Skip to content

Commit

Permalink
Merge pull request #32 from CanDIG/daisieh/integration
Browse files Browse the repository at this point in the history
  • Loading branch information
daisieh authored Apr 4, 2023
2 parents 3d01b06 + 1c575e4 commit 70881fc
Show file tree
Hide file tree
Showing 25 changed files with 8 additions and 79,154 deletions.
2 changes: 1 addition & 1 deletion Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ RUN apk add --no-cache \

COPY ./ /app/

RUN pip install --no-cache-dir -r app/tests/requirements.txt
RUN pip install --no-cache-dir -r /app/requirements.txt

RUN touch initial_setup
ENTRYPOINT ["bash", "/app/entrypoint.sh"]
59 changes: 2 additions & 57 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,60 +1,5 @@
# Open Policy Agent for CanDIGv2

This is the implementation of [OPA](https://www.openpolicyagent.org/) for CanDIGv2. The OPA service provides a unified policy engine across CanDIG services.
This is the implementation of [OPA](https://www.openpolicyagent.org/) for CanDIGv2. The OPA service provides a unified policy engine across CanDIG services.

## Testing with katsu


This script creates 6 datasets *name_i*(open1, open2, registered3, controlled4, controlled5, controlled6) with one phenopacket with id *pheno_i* in each one.

Capture tokens by running:
```
TOKEN1=$( python3 ./tests/capture_token.py user1 pass1 oidc1 )
TOKEN2=$( python3 ./tests/capture_token.py user2 pass2 oidc1 )
```

then you can query katsu and see what datasets you get back:

```
curl --insecure -XGET -H "X-CANDIG-LOCAL-OIDC: \"$TOKEN1\"" 'localhost:8001/api/phenopackets'|jq '.results'|jq '[.[] | {id: .id}]'
curl --insecure -XGET -H "X-CANDIG-LOCAL-OIDC: \"$TOKEN2\"" 'localhost:8001/api/phenopackets'|jq '.results'|jq '[.[] | {id: .id}]'
```
User1 should have access to 4 datasets, open1, open2, registered3 and controlled4.
User2 should have access to 3 datasets, open1, open2, and controlled5.


What's happening here is as described below

```mermaid
sequenceDiagram
participant user2
participant keycloak
participant katsu
participant opa
user2->>keycloak: Get ID token (would normally go via _e.g._ Tyk)
keycloak-->>user2: ID token for user2
user2->>+katsu: Request data with ID token
katsu->>opa: What datasets are allowed for user2 on this reququest?
opa->>katsu: open1, open2, dataset_3, testdset3, controlled5
katsu->>-user2: Here's the data from allowed datases
```


You can also query OPA directly with a script provided:

```
python3 ./tests/lookup_permissions.py ${TOKEN2}
```

And you should get the result:
```
{"result":["open1","open2","dataset_3","testdset3","controlled5"]}
```

From here you can run the tests to make sure everything works:

```
pytest tests/test_authx.py
pytest tests/katsu_tests/
```
Opa can be tested as part of the CanDIGv2 stack: from the CanDIGv2 repo directory, run `pytest etc/tests`.
Loading

0 comments on commit 70881fc

Please sign in to comment.