section), your dockerfile could extend this reference
 - `API_URL_ROOT`: the base url when constructing links returned by the api (eg.: https://iri.myfacility.com)
 - `API_PREFIX`: the path prefix where the api is hosted. Defaults to `/`. (eg.: `/api`)
 - `API_URL`: the path to the api itself. Defaults to `api/v1`.
+- `OPENTELEMETRY_ENABLED`: Enables OpenTelemetry. If enabled, the application will use OpenTelemetry SDKs and emit traces, metrics, and logs. Default to false
+- `OTLP_ENDPOINT`: OpenTelemetry Protocol collector endpoint to export telemetry data. If empty or not set, telemetry data is logged locally to log file. Default: ""
 
 Links to data, created by this api, will concatenate these values producing links, eg: `https://iri.myfacility.com/my_api_prefix/my_api_url/projects/123`
 
@@ -119,11 +121,25 @@ ENV IRI_API_PARAMS='{ \
 }'
 ```
 
+## Globus auth integration
+
+You can optionally use globus for authorization. Steps to use globus:
+- ask someone to add your globus account to the IRI Resource Server
+- log into globus and make a secret for yourself for the IRI Resource Server
+- if you want to create tokens during developent, also create a separate globus app
+- `cp local-template.env local.env` and fill in the missing values
+- to mint a token, run `make globus`, click the link and copy the code from the browser url bar back into the terminal
+- you can also run `make manage-globus` but be sure to not accidentally delete the `iri-api` scope. (Maybe it's better if you don't run this app)
+- now you can run `make` for the dev server and enjoy using your globus iri access tokens (in the demo adapter they will all resolve to the user `gtorok`)
+- for your facility:
+   - implement the `get_current_user_globus` method (see iri_adapter.py). Here you can look at the linked globus identities and session info to determine what the local username is
+   - make sure the values in `local.env` are available in the deployed app
+
 ## Next steps
 
 - Learn more about [fastapi](https://fastapi.tiangolo.com/), including how to run it [in production](https://fastapi.tiangolo.com/advanced/behind-a-proxy/)
-- Instead of the simulated state, keep real data in a [database](/Users/gtorok/dev/iri-api-python/README.md)
-- Add monitoring by [integrating with OpenTelemetry](https://opentelemetry.io/docs/zero-code/python/)
+- Instead of the simulated state, keep real data in a database
+- Specify the monitoring endpoint by setting the [OpenTelemetry](https://opentelemetry.io/docs/zero-code/python/) env vars
 - Add additional routers for other API-s
 - Add authenticated API-s via an [OAuth2 integration](https://fastapi.tiangolo.com/tutorial/security/oauth2-jwt/)
 

app/__init__.py

@@ -1,2 +1,3 @@
-from pkgutil import extend_path
-__path__ = extend_path(__path__, __name__)
+from pkgutil import extend_path
+
+__path__ = extend_path(__path__, __name__)

app/apilogger.py

@@ -0,0 +1,28 @@
+"""Logging utilities for the IRI Facility API."""
+import logging
+
+LEVELS = {"FATAL": logging.FATAL,
+          "ERROR": logging.ERROR,
+          "WARNING": logging.WARNING,
+          "INFO": logging.INFO,
+          "DEBUG": logging.DEBUG}
+
+
+def get_stream_logger(name: str = __name__, level: str = "DEBUG") -> logging.Logger:
+    """
+    Return a configured Stream logger.
+    """
+    logger = logging.getLogger(name)
+
+    if not logger.handlers:
+        handler = logging.StreamHandler()
+
+        formatter = logging.Formatter("%(asctime)s.%(msecs)03d - %(name)s - %(levelname)s - %(message)s", datefmt="%a, %d %b %Y %H:%M:%S")
+
+        handler.setFormatter(formatter)
+        logger.addHandler(handler)
+
+    logger.setLevel(LEVELS.get(level, logging.DEBUG))
+    logger.propagate = False
+
+    return logger