feat(smart): add SMART App Launch 2.0.0 and US Core Backend Services support

.dockerignore

@@ -0,0 +1,51 @@
+# Signing keys. `keys/` is gitignored, so a clean checkout never has it, but a
+# developer's working tree does and `COPY . /fence` would bake it into the image.
+keys/
+**/*.pem
+**/*.key
+jwt-keys.tar
+
+# Deployment secrets and local config
+fence-config.yaml
+*config*.local.yaml
+.env
+.netrc
+
+# Local virtualenvs and caches, which would shadow the image's /venv
+.venv/
+venv/
+ENV/
+**/__pycache__/
+**/*.py[cod]
+.mypy_cache/
+.pytest_cache/
+.cache/
+.coverage
+.coverage.*
+htmlcov/
+coverage.xml
+.tox/
+.hypothesis/
+
+# Build artifacts
+build/
+dist/
+*.egg-info/
+.eggs/
+
+# Editor, OS, and agent scratch
+.idea/
+.vscode/
+.DS_Store
+.claude/
+.serena/
+
+# Compose files and docs, not needed at runtime
+docker-compose*.yml
+# Root-only on purpose: `fence/static/privacy_policy.md` is served by
+# /privacy-policy and must stay in the image, so this must not become `**/*.md`.
+*.md
+!README.md
+
+# Note: `.git` is deliberately NOT ignored - the builder stage runs
+# `git rev-parse HEAD` and `git describe` to generate version_data.py.

dockerrun.bash

@@ -8,6 +8,11 @@ if [ -f /fence/jwt-keys.tar ]; then
     cd /fence
     tar xvf jwt-keys.tar
     if [ -d jwt-keys ]; then
+      # Replace keys/ rather than merging into it. Anything already there came
+      # from the image build rather than from the mounted secret, and must not
+      # survive alongside - fence loads every keypair it finds and publishes
+      # each one in the JWKS.
+      rm -rf keys
       mkdir -p keys
       mv jwt-keys/* keys/
     fi

fence/auth.py

@@ -356,22 +356,6 @@ def logout(next_url, force_era_global_logout=False):
     return redirect_response
 
 
-def check_scope(scope):
-    def wrapper(f):
-        @wraps(f)
-        def check_scope_and_call(*args, **kwargs):
-            if "_all" in flask.g.scopes or scope in flask.g.scopes:
-                return f(*args, **kwargs)
-            else:
-                raise Unauthorized(
-                    "Requested scope {} can't access this endpoint".format(scope)
-                )
-
-        return check_scope_and_call
-
-    return wrapper
-
-
 def login_required(scope=None):
     """
     Create decorator to require a user session

fence/blueprints/data/blueprint.py

@@ -177,6 +177,14 @@ def upload_data_file():
         uploader=uploader,
         guid=guid,
     )
+
+    if guid:
+        # A supplied GUID can resolve to an existing record instead of creating one
+        # (See BlankIndex.index_document code), and since
+        # the signed URL below writes to that record's storage key, we need to
+        # not just auth the authz provided by the user, but check on the existing record.
+        _authorize_upload_to_existing_record(blank_index.index_document)
+
     default_expires_in = flask.current_app.config.get("MAX_PRESIGNED_URL_TTL", 3600)
 
     expires_in = get_valid_expiration(
@@ -202,6 +210,42 @@ def upload_data_file():
     return flask.jsonify(response), 201
 
 
+def _authorize_upload_to_existing_record(index_document: dict) -> None:
+    """
+    Confirm the caller may write to an indexd record that already exists.
+
+    Args:
+        index_document (dict): the indexd record the supplied GUID resolved to
+
+    Raises:
+        Forbidden: if the caller may not write to this record
+    """
+    record_authz = index_document.get("authz")
+    if record_authz:
+        authorized = flask.current_app.arborist.auth_request(
+            jwt=get_jwt(),
+            service="fence",
+            methods=["write-storage"],
+            resources=record_authz,
+        )
+        if not authorized:
+            logger.error(
+                "Auth error on upload to existing record. User must have "
+                "'write-storage' access on {}.".format(record_authz)
+            )
+            raise Forbidden(
+                "You do not have write-storage access to this record's authz resources."
+            )
+        return
+
+    uploader = index_document.get("uploader")
+    if not uploader or uploader != current_token["context"]["user"]["name"]:
+        raise Forbidden(
+            "You cannot upload to this record because it has no authz resources and "
+            "the uploader field indicates it does not belong to you."
+        )
+
+
 @blueprint.route("/multipart/init", methods=["POST"])
 @require_auth_header(scope={"data"})
 @login_required({"data"})
@@ -220,6 +264,9 @@ def init_multipart_upload():
 
     blank_index = BlankIndex(file_name=params["file_name"], guid=guid)
 
