Skip to content

INSTALL.md: fix Go version and drop obsolete root-user INSERT (#722) #723

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Amaan0907 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

INSTALL.md: fix Go version and drop obsolete root-user INSERT (#722) #723

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 8 additions & 14 deletions INSTALL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ Airavata API (`cmd/airavata-server`).

| Requirement | Version | Check using |
|---|---|---|
| **Go** | 1.24.2+ | `go version` |
| **Go** | 1.25+ | `go version` |
| **PostgreSQL** | 14+ | `psql --version` |
| **Docker Engine** | 20.10+ *(optional — only to run PostgreSQL locally)* | `docker -v` |
| **Docker Compose** | 2.0+ *(optional)* | `docker compose version` |
Expand Down Expand Up @@ -241,26 +241,20 @@ curl -s -X POST localhost:9095/api/v1/slurm-clusters \
-d '{"clusterName":"expanse","headnodeHost":"login.expanse.sdsc.edu","headnodePort":22}'
```

### Two things that need a manual step

**1. Owning resources requires a matching `users` row.**
### Owning resources requires a matching `users` row

Endpoints that create *owned* resources — SSH keys, cluster configs, data storages,
processes — resolve the caller to a user record and refuse if none exists:

```
404 No user record found for authenticated principal: root
404 No user record found for authenticated principal: <user>
```

The root token bypasses introspection, so no record is created for it. Insert one if
you intend to own resources as `root`:

```sql
INSERT INTO users (user_id, auth_method, first_name, last_name, status, created_at)
VALUES ('root', 'SYSTEM', 'Root', 'Account', 'ACTIVE', UNIX_TIMESTAMP() * 1000);
```
When the root account is enabled, the server creates the `root` row on startup if it
is missing, so `root` can own resources with no manual step. Any other principal needs
a row, which you can create through the API (see "Registering users" below).

**2. Granting a role requires a manual insert.**
### Granting a role requires a manual insert

Authorities are read from `user_roles`, but no endpoint writes to that table — user
registration sets a status and timestamp, and updates deliberately cannot change roles.
Expand Down Expand Up @@ -346,7 +340,7 @@ caller lacking the required role returns `403`.
| `401` with `WWW-Authenticate: Bearer error="invalid_token"` | The token was rejected by introspection, or it is a stale root token from a previous start. Restart and use the newly printed token, or pin it with `AIRAVATA_ROOT_ACCOUNT_TOKEN`. |
| `502 Unable to validate bearer token` | CILogon is unreachable. This is reported separately from `401` because it is not the caller's fault. |
| `403 Access denied` on a write | The caller authenticated but lacks `ADMIN`/`SUPER_ADMIN`. Grant the role in `user_roles`. |
| `404 No user record found for authenticated principal` | The caller has no `users` row. See "First run" above. |
| `404 No user record found for authenticated principal` | The caller has no `users` row. Register the user (see "First run" above). The `root` row is created automatically on startup. |
| `409 Key is in use by a credential` | An SSH key cannot be deleted while a credential references it. Delete the credential first. |
| `409 Template has deployments` | A template cannot be deleted while deployments reference it. Delete the deployments first. |

Expand Down