permission error for POST aggregations in v3/meta

[schristley]

This is on the VDJServer tenant. I’m getting a permission error for aggregations that use the POST end point (submitLargeAggregation).

request for this uri path v1airr/repertoire_1/_aggrs/facets permissions spec meta:vdjserver:POST:v1airr:repertoire_1:_aggrs is NOT permitted

The aggregation works properly on the GET end point.

[smpadhy]

POST permission has been added for the user.

[schristley]

@smpadhy I seem to be getting a different error now. I'm also getting the error with the admin account which I thought was working before.

$ curl -v -H "X-Tapis-Token: $JWT" -H "Content-type: application/json" --data '{"match":{},"field":"$study.study_id"}' https://vdjserver.tapis.io/v3/meta/v1airr/repertoire_1/_aggrs/facets
*   Trying 129.114.103.30:443...
* Connected to vdjserver.tapis.io (129.114.103.30) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: C=US; ST=Texas; O=The University of Texas at Austin; CN=*.tapis.io
*  start date: Sep 27 00:00:00 2022 GMT
*  expire date: Sep 27 23:59:59 2023 GMT
*  subjectAltName: host "vdjserver.tapis.io" matched cert's "*.tapis.io"
*  issuer: C=US; ST=MI; L=Ann Arbor; O=Internet2; OU=InCommon; CN=InCommon RSA Server CA
*  SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x7f96c880d000)
> POST /v3/meta/v1airr/repertoire_1/_aggrs/facets HTTP/2
> Host: vdjserver.tapis.io
> user-agent: curl/7.79.1
> accept: */*
> x-tapis-token: eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJqdGkiOiIwYWYzOTc2OS02ODdkLTQ2YTUtOGIyNy1iNzBhYTgyN2I5MzAiLCJpc3MiOiJodHRwczovL3ZkanNlcnZlci50YXBpcy5pby92My90b2tlbnMiLCJzdWIiOiJ2ZGpAdmRqc2VydmVyIiwidGFwaXMvdGVuYW50X2lkIjoidmRqc2VydmVyIiwidGFwaXMvdG9rZW5fdHlwZSI6ImFjY2VzcyIsInRhcGlzL2RlbGVnYXRpb24iOmZhbHNlLCJ0YXBpcy9kZWxlZ2F0aW9uX3N1YiI6bnVsbCwidGFwaXMvdXNlcm5hbWUiOiJ2ZGoiLCJ0YXBpcy9hY2NvdW50X3R5cGUiOiJ1c2VyIiwiZXhwIjoxNjcwNjI1NTkwLCJ0YXBpcy9jbGllbnRfaWQiOm51bGwsInRhcGlzL2dyYW50X3R5cGUiOiJwYXNzd29yZCJ9.jgZ4HbVnn3gf9EQ6K4-ecGWaZIvF1cDKYvOO5yyOGoapNEibFj3JPcvI-pIEu73HM5F1WTWB6Qi4X595ZFrwq28o95aXWBpsCMARyxKiOA2OfRQW5Zl0NX2cARsj6hgo42SaHlluvyDzi9Ojr5rT0JGDVptBFtkUpkJ4A-pYV7fN7YXNsAAz_pyC62b0c-7scbVVX7RFpkaDumEokOcF-v9tE2AJne0VhvxXro2qqinpDrCKie2Iw8DoWf6zHVVouYpPCjBYBSExdLx0lraBHimZNAMhSF2Bn_AKilGAB7Ltrwi43rmRfFoPzK34g9dP0H-2JRVmrBCkzRZuGewchw
> content-type: application/json
> content-length: 38
> 
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
* We are completely uploaded and fine
< HTTP/2 405 
< server: nginx/1.23.2
< date: Fri, 09 Dec 2022 18:43:53 GMT
< content-type: application/json
< content-length: 171
< strict-transport-security: max-age=63072000
< access-control-allow-origin: *
< access-control-allow-credentials: true
< access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
< access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With,x-tapis-token
< 
* Connection #0 to host vdjserver.tapis.io left intact
{"http status code":405,"http status description":"Method Not Allowed","message":"method POST not allowed","_links":{"self":{"href":"/v1airr/repertoire_1/_aggrs/facets"}}}

[schristley]

Here's the same request but using GET which runs fine. Most of our queries are too large to use GET and need to POST instead.

$ curl -H "X-Tapis-Token: $JWT" -H "Content-type: application/json" https://vdjserver.tapis.io/v3/meta/v1airr/repertoire_1/_aggrs/facets?avars=%7B%22match%22%3A%7B%7D%2C%22field%22%3A%22%24study.study_id%22%7D
[{"_id":null,"facets":[{"_id":"PRJNA349143","count":30},{"_id":"PRJNA272713","count":30},{"_id":"PRJNA624801","count":1},{"_id":"PRJEB18631","count":71},{"_id":"dewitt-2015-jvi","count":48},{"_id":"ImmuneCODE-COVID-Release-002: COVID-19-HUniv12Oct","count":193},{"_id":"PRJNA606979","count":14},{"_id":"PRJNA248475","count":32},{"_id":"PRJNA300878","count":60},{"_id":"PRJNA747292","count":51},{"_id":"PRJNA642962","count":2},{"_id":"BIOPROJECT:PRJNA639580","count":26},{"_id":"PRJNA362309","count":18},{"_id":"PRJNA406949","count":180},{"_id":"3276777473314001386-242ac116-0001-012","count":60},{"_id":"ImmuneCODE-COVID-Release-002: COVID-19-BWNW","count":50},{"_id":"PRJNA472381","count":10},{"_id":"PRJNA724733","count":20},{"_id":"PRJNA593622","count":28},{"_id":"4995411523885404651-242ac118-0001-012","count":105},{"_id":"PRJNA283640","count":6},{"_id":"PRJNA608742","count":9},{"_id":"1371444213709729305-242ac11c-0001-012","count":29},{"_id":"emerson-2017-natgen","count":786},{"_id":"ImmuneCODE-COVID-Release-002: COVID-19-Adaptive","count":160},{"_id":"robins-bcell-2016","count":6},{"_id":"PRJNA260556","count":6},{"_id":"PRJNA549712","count":76},{"_id":"PRJNA315079","count":8},{"_id":"ImmuneCODE-COVID-Release-002: COVID-19-NIH/NIAID","count":357},{"_id":"TCR:PRJNA511481","count":92},{"_id":"PRJNA680539","count":20},{"_id":"4505707319090933270-242ac113-0001-012","count":30},{"_id":"langkuhs-2018-plosone","count":50},{"_id":"PRJNA645245","count":87},{"_id":"ImmuneCODE-COVID-Release-002: COVID-19-ISB","count":157},{"_id":"ImmuneCODE-COVID-Release-002: COVID-19-IRST/AUSL","count":64},{"_id":"PRJNA578389","count":3},{"_id":"ImmuneCODE-COVID-Release-002: COVID-19-DLS","count":433}]}] 

[smpadhy]

Fixed. deployed for vdjserver tenant