+    if guid:
+        _authorize_upload_to_existing_record(blank_index.index_document)
+
     default_expires_in = flask.current_app.config.get("MAX_PRESIGNED_URL_TTL", 3600)
     expires_in = get_valid_expiration(
         params.get("expires_in"),

fence/blueprints/data/bulk_helpers.py

@@ -74,21 +74,62 @@ def collect_authz_needing_check(guids, index_document, auth_roles):
     return authz_needing_check
 
 
+def _authz_key_resources(authz_key):
+    """Return the list of resource paths an authz key stands for."""
+    return list(authz_key) if isinstance(authz_key, tuple) else [authz_key]
+
+
+def _is_authorized_for_read_storage(auth_mapping, authz_key, jwt=None, user_id=None):
+    """
+    Determine whether the caller may read-storage every resource in an authz key.
+
+    Arborist's ``auth_request`` over the full resource list is the decision, matching
+    the single-object path: a record carrying several resources requires access to
+    all of them. The auth mapping only screens out keys with no matching resource at
+    all, so arborist is not called for keys that cannot pass.
+
+    Args:
+        auth_mapping: Arborist authorization mapping for a user or token.
+        authz_key: Normalized authz key from indexd metadata.
+        jwt: Bearer token to authorize, or None when authorizing by user_id or
+            anonymously.
+        user_id: Username to authorize, for passport-based access.
+
+    Returns:
+        True if arborist authorizes fence read-storage on every resource in the key.
+    """
+    if not _auth_mapping_has_read_storage(auth_mapping, authz_key):
+        return False
+
+    return bool(
+        flask.current_app.arborist.auth_request(
+            jwt=jwt,
+            user_id=user_id,
+            service="fence",
+            methods="read-storage",
+            resources=_authz_key_resources(authz_key),
+        )
+    )
+
+
 def _auth_mapping_has_read_storage(auth_mapping, authz_key):
     """Determine whether the Arborist auth mapping grants read-storage for an authz key.
 
+    This is a pre-filter, not an authorization decision: it passes when any one
+    resource in the key matches.
+
     Args:
         auth_mapping: Arborist authorization mapping for a user or token.
         authz_key: Normalized authz key from indexd metadata.
 
     Returns:
-        True if the auth_mapping contains a fence read-storage permission for the key.
+        True if the auth_mapping contains a fence read-storage permission for any
+        resource in the key.
     """
     if auth_mapping is None:
         return False
 
-    authz_list = list(authz_key) if isinstance(authz_key, tuple) else [authz_key]
-    for resource in authz_list:
+    for resource in _authz_key_resources(authz_key):
         methods_list = auth_mapping.get(resource)
         if not methods_list:
             continue
@@ -133,7 +174,9 @@ def build_authz_to_authorized_username(authz_needing_check, users_from_passports
             for authz_key in authz_needing_check:
                 if authz_key in authz_to_authorized_username:
                     continue
-                if _auth_mapping_has_read_storage(auth_mapping, authz_key):
+                if _is_authorized_for_read_storage(
+                    auth_mapping, authz_key, user_id=username
+                ):
                     authz_to_authorized_username[authz_key] = username
     else:
         try:
@@ -148,7 +191,7 @@ def build_authz_to_authorized_username(authz_needing_check, users_from_passports
             auth_mapping = {}
 
         for authz_key in authz_needing_check:
-            if _auth_mapping_has_read_storage(auth_mapping, authz_key):
+            if _is_authorized_for_read_storage(auth_mapping, authz_key, jwt=token):
                 authz_to_authorized_username[authz_key] = None
 
     return authz_to_authorized_username