Release 4.3.0 (#233)

Author: mboudet

CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 This changelog was started for release 4.2.0.
 
+## [4.3.0] - 2021-06-10
+
+### Added
+
+- Added 'Date' entity type, with associated Date picker in UI
+- Added API-key authentication for most endpoints. The api key should be passed with the header "X-API-KEY".
+- Added CLI (using token-auth) (https://github.com/askomics/askoclics). Still a WIP, with the python package 'askoclics'.
+- "Not" filter for categories
+- URI management in first column (and link column). Manage both full URI and CURIE. Check #223 for details.
+- 'Forms' : Minimal templates (users only access a basic form for modifying parameters, and not the graph) Restricted to admins. Form creators can customized entities and attributes display names to improve usability.
+
+### Changed
+
+- Faldo entity "Strand" now default to "faldo:BothStrandPosition" when the value is empty. The label will be "unknown/both" for CSV. For GFF and BED, "." will be "faldo:BothStrandPosition" instead of being ignored.
+- If one of the column name of a CSV file is empty, raise an Exception.
+- Now return the created result id (instead of celery task id) in the sparql query endpoint
+- Now return the created file id (instead of celery task id) in the create file endpoint
+- Fixed Flask version to < 2.0.0 due to compatibility issues
+
+
+### Fixed
+
+- Fixed the console restriction to admin/users (was not fully functional)
+- Fixed an issue with spaces (and other characters) in URIs
+- Fixed an issue with "Optional" button when using categories (and faldo entities) (either wrong values or nothing showing up) (Cf Changed category)
+- Fixed table ordering in results for numerical values (they were managed as strings)
+- Fixed UNION and MINUS blocks
+- Fixed an issue with Faldo "same strand" (clicking on the link between Faldo nodes)
+- Fixed Node/Link filter issue when using values with caps.
+
+### Security
+
+- Bump hosted-git-info from 2.8.8 to 2.8.9
+
+## [4.2.2] - 2021-06-09
+
+### Fixed
+
+- Fixed startup issue: race condition on config file creation
+
 ## [4.2.1] - 2021-03-29
 
 ### Fixed

Pipfile

@@ -5,7 +5,7 @@ name = "pypi"
 
 [packages]
 werkzeug = "==0.16.1"
-flask = "*"
+flask = "==1.1.4"
 flask-reverse-proxy-fix = "*"
 validate-email = "*"
 gunicorn = "*"
@@ -28,6 +28,7 @@ configparser = "*"
 tld = "*"
 argh = "*"
 python-ldap = "*"
+python-dateutil = "*"
 
 [dev-packages]
 pytest = "*"

Pipfile.lock

@@ -2,7 +2,7 @@
 import sys
 import traceback
 
-from askomics.api.auth import admin_required
+from askomics.api.auth import api_auth, admin_required
 from askomics.libaskomics.DatasetsHandler import DatasetsHandler
 from askomics.libaskomics.FilesHandler import FilesHandler
 from askomics.libaskomics.LocalAuth import LocalAuth
@@ -16,6 +16,7 @@
 
 
 @admin_bp.route('/api/admin/getusers', methods=['GET'])
+@api_auth
 @admin_required
 def get_users():
     """Get all users
@@ -46,6 +47,7 @@ def get_users():
 
 
 @admin_bp.route('/api/admin/getdatasets', methods=['GET'])
+@api_auth
 @admin_required
 def get_datasets():
     """Get all datasets
@@ -76,6 +78,7 @@ def get_datasets():
 
 
 @admin_bp.route('/api/admin/getfiles', methods=['GET'])
+@api_auth
 @admin_required
 def get_files():
     """Get all files info
@@ -107,6 +110,7 @@ def get_files():
 
 
 @admin_bp.route('/api/admin/getqueries', methods=['GET'])
+@api_auth
 @admin_required
 def get_queries():
     """Get all public queries
@@ -138,6 +142,7 @@ def get_queries():
 
 
 @admin_bp.route('/api/admin/setadmin', methods=['POST'])
+@api_auth
 @admin_required
 def set_admin():
     """change admin status of a user
@@ -167,6 +172,7 @@ def set_admin():
 
 
 @admin_bp.route('/api/admin/setquota', methods=["POST"])
+@api_auth
 @admin_required
 def set_quota():
     """Change quota of a user
@@ -200,6 +206,7 @@ def set_quota():
 
 
 @admin_bp.route('/api/admin/setblocked', methods=['POST'])
+@api_auth
 @admin_required
 def set_blocked():
     """Change blocked status of a user
@@ -229,6 +236,7 @@ def set_blocked():
 
 
 @admin_bp.route('/api/admin/publicize_dataset', methods=['POST'])
+@api_auth
 @admin_required
 def toogle_public_dataset():
     """Toggle public status of a dataset
@@ -269,6 +277,7 @@ def toogle_public_dataset():
 
 
 @admin_bp.route('/api/admin/publicize_query', methods=['POST'])
+@api_auth
 @admin_required
 def togle_public_query():
     """Publish a query template from a result
@@ -305,6 +314,7 @@ def togle_public_query():
 
 
 @admin_bp.route("/api/admin/adduser", methods=["POST"])
+@api_auth
 @admin_required
 def add_user():
     """Change blocked status of a user
@@ -360,6 +370,7 @@ def add_user():
 
 
 @admin_bp.route("/api/admin/delete_users", methods=["POST"])
+@api_auth
 @admin_required
 def delete_users():
     """Delete users data
@@ -411,6 +422,7 @@ def delete_users():
 
