11 apache polaris planning and implementation

.github/copilot-instructions.md

@@ -0,0 +1,9 @@
+Context:
+- the `teehr` repo which is a python library that contains the scientific code for the teehr environment. This contains code to fetch, validate, store, and analyze hydrologic forecast and simulation data against observations. It works on the concept of an Evaluation which references either a local or remote warehouse and a relates spark session.
+- the `teehr-cloud-core` repo contains the main shared teehr-cloud components such as authentication, jupyterhub, Apache Iceberg warehouse, web api, Trino query engine, spark-executors, prefect server, etc.  teehr-cloud-core utilizes the teehr library.
+- the `teehr-cloud-platform` repo contains terraform IaC for creating an AWS environment that can host a teehr-cloud deployment.
+- the `teehr-hub` and `teehr-fved` repos have `teehr-cloud-core` as a submodule and are deployments of `teehr` and `teehr-cloud-core`.  They also contain deployment specific components such as frontend dashboards, deployment specific prefect workflows and warehouse setup and maintenance code, certificates, etc.
+
+Don't make any changes in the `teehr-cloud-core` submodules to `teehr-hub` and `teehr-fved`.  Only make changes in the `teehr-cloud-core` repo and then update the submodules in the deployments.
+
+Make all changes to the cluster via code. Running one-off commands via kubectl or other tools is not allowed.  All changes must be made via code and then applied to the cluster via CI/CD pipelines.  This ensures that all changes are tracked in version control and can be rolled back if necessary.

