Fix: Mirror URI in manifest /index/files response is set for MA files (#7687) by nadove-ucsc · Pull Request #7693 · DataBiosphere/azul

nadove-ucsc · 2026-01-13T01:12:50Z

Linked issues: #7687

Checklist

Author

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all linked issues}
This PR partially resolves each of the linked issues _{or does not have the partial label}

Author (reindex)

Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}

Author (API changes)

This PR and its linked issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Ran make docker_images.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify docker_images.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any linked issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues linked to this PR}

Author (before every review)

Rebased PR branch on develop, squashed fixups from prior reviews
Ran make requirements_update _{or this PR does not modify Dockerfile, environment, requirements*.txt, common.mk, Makefile or environment.boot}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}
PR is awaiting requested review from a peer
Status of PR is Review requested
PR is assigned to only the peer and the author

Peer reviewer (after approval)

Note that after requesting changes, the PR must be assigned to only the author.

Actually approved the PR
PR is not a draft
PR is awaiting requested review from system administrator
Status of PR is Review requested
PR is assigned to only the system administrator and the author

System administrator (after approval)

Actually approved the PR
Labeled linked issues as demo or no demo
Commented on linked issues about demo expectations _{or all linked issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review
PR title is appropriate as title of merge commit
N reviews label is accurate
Status of PR is Approved
PR is assigned to only the operator and the author

Operator

Checked reindex:… labels and r commit title tag
Checked that demo expectations are clear _{or all linked issues are labeled no demo}
Squashed PR branch and rebased onto develop
Sanity-checked history
Pushed PR branch to GitHub

Operator (deploy `.shared` and `.gitlab` components)

Ran _select dev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused _{or this PR is not labeled deploy:shared}
Ran _select dev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply _{or this PR is not labeled deploy:gitlab}
Ran _select anvildev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused _{or this PR is not labeled deploy:shared}
Ran _select anvildev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply _{or this PR is not labeled deploy:gitlab}
Checked the items in the next section _{or this PR is labeled deploy:gitlab}
PR is assigned to only the system administrator and the author _{or this PR is not labeled deploy:gitlab}

System administrator (post-deploy of `.gitlab` component)

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator and the author

Operator (deploy runner image)

Ran _select dev.gitlab && make -C terraform/gitlab/runner _{or this PR is not labeled deploy:runner}
Ran _select anvildev.gitlab && make -C terraform/gitlab/runner _{or this PR is not labeled deploy:runner}

Operator (sandbox build)

Operator (merge the branch)

All status checks passed and the PR is mergeable
The title of the merge commit starts with the title of this PR
Added PR # reference to merge commit title
Collected commit title tags in merge commit title _{but only included p if the PR is also labeled partial}
Pushed merge commit to GitHub
Status of PR is Merged lower
Status of blocked issues is Triage _{or no issues are blocked on the linked issues}

Operator (main build)

Operator (reindex)

Operator (mirroring)

Started mirroring in dev _{or this PR does not require mirroring dev}
Started mirroring in anvildev _{or this PR does not require mirroring anvildev}
Checked for, triaged and possibly requeued messages in mirror fail queue in dev _{or this PR does not require mirroring dev}
Checked for, triaged and possibly requeued messages in mirror fail queue in anvildev _{or this PR does not require mirroring anvildev}
Emptied mirror fail queue in dev _{or this PR does not require mirroring dev}
Emptied mirror fail queue in anvildev _{or this PR does not require mirroring anvildev}

Operator

Propagated the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels to the next promotion PRs _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels, from the description of this PR to that of the next promotion PRs _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

src/azul/service/source_service.py

lambdas/indexer/vendor/resources/sources.json.template.py

lambdas/service/vendor/resources/sources.json.template.py

codecov · 2026-01-13T22:43:43Z

Codecov Report

❌ Patch coverage is 94.35484% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.83%. Comparing base (fa8d30d) to head (912d50a).

