Make sync-experiment Tiled-based#234
Make sync-experiment Tiled-based#234Nathanael (Nate) Maytan (nmaytan) wants to merge 24 commits intoNSLS2:mainfrom
Conversation
|
This will close #189. A few touch-ups still needed. We also agree that we need a "desync experiment" command. This has been discussed before, but is now even a bit more useful when using API key for auth (effectively can work like a logout) |
Experiments (proposals) are "authorized". Then, one of the authorized experiments is "activated". Multiple proposals may be authorized at the same time, but only one proposal can be active at a time. This should make more clear what the tool is doing, and how the policy works, as opposed to before (authorize/activate vs activate/select or activate/load). Includes some other minor word fixes.
…ormalized_beamline
| "/v1/facility/nsls2/cycles/current" | ||
| ).raise_for_status() | ||
| return cycle_response.json()["cycle"] | ||
| print( |
There was a problem hiding this comment.
Do we have a proper logger for this already? I guess, printing is okay still.
There was a problem hiding this comment.
A reflection on this: in its current implementation, this is a CLI tool (+callable from Python). I typically don't expect tools I call from terminal to print to syslog, for example. That is, unless I'm doing something with services, which this tool isn't exactly quite yet. It does set information in Redis for us, maybe that is sort of service like, but I'm not bought in.
Not to say that using a logger for this == we have to put things in syslog, but thinking in terms of intent/patterns. I don't think I'd expect this version of the tool to be logging. And I'm also not sure I'd put Redis metadata in the logs on random workstations.
Also, when I call verbose with a terminal command I'm expecting more stdout/stderr to appear in the stream. Sometimes that is also logged, but I don't expect it to mean "turn on logging".
So, I think I favor that this remains a print for now.
|
Updated to greedily revoke the existing API key rather than cache+rotate, enabled by the This also gets us closer to ready for OIDC, where we wouldn't have had a password to encrypt the keys with. Probably just two more things needed?
Tested current changes and seems to work well. More to come for OIDC when available to test with. edit: also need to change root_node tag -> beamline tag when then change goes through server-side |
|
Nathanael (Nate) Maytan (@nmaytan) Can you try to merge this soon? We need ESM arpes to be on a new release of nslsii |
Summary of changes so far:
md['data_sessions_authorized']switch_proposallet's you rotate through any proposals that are currently activatedpassword_grantonly for now, but could use any auth flow that Tiled supports (sets us up for the future, i.e. OIDC)sync-experimentruns, reducing the need to have multiple logins (API key will be used for subsequent Tiled clients)API keys are cached in Redis and managed with a priority queue based on expiration date. Keys are set to expire after 7 days.5 keys can be cached at a time - each combination of username + proposal list counts as a new keyOnly one API key is left unencrypted at a time, and it is put in Redis under a specific key so that it can be retrieved from other applications without decrypting itThe rest of the cached keys remain encrypted in Redis until they are needed