Inherited access

.github/workflows/ci-cd.yml

@@ -2,7 +2,7 @@ name: CI/CD Pipeline
 
 on:
   push:
-    branches: [ main, develop ]
+    branches: [ main, develop, inherited_access ]
   pull_request:
     branches: [ main ]
   release:
@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.11", "3.12", "3.13"]
+        python-version: ["3.12"]
 
     steps:
     - uses: actions/checkout@v4

.mypy.ini

@@ -1,5 +1,5 @@
 [mypy]
-python_version = 3.11
+python_version = 3.12
 mypy_path = src
 ignore_errors = True
 ignore_missing_imports = True

.pixi/envs/bl733/share/terminfo/32/2621A

@@ -0,0 +1 @@
+../68/hp2621

.pixi/envs/bl733/share/terminfo/68/hp2621a

@@ -0,0 +1 @@
+../68/hp2621

.pixi/envs/bl733/share/terminfo/68/hp70092a

@@ -0,0 +1 @@
+../68/hp70092

.pixi/envs/default/share/terminfo/32/2621A

@@ -0,0 +1 @@
+../68/hp2621

.pixi/envs/default/share/terminfo/68/hp2621a

@@ -0,0 +1 @@
+../68/hp2621

.pixi/envs/default/share/terminfo/68/hp70092A

@@ -0,0 +1 @@
+../68/hp70092

.pixi/envs/dev/share/terminfo/32/2621a

@@ -0,0 +1 @@
+../68/hp2621

.pixi/envs/dev/share/terminfo/68/hp2621A

@@ -0,0 +1 @@
+../68/hp2621

.pixi/envs/dev/share/terminfo/68/hp70092a

@@ -0,0 +1 @@
+../68/hp70092

Containerfile

@@ -1,9 +1,26 @@
-FROM ghcr.io/bluesky/tiled:0.2.8 AS base
+FROM ghcr.io/bluesky/tiled:0.2.15 AS base
+
+# Rebuild tiled to include inherited access control changes, which are needed for the ALS Computing Hub. Won't be needed once those changes are merged into the main tiled branch and included in a release.
+
+FROM base AS build-tiled
+
+USER root
+RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+RUN git clone --branch inherited_access_control https://github.com/als-computing/tiled.git /tmp/tiled
+WORKDIR /tmp/tiled
+RUN pip wheel --no-deps -w /tmp/wheels .
+
+FROM base
 
 # uv is a statically-linked Rust binary — no shared-library mprotect call,
 # so it works under rootless Podman where `pip` (glibc RELRO) fails.
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
+# Copy tiled wheel from build stage and install as root (will override base image's tiled)
+USER root
+COPY --from=build-tiled /tmp/wheels/*.whl /tmp/
+RUN uv pip install --python /app/bin/python --no-cache /tmp/*.whl
+
 USER app
 ENV PATH=/app/bin:$PATH
 ENV PYTHONPATH=/app/src:/tiled_deploy/config

README.md

@@ -26,6 +26,7 @@ docker build -t splash_tiled -f Containerfile .
 docker run -p 8000:8000 splash_tiled
 ```
 
+
 ### Local Development
 
 ```bash

pixi.toml

@@ -5,7 +5,7 @@ channels = ["conda-forge"]
 platforms = ["linux-64", "osx-64", "osx-arm64", "linux-aarch64"]
 
 [environments]
-default = { features = ["bl733"] }
+default = { features = ["bl733", "dev"] }
 dev = { features = ["bl733", "dev"] }
 
 [dependencies]

pyproject.toml

@@ -33,9 +33,11 @@ dependencies = [
 tiled-all = [
   "tiled[all]>=0.2.8",
 ]
+
 bl733 = [
   "fabio",
 ]
+
 dev = [
   "flake8",
   "black",
@@ -45,7 +47,7 @@ dev = [
   "pytest-cov",
   "pytest-asyncio",
   "fabio",
-  "tiled[server]>=0.2.8"
+  "tiled[server]",
 ]
 
 [project.urls]

src/splash_tiled/access_control/cli.py

@@ -19,13 +19,17 @@
     run,
 )
 
-app = typer.Typer(help="ALS access control management.", add_completion=False)
+app = typer.Typer(
+    no_args_is_help=True, help="ALS access control management.", add_completion=False
+)
 compile_app = typer.Typer(
-    help="Build ESAF and compiled-tags databases.", add_completion=False
+    no_args_is_help=True,
+    help="Build ESAF and compiled-tags databases.",
+    add_completion=False,
 )
 
-app.add_typer(query_app, name="query")
-app.add_typer(compile_app, name="compile")
+app.add_typer(query_app, no_args_is_help=True, name="query")
+app.add_typer(compile_app, no_args_is_help=True, name="compile")
 
 _ESAF_DB = typer.Option(
     Path("tags/esafs.db"), "--esaf-db", help="ESAF SQLite database."
@@ -144,7 +148,7 @@ def _tag_recursive(node, tags: list[str], errors: list[str]) -> int:
     return count
 
 
-@app.command("set-access-tags")
+@app.command("set-access-tags", no_args_is_help=True)
 def tag_path_command(
     path: Annotated[
         str, typer.Argument(help="Path within tiled (e.g. beamlines/12.3.2).")

src/splash_tiled/access_control/tiled_tags.py

@@ -30,11 +30,13 @@ def get_default_output_sqlite_path() -> Path:
 
 
 def get_default_tag_definitions_path() -> Path:
-    return Path(__file__).resolve().parent / "tag_definitions_stub.yaml"
+    return Path(__file__).resolve().parents[3] / "tags" / "tag_definitions_stub.yaml"
 
 
 def get_default_generated_tag_definitions_path() -> Path:
-    return Path(__file__).resolve().parents[3] / "tag_definitions.generated.yml"
+    return (
+        Path(__file__).resolve().parents[3] / "tags" / "tag_definitions.generated.yml"
+    )
 
 
 def load_esaf_groups(esaf_db_path: Path) -> dict[str, list[str]]:

tiled_config/config_dev.yaml

@@ -0,0 +1,50 @@
+database:
+  uri: sqlite:////home/dmcreynolds/dev/splash_tiled/data/auth.db
+
+# links_database:
+#   uri: sqlite:////home/dmcreynolds/dev/splash_tiled/data/graph.db
+
+authentication:
+    secret_keys:
+    - secret
+    providers:
+    - provider: dictionary
+      authenticator: tiled.authenticators:DictionaryAuthenticator
+      args:
+        users_to_passwords:
+          alice: pass
+          bob: pass
+          0000-0002-1539-0297: pass
+        confirmation_message: "You have logged in as {id}."
+
+
+    tiled_admins:
+      - provider: dictionary
+        id: bob
+
+
+access_control:
+  access_policy: "tiled.access_control.access_policies:InheritedTagAccessPolicy"
+  args:
+    provider: "dictionary"
+    scopes:
+    - "read:metadata"
+    - "read:data"
+    - "write:metadata"
+    - "write:data"
+    - "delete:revision"
+    - "delete:node"
+    - "create:node"
+    - "register"
+    tags_db:
+      uri: /home/dmcreynolds/dev/splash_tiled/tags/compiled_tags.db
+    access_tags_parser: "tiled.access_control.access_tags:AccessTagsParser"
+
+trees:
+  - path: /
+    tree: catalog
+    args:
+      uri: /home/dmcreynolds/dev/splash_tiled/data/catalog.db
+      readable_storage: [/home/dmcreynolds/data]
+      writable_storage: /home/dmcreynolds/data
+      init_if_not_exists: true