Files with missing lines	Patch %	Lines
test/integration_test.py	0.00%	3 Missing ⚠️
src/azul/indexer/mirror_service.py	87.50%	2 Missing ⚠️
src/azul/plugins/repository/tdr.py	87.50%	1 Missing ⚠️
src/azul/service/source_service.py	95.45%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #7693      +/-   ##
===========================================
+ Coverage    84.80%   84.83%   +0.03%     
===========================================
  Files          157      157              
  Lines        23067    23124      +57     
===========================================
+ Hits         19561    19617      +56     
- Misses        3506     3507       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coveralls · 2026-01-13T22:43:55Z

coverage: 85.052% (+0.03%) from 85.02%
when pulling 912d50a on issues/nadove-ucsc/7687-mirror-uri-set-for-ma-files
into fa8d30d on develop.

hannes-ucsc · 2026-01-20T17:45:42Z

src/azul/plugins/__init__.py

+        Implementations should raise PermissionError if the provided
+        authentication is insufficient to access the repository.


"Implementations" implies "implementations of this method". No authentication is provided to those implementations, so I don't understand this sentence.

hannes-ucsc · 2026-01-20T17:46:41Z

src/azul/service/source_service.py

+            all_sources = set()
+            public_sources = set()


We typically use tuple assignmets when they correlate like this.

hannes-ucsc · 2026-01-20T17:48:47Z

src/azul/service/source_service.py

        return int(time())
+
+    @cache
+    def _configured_sources(self) -> Mapping[str, AbstractSet[SourceRef]]:


The return type hint is a text-book case for a typed dict.

lambdas/indexer/vendor/resources/sources.json.template.py

hannes-ucsc

Also, please add unit test coverage for the the newly uncovered lines

https://app.codecov.io/gh/DataBiosphere/azul/pull/7693/blob/src/azul/service/source_service.py

nadove-ucsc · 2026-01-21T01:00:13Z

The bot is right, which raises the question as to why make pep8 didn't catch this.

It wasn't caught because $(project_root)/lambdas/{indexer,service}/vendor/ is not included in the paths passed to flake8. It also wasn't detected by PyCharm (not grayed out in the editor) because those directories are explicitly marked as ignored.

src/azul/service/source_service.py

hannes-ucsc · 2026-02-04T18:36:55Z

src/azul/indexer/__init__.py

+    Specifically, this means that subclasses may not add fields without a
+    default or modify whether a field is initialized via a keyword-only or
+    positional-only argument.


Suggested change

Specifically, this means that subclasses may not add fields without a

default or modify whether a field is initialized via a keyword-only or

positional-only argument.

For example, this means that subclasses may not add fields without a

default value or modify the constructor to accept positional arguments.

Modifying the constructor to accept positional arguments would not prevent the constructor from being invoked with keyword arguments. I maintain that my original wording is more accurate and precise.

hannes-ucsc · 2026-02-05T06:00:00Z

src/azul/service/source_service.py

+        """
+        List source IDs in the underlying repository that are accessible using
+        the provided authentication. May require a roundtrip to the underlying
+        repository, but results are cached in DynamoDB for up to 1 minute.


Suggested change

repository, but results are cached in DynamoDB for up to 1 minute.

repository, but results are cached in DynamoDB for a short time.

Implementation detail. It's actually 5 min now.

hannes-ucsc · 2026-02-05T06:47:51Z

src/azul/service/source_service.py

+            }
+
+    @property
+    def configured_sources(self) -> AbstractSet[SourceRef]:


Let's remove this for now. Let's also remove the outer dictionary in sources.json for now, and the TypedDict, and let's rename sources.json to public_sources.json.

I think we should organize the contents of sources.json by catalog. Then we can use configured_public_sources in list_accessible_sources if authentication is None. We can also make this method protected and have the mirror service use the public list_accessible_sources instead. This would create infinite recursion outside of a Lambda context. I think that can be broken by having list_accessible_sources and _list_accessible_sources. I can elaborate in PL.

Somewhat unrelated: Please add a log statement to the auth fallback for the case when it falls back to no auth. I want to be able to tell from the logs how frequently that occurs.