 
 @admin_bp.route("/api/admin/delete_files", methods=["POST"])
+@api_auth
 @admin_required
 def delete_files():
     """Delete files
@@ -443,6 +455,7 @@ def delete_files():
 
 
 @admin_bp.route("/api/admin/delete_datasets", methods=["POST"])
+@api_auth
 @admin_required
 def delete_datasets():
     """Delete some datasets (db and triplestore) with a celery task

askomics/api/admin.py

@@ -26,6 +26,22 @@ def decorated_function(*args, **kwargs):
     return decorated_function
 
 
+def api_auth(f):
+    """Get info from token"""
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        """Login required decorator"""
+        if request.headers.get("X-API-KEY"):
+            key = request.headers.get("X-API-KEY")
+            local_auth = LocalAuth(current_app, session)
+            authentication = local_auth.authenticate_user_with_apikey(key)
+            if not authentication["error"]:
+                session["user"] = authentication["user"]
+        return f(*args, **kwargs)
+
+    return decorated_function
+
+
 def admin_required(f):
     """Login required function"""
     @wraps(f)
@@ -69,11 +85,17 @@ def signup():
             'error': True,
             'errorMessage': "Account creation is disabled",
             'user': {}
-        }), 500
+        }), 400
 
     user = {}
 
     data = request.get_json()
+    if not data:
+        return jsonify({
+            'error': True,
+            'errorMessage': "Missing parameters",
+            'user': {}
+        }), 400
 
     local_auth = LocalAuth(current_app, session)
     local_auth.check_inputs(data)
@@ -100,6 +122,12 @@ def login():
         Information about the logged user
     """
     data = request.get_json()
+    if not (data and data.get("login") and data.get("password")):
+        return jsonify({
+            'error': True,
+            'errorMessage': "Missing login or password",
+            'user': None
+        }), 400
 
     local_auth = LocalAuth(current_app, session)
     authentication = local_auth.authenticate_user(data["login"], data["password"])
@@ -171,6 +199,11 @@ def update_profile():
         The updated user
     """
     data = request.get_json()
+    if not (data and any([key in data for key in ["newFname", "newLname", "newEmail"]])):
+        return jsonify({
+            "error": True,
+            "errorMessage": "Missing parameters"
+        }), 400
 
     local_auth = LocalAuth(current_app, session)
     updated_user = local_auth.update_profile(data, session['user'])
@@ -195,6 +228,11 @@ def update_password():
         The user
     """
     data = request.get_json()
+    if not (data and all([key in data for key in ["oldPassword", "newPassword", "confPassword"]])):
+        return jsonify({
+            "error": True,
+            "errorMessage": "Missing parameters"
+        }), 400
 
     local_auth = LocalAuth(current_app, session)
     updated_user = local_auth.update_password(data, session['user'])
@@ -238,6 +276,12 @@ def update_galaxy():
         The user with his new apikey
     """
     data = request.get_json()
+    if not (data and data.get("gurl") and data.get("gkey")):
+        return jsonify({
+            'error': True,
+            'errorMessage': "Missing parameters",
+            'user': session["user"]
+        }), 400
 
     local_auth = LocalAuth(current_app, session)
     if session["user"]["galaxy"]:
@@ -274,6 +318,11 @@ def logout():
 def reset_password():
     """Reset password route"""
     data = request.get_json()
+    if not data:
+        return jsonify({
+            "error": True,
+            "errorMessage": "Missing parameters"
+        }), 400
 
     # Send a reset link
     if "login" in data:
@@ -318,7 +367,7 @@ def reset_password():
         })
 
     # Update password
-    else:
+    elif all([key in data for key in ["token", "password", "passwordConf"]]):
         try:
             local_auth = LocalAuth(current_app, session)
             result = local_auth.reset_password_with_token(data["token"], data["password"], data["passwordConf"])
@@ -333,6 +382,11 @@ def reset_password():
             "error": result["error"],
             "errorMessage": result["message"]
         })
+    else:
+        return jsonify({
+            "error": True,
+            "errorMessage": "Missing parameters"
+        }), 400
 
 
 @auth_bp.route("/api/auth/delete_account", methods=["GET"])

askomics/api/auth.py

@@ -1,7 +1,9 @@
 """Api routes"""
+import urllib.parse
 import sys
 import traceback
 
+from askomics.api.auth import api_auth
 from askomics.libaskomics.SparqlQuery import SparqlQuery
 from askomics.libaskomics.SparqlQueryLauncher import SparqlQueryLauncher
 
@@ -12,6 +14,7 @@
 
 
 @data_bp.route('/api/data/<string:uri>', methods=['GET'])
+@api_auth
 def get_data(uri):
     """Get information about uri
 
@@ -33,10 +36,11 @@ def get_data(uri):
         # If the user do not have access to any endpoint (no viewable graph), skip
         if endpoints:
 
+            uri = urllib.parse.quote(uri)
             base_uri = current_app.iniconfig.get('triplestore', 'namespace_data')
             full_uri = "<%s%s>" % (base_uri, uri)
 
-            raw_query = "SELECT DISTINCT ?predicat ?object\nWHERE {\n%s ?predicat ?object\n}" % (full_uri)
+            raw_query = "SELECT DISTINCT ?predicat ?object\nWHERE {\n?URI ?predicat ?object\nVALUES ?URI {%s}}\n" % (full_uri)
             federated = query.is_federated()
             replace_froms = query.replace_froms()