Repository navigation
fix(accounts): order an API key's variables from where to how - #619
Merged
Merged
Conversation
The example for an API key now reads region, S3 endpoint, STS endpoint, role, then key file: where requests go before how they sign in. The test pins the whole snippet, so the order is checked rather than only its lines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014rVE6YPLaG5BrUoC76r3fp
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Claude finished @alukach's task in 8s —— View job ✅ No blocking issues — safe to merge. The diff only reorders the lines in DocsThe PR description names source-cooperative/docs.source.coop#37, which documents this snippet and uses the same order. It also says no ADR covers the order. That satisfies the CLAUDE.md requirement. I didn't open docs.source.coop#37 to check it. 💰 Estimated review cost: $0.10 · 0m08s · 4 turns |
alukach
added a commit
to source-cooperative/docs.source.coop
that referenced
this pull request
Oct 2, 2026
The example now matches the order source.coop prints (source-cooperative/source.coop#619): region, S3 endpoint, STS endpoint, role, key file. The table below it follows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014rVE6YPLaG5BrUoC76r3fp
alukach
marked this pull request as ready for review
October 2, 2026 04:34
alukach
added a commit
to source-cooperative/docs.source.coop
that referenced
this pull request
Oct 6, 2026
…de (#37) * docs: add an automated access guide for service accounts Adds Automated Access (docs/using-source/automated-access.md), the guide for software that reaches Source Cooperative with nobody at the keyboard: what a service account is; creating one and granting it products; issuing an API key and the five variables the AWS CLI or an SDK needs to exchange it at the data proxy; the refusal users see and the request id to quote; keeping the key out of URLs and debug output; rotation and editable expiry; tools that keep their first credentials; GDAL; revocation, the emergency stop and revoking a found key; and GitHub Actions as coming soon. The page is added to sidebars.ts. Upload Your Data's Option 3 walked through trusting an IAM role in the uploader's own AWS account to write straight to Source's bucket. Service accounts supersede it, so the section is now a pointer to the new page, as are the two references to it earlier on that page and the "contact us" line for automated access. Access Data gains one sentence pointing unattended software at service accounts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1eiTse4416N6uTgAy4Ddd * docs: say what the malformed-key error means An API key now ends in a six-character checksum of the rest (ADR-013, source-cooperative/data.source.coop#242), so the data proxy and the Source CLI refuse a key that was cut short or mistyped before anything is looked up, with "API key is malformed; check that it was copied whole". The guide's "If the key is refused" section shows that error and what to do about it, and no longer says a value that isn't a key gets "API key was not accepted". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R1eiTse4416N6uTgAy4Ddd * docs: document GitHub Actions sign-in, ReadOnly, and the current service account UI GitHub Actions trust shipped in data.source.coop#237 (which implements #222 and #223), so the "coming soon" note becomes instructions: trusting a workflow, the step from Example usage, why a job with an environment or a pull_request trigger carries a different subject, role-duration-seconds for long jobs, and the AccessDenied a refused sign-in gets. The API-key section now says how to choose ReadOnly, and that any other role name is refused. The create and issue steps follow the UI on source.coop main: sign-ins are added under "How software signs in" at creation or from "Add sign-in" under "Signs in with", and the variables, Change expiry and Revoke live in each row's menu. The stop table gains removing a workflow, and disabling now names workflow sign-ins too (authenticateWithOidcToken refuses a disabled account). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014rVE6YPLaG5BrUoC76r3fp * docs: list an API key's variables from where to how The example now matches the order source.coop prints (source-cooperative/source.coop#619): region, S3 endpoint, STS endpoint, role, key file. The table below it follows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014rVE6YPLaG5BrUoC76r3fp * docs: split Upload Your Data into browser, CLI and service account pages Upload Your Data becomes a sidebar category. Its index keeps /data-upload with what every method shares (how the proxy works, where to upload, the controls) and a table for choosing a method. Option 1 becomes Upload in the Browser (/upload-in-the-browser), Option 2 becomes Upload with the Source CLI (/upload-with-the-cli) with View Credentials as its no-CLI fallback, and Automated Access moves in as With a Service Account, keeping /automated-access. The index carries HTML anchors for the old Option headings and the CLI heading Access Data linked to, so existing links still land. Content moves unchanged apart from headings and a sentence of glue per page. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014rVE6YPLaG5BrUoC76r3fp * docs: explain AWS_REGION, and drop the note that proxy uploads are disabled The data proxy verifies signatures with whatever region the client signed for and uses it for nothing else, but many SDKs refuse to sign without one, so both credential pages now say to set it anyway. Access Data's closing section said uploading through the proxy was disabled, which the Upload Your Data pages contradict; it is gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014rVE6YPLaG5BrUoC76r3fp * docs: note that only owners and maintainers manage service accounts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: keep the IAM-role upload instructions at /direct-uploads, marked deprecated Pipelines that write straight to the bucket with their own IAM role still need these instructions until they move to service accounts. The page stays out of the sidebar; the upload index links to it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * tools: mark the IAM policy wizard deprecated and link it to /direct-uploads Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: drop the upload index's advice against permanent keys Service account API keys can be issued without an expiry, so the index shouldn't forbid them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: set AWS_DEFAULT_REGION, which boto3 reads, instead of AWS_REGION botocore reads only AWS_DEFAULT_REGION, so with AWS_REGION alone boto3 had no region. Note that the JavaScript and Java SDKs read AWS_REGION. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: give the key file as a full path, not $HOME Cron and systemd, where the page tells readers to copy these variables, do not expand $HOME, so the job would look for a literal "$HOME/..." path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: keep a found key off the command line when revoking it The example put the key in curl's arguments, where it lands in shell history and is visible in ps, against the page's own advice. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: create the key file private from the start mkdir -m leaves an existing directory's mode alone, and the key file was readable by others between cat and chmod. chmod the directory, and create the file under umask 077 in a subshell so the shell's umask is untouched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: clarify how software signs in, name the Grant button, keep old anchors - Explain in the intro that a service account signs in with a GitHub workflow token or an API key, and what 'nothing else has to run' meant. - The grant dialog's button is labelled Grant, not a check mark. - Keep the old page's sub-section anchors so links into it land beside the page that now covers them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: keep AWS_REGION, and note that boto3 needs AWS_DEFAULT_REGION AWS_REGION is what most SDKs and the app's example usage read; boto3 is the one that reads only AWS_DEFAULT_REGION. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: drop the files/folders/objects list from the upload index Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: drop the 'Why we use these controls' section from the upload index Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: drop the 'What not to do' section from the upload index Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: list Direct Uploads (Deprecated) in the sidebar Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Simplify * Prefer account rather than org * Add windows focused examples * Rename file * Reorganize, format * Simplify * line-wrap plain-text code blocks * Add more windows friendly docs * Prefer account-id / product-id --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
An API key's Example usage now lists its variables from where requests go to how they sign in:
It used to start with the role and key file and end with the region. Only the order changes; every value is the same.
apiKeyEnvironmentis the one place it's built, so the key row's dialog and the story both follow.Story: ExampleUsage / ApiKey. The snippet above is the whole visual change, so there's no screenshot.
Testing
service-account-usage.test.tsnow pins the whole snippet withtoBe, where it used to check three lines withtoContain, so the order is tested. It passes.npm run type-checkpasses.Docs and ADRs
source-cooperative/docs.source.coop#37 documents this snippet on its Automated Access page and now uses the same order. No ADR covers the order.
🤖 Generated with Claude Code
https://claude.ai/code/session_014rVE6YPLaG5BrUoC76r3fp