I also have the feeling that a set of SourceRef instances (what this method returns) doesn't work as one would expect. I think it can contain two SourceRef instances with the same source_id.

In essence what this PR then effectively does is cache public sources for much longer and ensure that the plugin layer restricts the set of sources to those configured.

In another PR we can add back the functionality of this removed method, and use it in list_accessible_source_ids() to further subset the return value.

Another point of tension that we need to address in the long run (not in this PR) is that post_deploy and outsourcing of sources do similar things.

Let's remove this for now. Let's also remove the outer dictionary in sources.json for now, and the TypedDict, and let's rename sources.json to public_sources.json.

Agreed to remove this method since it is unused in this PR. It will trivial to re-add it later.

I think we should organize the contents of sources.json by catalog. Then we can use configured_public_sources in list_accessible_sources if authentication is None. We can also make this method protected and have the mirror service use the public list_accessible_sources instead. This would create infinite recursion outside of a Lambda context. I think that can be broken by having list_accessible_sources and _list_accessible_sources. I can elaborate in PL.

Agreed to postpone organizing by catalog and unifying list_accessible_sources with configured_public_sources.

Somewhat unrelated: Please add a log statement to the auth fallback for the case when it falls back to no auth. I want to be able to tell from the logs how frequently that occurs.

This is easy, I can do this.

I also have the feeling that a set of SourceRef instances (what this method returns) doesn't work as one would expect. I think it can contain two SourceRef instances with the same source_id.

Agreed to change return type annotation to Iterable[SourceRef] and skip the conversion to set.

In essence what this PR then effectively does is cache public sources for much longer and ensure that the plugin layer restricts the set of sources to those configured.

In another PR we can add back the functionality of this removed method, and use it in list_accessible_source_ids() to further subset the return value.

Another point of tension that we need to address in the long run (not in this PR) is that post_deploy and outsourcing of sources do similar things.

Agreed to change return type annotation to Iterable[SourceRef] and skip the conversion to set.

Something I missed was that it is necessary to store the sources in a set when preparing for outsourcing to avoid duplicate entries in cases where the same source occurs in multiple catalogs (e.g. dcp55 and dcp56).

Two sources with the same ID can coexist in a set only if they differ by some other attribute (e.g. have different prefixes). Therefore using a set here is still very useful at eliminating duplicates, which would otherwise be very common.

…#7687)

nadove-ucsc self-assigned this Jan 13, 2026

nadove-ucsc linked an issue Jan 13, 2026 that may be closed by this pull request

Fix: Mirror URI in manifest /index/files response is set for MA files #7687

Open

github-advanced-security bot found potential problems Jan 13, 2026

View reviewed changes

src/azul/service/source_service.py Fixed Show fixed Hide fixed

lambdas/indexer/vendor/resources/sources.json.template.py Fixed Show fixed Hide fixed

lambdas/service/vendor/resources/sources.json.template.py Fixed Show fixed Hide fixed

nadove-ucsc force-pushed the issues/nadove-ucsc/7687-mirror-uri-set-for-ma-files branch 7 times, most recently from 52a4ca7 to d8627ae Compare January 13, 2026 22:28

nadove-ucsc force-pushed the issues/nadove-ucsc/7687-mirror-uri-set-for-ma-files branch 3 times, most recently from 39b3cd7 to 87d7dea Compare January 16, 2026 04:43

nadove-ucsc requested a review from dsotirho-ucsc January 16, 2026 05:25

nadove-ucsc assigned dsotirho-ucsc Jan 16, 2026

hannes-ucsc assigned hannes-ucsc and unassigned dsotirho-ucsc Jan 16, 2026

hannes-ucsc removed the request for review from dsotirho-ucsc January 16, 2026 18:55

hannes-ucsc marked this pull request as ready for review January 16, 2026 18:55

hannes-ucsc self-requested a review as a code owner January 16, 2026 18:55

hannes-ucsc requested changes Jan 20, 2026

View reviewed changes

hannes-ucsc added the 1 review [process] Lead requested changes once label Jan 20, 2026