README.md

@@ -120,4 +120,6 @@ Now the fun of adding new features and bug fixes starts.
 When working on the API or the frontend it is convenient to have code syncing.  Code syncing can be done in `garden` by running:
 ```bash
 garden deploy --sync
-```
+```
+
+test commit.

api/manifests/configmap.yaml.tpl

@@ -15,7 +15,18 @@ data:
   KEYCLOAK_ISSUER_URL: "https://auth.${var.hostname}/realms/teehr"
   KEYCLOAK_JWKS_URL: "http://keycloak-service:8080/realms/teehr/protocol/openid-connect/certs"
   KEYCLOAK_AUDIENCE: "teehr-api"
-  KEYCLOAK_ALLOWED_AUDIENCES: "teehr-api,teehr-frontend"
+  KEYCLOAK_ALLOWED_AUDIENCES: "teehr-api,teehr-frontend,jupyterhub"
+  BROKER_TOKEN_EXCHANGE_ENABLED: "true"
+  BROKER_TOKEN_ENDPOINT: "http://keycloak-service:8080/realms/teehr/protocol/openid-connect/token"
+  BROKER_OAUTH_CLIENT_ID: "teehr-api"
+  BROKER_OAUTH_CLIENT_SECRET: ""
+  BROKER_TARGET_AUDIENCE: "account"
+  BROKER_DEFAULT_SCOPE: "openid profile email"
+  BROKER_MIN_TTL_SECONDS: "120"
+  BROKER_MAX_TTL_SECONDS: "900"
+  BROKER_REQUEST_TIMEOUT_SECONDS: "10"
+  BROKER_SUBJECT_CLIENT_ID: "jupyterhub"
+  BROKER_DELEGATED_SESSION_TTL_SECONDS: "43200"
   ANON_RATE_LIMIT_RPM: "20"
   AUTH_RATE_LIMIT_RPM: "120"
   ROW_LIMIT_ANON: "200"

api/manifests/deployment.yaml.tpl

@@ -76,6 +76,76 @@ spec:
             configMapKeyRef:
               name: teehr-api-config
               key: KEYCLOAK_ALLOWED_AUDIENCES
+        - name: BROKER_TOKEN_EXCHANGE_ENABLED
+          valueFrom:
+            configMapKeyRef:
+              name: teehr-api-config
+              key: BROKER_TOKEN_EXCHANGE_ENABLED
+        - name: BROKER_TOKEN_ENDPOINT
+          valueFrom:
+            configMapKeyRef:
+              name: teehr-api-config
+              key: BROKER_TOKEN_ENDPOINT
+        - name: BROKER_OAUTH_CLIENT_ID
+          valueFrom:
+            configMapKeyRef:
+              name: teehr-api-config
+              key: BROKER_OAUTH_CLIENT_ID
+        - name: BROKER_OAUTH_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: teehr-api-secrets
+              key: client-secret
+        - name: BROKER_TARGET_AUDIENCE
+          valueFrom:
+            configMapKeyRef:
+              name: teehr-api-config
+              key: BROKER_TARGET_AUDIENCE
+        - name: BROKER_DEFAULT_SCOPE
+          valueFrom:
+            configMapKeyRef:
+              name: teehr-api-config
+              key: BROKER_DEFAULT_SCOPE
+        - name: BROKER_MIN_TTL_SECONDS
+          valueFrom:
+            configMapKeyRef:
+              name: teehr-api-config
+              key: BROKER_MIN_TTL_SECONDS
+        - name: BROKER_MAX_TTL_SECONDS
+          valueFrom:
+            configMapKeyRef:
+              name: teehr-api-config
+              key: BROKER_MAX_TTL_SECONDS
+        - name: BROKER_REQUEST_TIMEOUT_SECONDS
+          valueFrom:
+            configMapKeyRef:
+              name: teehr-api-config
+              key: BROKER_REQUEST_TIMEOUT_SECONDS
+        - name: BROKER_SUBJECT_CLIENT_ID
+          valueFrom:
+            configMapKeyRef:
+              name: teehr-api-config
+              key: BROKER_SUBJECT_CLIENT_ID
+        - name: BROKER_DELEGATED_SESSION_TTL_SECONDS
+          valueFrom:
+            configMapKeyRef:
+              name: teehr-api-config
+              key: BROKER_DELEGATED_SESSION_TTL_SECONDS
+        - name: BROKER_SUBJECT_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: jupyterhub
+              key: OAUTH_CLIENT_SECRET
+        - name: BROKER_SESSION_SIGNING_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: broker-secrets
+              key: session-signing-secret
+        - name: BROKER_REFRESH_TOKEN_ENCRYPTION_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: broker-secrets
+              key: refresh-token-encryption-secret
         - name: API_KEYS_DB_HOST
           value: keycloak-pg
         - name: API_KEYS_DB_PORT
@@ -97,6 +167,27 @@ spec:
               key: password
         - name: API_KEYS_DB_DSN
           value: "postgresql://$(API_KEYS_DB_USER):$(API_KEYS_DB_PASSWORD)@$(API_KEYS_DB_HOST):$(API_KEYS_DB_PORT)/$(API_KEYS_DB_NAME)"
+        - name: DELEGATED_SESSIONS_DB_HOST
+          value: keycloak-pg
+        - name: DELEGATED_SESSIONS_DB_PORT
+          value: "5432"
+        - name: DELEGATED_SESSIONS_DB_NAME
+          valueFrom:
+            secretKeyRef:
+              name: teehr-api-db-secrets
+              key: database
+        - name: DELEGATED_SESSIONS_DB_USER
+          valueFrom:
+            secretKeyRef:
+              name: teehr-api-db-secrets
+              key: username
+        - name: DELEGATED_SESSIONS_DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: teehr-api-db-secrets
+              key: password
+        - name: DELEGATED_SESSIONS_DB_DSN
+          value: "postgresql://$(DELEGATED_SESSIONS_DB_USER):$(DELEGATED_SESSIONS_DB_PASSWORD)@$(DELEGATED_SESSIONS_DB_HOST):$(DELEGATED_SESSIONS_DB_PORT)/$(DELEGATED_SESSIONS_DB_NAME)"
         - name: ANON_RATE_LIMIT_RPM
           valueFrom:
             configMapKeyRef:

api/src/auth.py

@@ -35,6 +35,8 @@ class AuthIdentity:
     auth_type: str
     roles: list[str] = field(default_factory=list)
     scopes: list[str] = field(default_factory=list)
+    preferred_username: str | None = None
+    groups: list[str] = field(default_factory=list)
 
     @property
     def is_authenticated(self) -> bool:
@@ -129,11 +131,17 @@ async def validate(self, token: str) -> AuthIdentity:
             if not subject:
                 raise HTTPException(status_code=401, detail="JWT missing subject")
 
+            groups = claims.get("groups", [])
+            if not isinstance(groups, list):
+                groups = []
+
             return AuthIdentity(
                 subject=subject,
                 auth_type="jwt",
                 roles=roles,
                 scopes=scopes,
+                preferred_username=claims.get("preferred_username"),
+                groups=[str(group) for group in groups],
             )
         except httpx.HTTPError as exc:
             logger.error("Keycloak connectivity error during token validation: %s", str(exc))
@@ -172,6 +180,16 @@ async def get_request_identity(request: Request) -> AuthIdentity:
     return identity
 
 
+def extract_bearer_token_from_request(request: Request) -> str:
+    auth_header = request.headers.get("authorization", "")
+    if not auth_header.lower().startswith("bearer "):
+        raise HTTPException(status_code=401, detail="Bearer token required")
+    token = auth_header.split(" ", 1)[1].strip()
+    if not token:
+        raise HTTPException(status_code=401, detail="Bearer token required")
+    return token
+
+
 async def get_authenticated_identity(
     identity: AuthIdentity = Depends(get_request_identity),
 ) -> AuthIdentity: