Add proper authentication

.github/workflows/cd.yml

@@ -14,10 +14,10 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@v2
 
-      - name: Set up Python 3.9
+      - name: Set up Python 3.10
         uses: actions/setup-python@v2
         with:
-          python-version: '3.9'
+          python-version: '3.10'
 
       - name: Validate the tag version against the package version
         run: python .github/workflows/validate_release_tag.py $GITHUB_REF
@@ -31,10 +31,10 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@v2
 
-      - name: Set up Python 3.9
+      - name: Set up Python 3.10
         uses: actions/setup-python@v2
         with:
-          python-version: '3.9'
+          python-version: '3.10'
 
       - name: Install flit
         run: pip install flit~=3.4

.github/workflows/ci.yml

@@ -12,10 +12,10 @@ jobs:
     steps:
       - uses: actions/checkout@v2
 
-      - name: Set up Python 3.9
+      - name: Set up Python 3.10
         uses: actions/setup-python@v2
         with:
-          python-version: '3.9'
+          python-version: '3.10'
 
       - uses: pre-commit/action@v3.0.1
 
@@ -27,7 +27,7 @@ jobs:
     timeout-minutes: 30
     strategy:
       matrix:
-        python-version: ['3.9', '3.10', '3.11']
+        python-version: ['3.10', '3.11', '3.12']
 
     services:
       postgres:
@@ -44,9 +44,10 @@ jobs:
         ports:
           - 5432:5432
       rabbitmq:
-        image: rabbitmq:latest
+        image: rabbitmq:3.8.14-management
         ports:
           - 5672:5672
+          - 15672:15672
 
     steps:
       - uses: actions/checkout@v2
@@ -69,7 +70,7 @@ jobs:
         run: pytest --cov aiida_restapi --cov-report=xml
 
       - name: Upload to Codecov
-        if: matrix.python-version == 3.8
+        if: matrix.python-version == 3.10
         uses: codecov/codecov-action@v4
         with:
           name: pytests

.pre-commit-config.yaml

@@ -20,7 +20,7 @@ repos:
         exclude: *exclude_pre_commit_hooks
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.10.0
+    rev: v2.1.0
     hooks:
       - id: mypy
         additional_dependencies:
@@ -36,18 +36,18 @@ repos:
           )$
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.28.6
+    rev: 0.37.2
     hooks:
       - id: check-github-workflows
 
   - repo: https://github.com/ikamensh/flynt/
-    rev: 1.0.1
+    rev: 1.0.6
     hooks:
       - id: flynt
         args: [--line-length=120, --fail-on-change]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.5.0
+    rev: v0.15.13
     hooks:
       - id: ruff-format
         exclude: &exclude_ruff >
@@ -60,7 +60,7 @@ repos:
         args: [--fix, --exit-non-zero-on-fix, --show-fixes]
 
   - repo: https://github.com/macisamuele/language-formatters-pre-commit-hooks
-    rev: v2.13.0
+    rev: v2.16.0
     hooks:
       - id: pretty-format-toml
         args: [--autofix, --trailing-commas]

README.md

@@ -12,11 +12,11 @@ Serve e.g. using [`uvicorn`](https://www.uvicorn.org/).
 
 ## Features
 
- * `/users` (GET/POST) and `/users/<id>` (GET) endpoints
- * Authentication via [JSON web tokens](https://jwt.io/introduction) (see `test_auth.py` for the flow; also works via interactive docs)
- * `User` `pydantic` model for validation
- * Automatic documentation at `http://127.0.0.1:8000/docs`
- * Full specification at `http://127.0.0.1:8000/openapi.json`
+- `/users` (GET/POST) and `/users/<id>` (GET) endpoints
+- Authentication via [JSON web tokens](https://jwt.io/introduction) (see `test_auth.py` for the flow; also works via interactive docs)
+- `User` `pydantic` model for validation
+- Automatic documentation at `http://127.0.0.1:8000/docs`
+- Full specification at `http://127.0.0.1:8000/openapi.json`
 
 ## Installation
 
@@ -34,6 +34,42 @@ uvicorn aiida_restapi:app
 uvicorn aiida_restapi:app --reload
 ```
 
+### Authentication setup
+
+Password authentication now validates against:
+
+1. An existing AiiDA user in the configured profile storage.
+2. A credential mapping supplied through one of these environment variables:
+
+```shell
+# option 1: inline JSON
+export AIIDA_RESTAPI_AUTH_CREDENTIALS_JSON='{"user@example.com": {"hashed_password": "$argon2id$...", "disabled": false}}'
+
+# option 2: JSON file path
+export AIIDA_RESTAPI_AUTH_CREDENTIALS_FILE=/path/to/auth-credentials.json
+```
+
+Only one source should be set at a time. The mapping is keyed by user email and accepts either:
+
+```json
+{
+  "user@example.com": "$argon2id$..."
+}
+```
+
+or:
+
+```json
+{
+  "user@example.com": {
+    "hashed_password": "$argon2id$...",
+    "disabled": false
+  }
+}
+```
+
+The `/auth/token` endpoint expects the email as username.
+
 ## Examples
 
 See the [examples](https://github.com/aiidateam/aiida-restapi/tree/master/examples) directory.
@@ -48,13 +84,16 @@ cd aiida-restapi
 ### Setting up pre-commit
 
 We use pre-commit to take care for the formatting, type checking and linting.
+
 ```shell
 pip install -e .[pre-commit]  # install extra dependencies
 pre-commit run # running pre-commit on changes
 pre-commit run --all-files # running pre-commit on every file
 pre-commit run pylint --all-files # run only the linter on every file
 ```
+
 One can also set up pre-commit to be run on every commit
+
 ```shell
 pre-commit install
 # pre-commit uninstall # to disable it again
@@ -63,13 +102,16 @@ pre-commit install
 ### Running tests
 
 With tox the tests can be run
+
 ```shell
 pip install tox
 tox -e py311 # run all tests for Python 3.11
 tox -av # see all supported environments
 ```
+
 tox will creat a custom environment to run the tests in. If you want to run the
 tests inside your current environment
+
 ```shell
 pip install -e .[testing]  # install extra dependencies
 pytest -v

aiida_restapi/cli/main.py

@@ -15,7 +15,17 @@ def cli() -> None:
 @click.option('--read-only', is_flag=True)
 @click.option('--watch', is_flag=True)
 def start(read_only: bool, watch: bool, host: str, port: int) -> None:
-    """Start the AiiDA REST API service."""
+    """Start the AiiDA REST API service.
+
+    :param read_only: If set, the API will be started in read-only mode.
+    :type read_only: bool
+    :param watch: If set, the API will watch for code changes and reload automatically.
+    :type watch: bool
+    :param host: The host address to bind the API service to.
+    :type host: str
+    :param port: The port number to bind the API service to.
+    :type port: int
+    """
 
     os.environ['AIIDA_RESTAPI_READ_ONLY'] = '1' if read_only else '0'
 

aiida_restapi/common/exceptions.py

@@ -0,0 +1,13 @@
+"""Common exception classes."""
+
+
+class QueryBuilderException(Exception):
+    """Exception raised for errors during QueryBuilder execution."""
+
+
+class JsonApiException(Exception):
+    """Base exception for JSON:API related errors."""
+
+
+class SchemaNotSupported(Exception):
+    """Exception raised when a node type does not support a particular schema type."""

aiida_restapi/common/pagination.py

@@ -5,15 +5,12 @@
 import typing as t
 
 import pydantic as pdt
-from aiida.orm import Entity
 
-ResultType = t.TypeVar('ResultType', bound=Entity.Model)
-
-__all__ = ('PaginatedResults',)
+ResultType = t.TypeVar('ResultType')
 
 
 class PaginatedResults(pdt.BaseModel, t.Generic[ResultType]):
     total: int
     page: int
     page_size: int
-    results: list[ResultType]
+    data: list[ResultType]