hannes-ucsc requested changes Jan 20, 2026

View reviewed changes

hannes-ucsc removed their assignment Jan 20, 2026

nadove-ucsc force-pushed the issues/nadove-ucsc/7687-mirror-uri-set-for-ma-files branch from 87d7dea to 7464fca Compare January 21, 2026 02:20

github-advanced-security bot found potential problems Jan 21, 2026

View reviewed changes

src/azul/service/source_service.py Fixed Show fixed Hide fixed

nadove-ucsc force-pushed the issues/nadove-ucsc/7687-mirror-uri-set-for-ma-files branch from 7464fca to 73ab983 Compare January 21, 2026 02:23

hannes-ucsc requested changes Feb 5, 2026

View reviewed changes

hannes-ucsc removed their assignment Feb 5, 2026

nadove-ucsc assigned hannes-ucsc and unassigned hannes-ucsc Feb 7, 2026

nadove-ucsc added 5 commits February 6, 2026 17:25

Fix conflation of absent/null properties in mirror documentation (#7637)

29b133d

Rename source service test

57d0fb2

Fix typo

a548f59

Reorganize static resources

7b17859

Deduplicate outsourced environ template file

5aa71ee

nadove-ucsc force-pushed the issues/nadove-ucsc/7687-mirror-uri-set-for-ma-files branch from 3ebeec1 to c41db2c Compare February 7, 2026 02:00

nadove-ucsc added 11 commits February 6, 2026 18:03

[R] Cover resource templates with pep8

ca4ff79

Inline method

1e004d5

fixup! Add docstrings in source service

885b4fe

Rename list_source[_id]s to list_accessible_source[_id]s

0bf4d4e

Pull up {Simple,TDR}SourceSpec.name into superclass

66a4b3e

Extract protected methods from list_accessible_sources in TDR plugin

887b146

Document and enforce uniqueness of source names

58067a0

Add log statement for when TDR requests fall back to no auth

226f36f

Extract variable

2354939

Pull up MirrorService._source_service into superclass

72da1f6

Make cached plugins public and remove redundant instantiation

c3776bb

nadove-ucsc force-pushed the issues/nadove-ucsc/7687-mirror-uri-set-for-ma-files branch 2 times, most recently from beb364a to e8b472a Compare February 7, 2026 02:16

nadove-ucsc requested a review from hannes-ucsc February 7, 2026 03:44

nadove-ucsc assigned hannes-ucsc Feb 7, 2026

nadove-ucsc and others added 4 commits February 8, 2026 21:41

Fix: Mirror URI in manifest /index/files response is set for MA files (…

75108db

…#7687)

Fix return type

e602492

Cover azul.service.source_service with mypy

7032544

Remove unused methods

912d50a

hannes-ucsc force-pushed the issues/nadove-ucsc/7687-mirror-uri-set-for-ma-files branch from e8b472a to 75108db Compare February 9, 2026 05:41

		Implementations should raise PermissionError if the provided
		authentication is insufficient to access the repository.

	repository, but results are cached in DynamoDB for up to 1 minute.
	repository, but results are cached in DynamoDB for a short time.

Conversation

nadove-ucsc commented Jan 13, 2026 • edited by hannes-ucsc Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Author

Author (partiality)

Author (reindex)

Author (API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator

Operator (deploy .shared and .gitlab components)

System administrator (post-deploy of .gitlab component)

Operator (deploy runner image)

Operator (sandbox build)

Operator (merge the branch)

Operator (main build)

Operator (reindex)

Operator (mirroring)

Operator

Shorthand for review comments

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov bot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coveralls commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hannes-ucsc left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nadove-ucsc commented Jan 21, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

nadove-ucsc commented Jan 13, 2026 •

edited by hannes-ucsc

Loading

Operator (deploy `.shared` and `.gitlab` components)

System administrator (post-deploy of `.gitlab` component)

codecov bot commented Jan 13, 2026 •

edited

Loading

coveralls commented Jan 13, 2026 •

edited

Loading

hannes-ucsc left a comment •

edited

Loading