Add authorized reviewer view to status

[jmetz]

This is to allow authorized users to review a "staging" entry.

Discussed mechanism for implementing this (as discussed with @oeway , @FynnBe ) is likely to be:

• Store list of reviewers (GitHub - possibly in collections repo)
• Load list and check against logged in user to show review controls
• On server-side, also check logged in user against this list when submitting a review action

[oeway]

For the authentication, you can get the user email in the context variable when a hypha service function is called https://ha.amun.ai/#/?id=service-authorization

See here for an example where we check against the authorized user emails https://github.com/bioimage-io/bioimageio-chatbot/blob/e526cef8f11fd410014da8ed8e8844754a900370/bioimageio_chatbot/chatbot.py#L346

[jmetz]

To be clear, are you suggesting that from a netlify function we should contact hypha and check that a user is who they say they are (essentially)?

Because doing this only client-side would probably be considered very bad security practice, right?

This was why I decided with the last day or so of Hackathon time to do a proof of concept Firebase-backed demo - as there the review workflow uses Firebase cloud functions that can trivially check a users Auth (as it's all within the same system).

In the future, the equivalent could be achieved with Hypha by having a dedicated review-backend running, but this won't be achievable robustly in a short space of time.

I would recommend I finish the Firebase version, and that migrating back to Hypha is left as a task for future contributors.

[oeway]

No, no netlify function needed, it will be a Python file with hypha service that we deployed together with the bioengine running on the backend, it's the same as a firebase, flask server, fastapi or equivalent.

The js client will call hypha service functions that running on the backend (same as our chatbot which holds OpenAI api token).

Uploader/review client --> hypha/BioEngine server --> hypha service (with review functions, running on a secured server with the bioengine, can keep secret)

Hypha server will handle the authentication, in the hypha service function, you can check it against a list of authorized emails.

If you create a set of Python functions for the backend, we can easily make it available as hypha service. On the client side, you can just call those functions, same as you call bioengine models.

Not sure if we should go for an entirely different framework at this stage, most likely no one in the team gonna continue the development and maintain firebase apps.

[jmetz]

Yes, I think this is what I referred to as having a review backend running above (but rebranded to "hypha service").

I would still for the time being recommend a stable third-party solution such as Firebase instead of relying on a new Hypha service which itself needs to be written and maintained. My impression is that at present Hypha seems a little "wobbly", and tying the uploader to that means one more (important) thing will be unreliable.

However if that's how you'd prefer I spend my time, then that's what I'll do 👍

[oeway]

Well, You might get the impression from the model testing issues with triton, which are mainly because of GPU, model loading and triton memory issues. But as a communication hub, the latest hypha is rather stable. We have been using it for the chatbot and many other services for quite sometime.

I am rather confident that for a simple review function it won't be a problem.

Plus, unless you propose and implement an entire solution without hypha that is much better than hypha, I don't think only moving the review feature to an entire different new Google framework (while keeping the login, upload and model testing) would make it better -- on contrary, it make it even harder to maintain, since we need people with expertise in firebase.

[jmetz]

Closed with 48a39ba