update python to 3.11 and upgrade dependencies

.github/workflows/main.yml

@@ -18,7 +18,7 @@ jobs:
     - name: Setup Python
       uses: actions/setup-python@v2
       with:
-        python-version: '3.10'
+        python-version: '3.11'
 
     - uses: actions/cache@v2
       with:
@@ -43,7 +43,7 @@ jobs:
     - name: Setup Python
       uses: actions/setup-python@v2
       with:
-        python-version: '3.10'
+        python-version: '3.11'
 
     - uses: actions/cache@v2
       with:
@@ -52,8 +52,8 @@ jobs:
 
     - name: Install Black formatter
       run:  |
-        pip install black
+        pip install black==23.11.0
 
     - name: Run Black formatter in check mode
       run: |
-        black server --target-version py310 --check
+        black server --check

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.10-buster
+FROM python:3.11-buster
 
 EXPOSE 8000
 

camino/docker-compose.yml

@@ -9,6 +9,7 @@ services:
     volumes:
       - /corral-repl/tacc/NHERI:/corral-repl/tacc/NHERI
       - /ds-mydata:/ds-mydata
+      - /frontera-scratch:/frontera-scratch
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
     logging:

pyproject.toml

@@ -5,16 +5,19 @@ description = ""
 authors = ["Jarosenb <[email protected]>"]
 
 [tool.poetry.dependencies]
-python = "3.10.10"
-uvicorn = {extras = ["standard"], version = "^0.15.0"}
-fastapi = "^0.70.0"
-agavepy = "^0.9.5"
+python = "^3.11"
+uvicorn = {extras = ["standard"], version = "^0.24.0"}
+fastapi = "^0.104.1"
 redis = "^4.0.2"
 zipfly = "^6.0.3"
 gunicorn = "^20.1.0"
+paramiko = "^3.3.1"
+requests = "^2.31.0"
+ipython = "^8.17.2"
+pickleshare = "^0.7.5"
 
 [tool.poetry.dev-dependencies]
-black = "^21.11b1"
+black = "^23.11.0"
 pytest = "^6.2.5"
 
 [build-system]

server/main.py

@@ -33,6 +33,8 @@ def get_system_root(system: str) -> str:
     match system:
         case "designsafe.storage.default":
             root_dir = "/ds-mydata"
+        case "designsafe.storage.frontera.scratch":
+            root_dir = "/frontera-scratch"
         case "designsafe.storage.community":
             root_dir = "/corral-repl/tacc/NHERI/community"
         case "designsafe.storage.published":
@@ -95,13 +97,19 @@ def check_system_access(system: str, paths: List[str], token: str) -> None:
     Confirm a user's READ access to files in a system by using their Tapis access token
     to perform a listing at the files' common path.
     """
-    try:
-        common_path = os.path.commonpath(map(lambda p: p.strip("/"), paths))
-        listing_url = (
-            f"{TAPIS_BASE_URL}"
-            "/files/v2/listings/system/"
-            f"{system}/{common_path}/?limit=1"
+
+    common_path = os.path.commonpath(map(lambda p: p.strip("/"), paths))
+    if common_path == "" and not system.startswith("project-"):
+        raise HTTPException(
+            status_code=403,
+            detail="Detected a possible attempt to access multiple home directories.",
         )
+    listing_url = (
+        f"{TAPIS_BASE_URL}"
+        "/files/v2/listings/system/"
+        f"{system}/{common_path}/?limit=1"
+    )
+    try:
         resp = requests.get(listing_url, headers={"Authorization": f"Bearer {token}"})
         resp.raise_for_status()
     except HTTPError:

server/tests/test_utils.py

@@ -124,3 +124,11 @@ def test_check_system_access_failure(mock_get_error, monkeypatch):
         "tapis.test/files/v2/listings/system/test.system/tmp/?limit=1",
         headers={"Authorization": f"Bearer {'ABC123'}"},
     )
+
+
+def test_check_system_access_403():
+    with pytest.raises(HTTPException) as excinfo:
+        check_system_access(
+            "designsafe.storage.default", ["/user1/file1", "/user2/file2"], "ABC123"
+        )
+    assert excinfo.value.status_code == 403