Place it below the table at https://workbench.qr1hi.arvadosapi.com/keep_disks

Desired command line arguments to control permissions: * @--enable-permissions=@ _true/false_ to enable or disable permission enforcement ** For transition, maybe support a @--generate-permissions@ flag and a @--enforce-permissions@ flag. ** Alternatively, make Keep always generate permission tokens, but only enforce them when the perms flag is turned on. ** Permissions are always required for DELETE * @--privileged-ip@ specifies IP addresses to be considered superuser. ** If permissions are disabled, index (@GET /index.txt@) and @DELETE@ do not work unless remote address matches @--privileged-ip@ command line argument * @--signature-ttl=num_seconds@ to control expiry time of signatures * @--signature-key-fd=fdnum@ to read signing key from given file descriptor

Implement a Go interface for generating permissions tokens and verifying them. (Use an interface to facilitate testing).

Issues to resolve: * How are tokens verified? * Is a token tied to a user? Can a permissions token be shared with someone else?

When provided, the API server will grant access to resources as though GET scopes from the supplemental authorizations were added to the primary authorizations' scopes.

When provided, Workbench uses the API token to make any API server requests. However, unlike the current @api_token@ behavior, Workbench does not set up or change the current user session based on this token.

This implements the behavior described in task #2663.

This is a small branch to make @wget -r@ work decently with reader_tokens.

This branch introduces general, URL-based scopes to API client authorizations. They can be used to give a token very particular read and write permissions to specific resources. Refer to #2642 and #2662 for additional rationale.

Tom says: ”hopefully sooner rather than later -- none of the Javascript or Workbench-server support will be specific to Groups. (But if it makes the difference between getting it done or not, "only groups are essential for this story" is the rule.)”

The API token will be "for" the current user, with very limited scope. The token should be persisted, so that the user can expire it later if desired. TBD: * How much of this work happens in the API server, and how much in Workbench?

This branch implements the work described in #2702.

This implements the functionality described in task #2663.

These URLs are built using the limited API tokens of #2662, put in the query parameter of #2663. "Manage" means create and delete. When a URL is deleted, its associated API token should be expired as well.

Ensure the owner_uuid chain always leads to a user.

This branch adds a @docker_image@ runtime constraint to Jobs. If specified, Crunch will run the Job script inside a Docker container built from that image.

ls mnt/tag/foo -> list of UUIDs of objects referenced by links with link_class=tag name=foo

e.g., mnt/collection/12345678+12/foo.txt

https://developers.google.com/discovery/libraries

Add a README file that will serve as a getting started guide.

This will help eliminate the need to upload the discovery service client jars into our git repository.

(from email) 1. Install Single Sign On (SSO) server: * We would want to add “cd into your home directory or wherever you want to install ” before doing the git clone 2. Install API server: * We would want to add “cd into your home directory or wherever you want to install ” before doing the git clone 3. Install client libraries * git clone https://github.com/curoverse/arvados.git is failing because we already did it in the api server and the repository exists. <pre> $ git clone https://github.com/curoverse/arvados.git fatal: destination path 'arvados' already exists and is not an empty directory. </pre> 4. Install Client Libraries: * sudo python setup.py install — is failing. I do not find a setup.py file in this directory. I do find a setup.py.src file but am not sure if I need to do something first. 5. Install API Server: * Do we want to include a note about installing “rvm” in the “install dependencies” section? It was not so obvious for me at first. 6. This is probably not a documentation issue, but I am having this issue. I setup following the steps and when I login into workbench, I am seeing the welcome page. It appears that my account needs to be activated. Not sure if I missed some step or if it is something due to some newer improvements in code. I had not seen this in my earlier run-ins with the workbench / api server.

This is a very large code review. Here are some hints that may make it easier to understand what's going on here: A _Volume_ interface has been added to provide an abstraction layer for implementing any kind of storage device. The only Volume that has been implemented so far is a _UnixVolume_ (a volume mounted as a local POSIX filesystem). When Keep receives a @GET@ or @PUT@ request from a remote user, it invokes a Get or Put method on the appropriate Volume. The Volume is responsible for serializing any I/O requests if necessary. Suggestions for review: # First review @volume.go@, which describes the Volume interface and implements a _MockVolume_ used for testing the front end. # It may help then to review @keep_test.go@, to see how the Volume interface is used in unit tests. # At that point, the changes in @keep.go@ should be easier to understand: they chiefly change the Keep front-end to interact with the Volume interface rather than reading and writing files directly to disk. # The underlying UnixVolume type is implemented in volume_unix.go, including the code for managing any serialized I/O requests. volume_unix_test.go supplies unit tests. Or, you know, review in whatever order makes sense to you. :-P

Enforce "one read/write operation per mount point" restriction (with command line flag to disable, for AWS. --no-io-lock?)

https://arvados.org/projects/arvados/wiki/Hacking_Workbench

Have first version running at https://10.13.121.106:3001/users/storage . It's not ready for check in, but I'd like to get a preliminary review before I write too much code since I've never worked on workbench or even ruby on rails before.