Allow document id variant API connect, and improve user cred check when accessing variants #4455
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4455 +/- ##
==========================================
- Coverage 84.69% 84.66% -0.03%
==========================================
Files 310 310
Lines 18507 18533 +26
==========================================
+ Hits 15674 15691 +17
- Misses 2833 2842 +9 ☔ View full report in Codecov by Sentry. |
|
While thinking about this, I noticed we have a few flaws in checking if users are authorised to view things. For starters, the variant api is not really relying on its checks (which are anyway nonexistent).
Given a malicious authenticated user, it would be possible to give any fake institute and case. It is easy to see the institute and case are not really used in the variant api call: the variant_id (document_id) is complete enough without them. Even if an insitute_and_case check is introduced, the same goes, so if we had any malicious users, they could just give an institute and case they do have access to. The latter potentially generalises also to other endpoints that do not make direct use of the institute and case supplied for the check. |
|
I'll add a test as well, but the code should be there for review.
|
Co-authored-by: Chiara Rasi <[email protected]>
# Conflicts: # CHANGELOG.md
# Conflicts: # CHANGELOG.md
|
This PR adds a functionality or fixes a bug.
Prepare to fix Clinical-Genomics-Lund/gens#114 and to do Clinical-Genomics/gens#57 in the easiest way. Gens does not have any concept of institute. It cannot easily use the standard scout variant link endpoint (without resorting to more direct db reading or additional potential future api calls), or the recent pin variant api endpoint. The variant
document_iduniquely identifies a variant (includes unique case_id). Using it in the calls seems the most parsimonious, given that some extra safety measures are taken to ensure the current user really has access.En passant fix security issue with the existing variant api call.
Testing on cg-vm1 server (Clinical Genomics Stockholm)
Prepare for testing
scout-stageand the server iscg-vm1.ssh <USER.NAME>@cg-vm1.scilifelab.sesudo -iu hiseq.clinicalssh localhostpodman pssystemctl --user stop scout.targetsystemctl --user start scout@<this_branch>systemctl --user status scout.targetscout-stage) to be used for testing by other users.Testing on hasta server (Clinical Genomics Stockholm)
Prepare for testing
ssh <USER.NAME>@hasta.scilifelab.seus; paxa -u <user> -s hasta -r scout-stage. You can also use the WSGI Pax app available at https://pax.scilifelab.se/.conda activate S_scout; pip freeze | grep scout-browserbash /home/proj/production/servers/resources/hasta.scilifelab.se/update-tool-stage.sh -e S_scout -t scout -b <this_branch>us; scout --versionpaxaprocedure, which will release the allocated resource (scout-stage) to be used for testing by other users.How to test:
Expected outcome:
The functionality should be working
Take a screenshot and attach or copy/paste the output.
Review: