GMS API integration by valentinRyckaert · Pull Request #3 · hep-training/TeSS

valentinRyckaert · 2026-08-10T15:15:20Z

Summary of changes

Adding the GMS API fetching system as part of the private spaces implementation.
removing everse theme, not longer necessary for HEP Training

Motivation and context

Using the CERN SSO system for private spaces.

Checklist

[x] I have read and followed the CONTRIBUTING guide.
[x] I confirm that I have the authority necessary to make this contribution on behalf of its copyright owner and agree to license it to the TeSS codebase under the BSD license.

kennethrioja · 2026-08-11T14:01:46Z

    sources: false
    nodes: false
    spaces: false
+    api_system_for_groups: # link the the GMS API


# Link 'to' the GMS API

Can you give an example on how the link should be? e.g., https://myapi.com or myapi.com?

kennethrioja · 2026-08-11T14:53:46Z

+#
+# Points of attention:: Uses class variables (@@bearer_token) for token caching,
+# which is shared across all instances. Consider thread-safety implications
+# in concurrent environments.


Let's use Rails.fetch.cache() for caching instead of @@bearer_token class variable – then you can remove the comment in the code

kennethrioja · 2026-08-11T15:10:14Z

+  def valid_token?
+    return false unless defined?(@@bearer_token)
+    response = HTTParty.get(
+      TeSS::Config.feature['api_system_for_groups'] + "/Group/1",


LLM found "SSO Token Thread-Safety & API DoS:
@@bearer_token is not thread-safe. valid_token? DDoS-ing your own external API with /Group/1 remains a major issue."

As discussed, if you know the expiration_time/date from the GMS API, then no need to have valid_token? method anymore

kennethrioja · 2026-08-11T15:36:20Z

We must check live:

when a group (from GMS) is deleted, whether the records are deleted too -> UPDATE: It can happen that a GMS group is deleted, then HEP Training is not updating automatically nor doing anything. Admin must manually check.
when a private space (from TeSS) is deleted, whether the records are deleted too -> UPDATE: The output is that the records are deleted.
when a private space G1 (from TeSS) is switching from private to public, whether the records are now shown
- then what happens when we make G1 private again -> it should hide records

If tests about this are not done, do it (+ if relevant to upstream TeSS, do a PR)

kennethrioja · 2026-08-12T07:43:45Z

+  # GET /search_groups
+  #
+  # Get all the groups of the space. Requires authorization via SpacePolicy#search_groups?.
+  # Used only when Group API System is enabled. 


Suggested change

# Used only when Group API System is enabled.

# Used only when Group API System is enabled.

# Triggered in the Spaces form when the admin searches for GMS groups

kennethrioja · 2026-08-12T07:51:36Z

 # Groups are primarily used to control access to private Space objects: a
 # private space is only accessible to users belonging to one of the space's
 # associated groups (see ApplicationPolicy#shown?).
+# Used only when Group API System is enabled.


This is not true (!?)

Suggested change

# Used only when Group API System is enabled.

# Used only when Group API System is disabled.

kennethrioja · 2026-08-12T07:54:36Z

 # of the group (see the +owner+ attribute, managed for example by
 # GroupsController#sync_owners), which grants additional permissions such
 # as editing or destroying the group (see GroupPolicy#owner?).
+# Used only when Group API System is enabled.


Again, not true, we use group_membership only when there is the classic Group in TeSS

Suggested change

# Used only when Group API System is enabled.

# Used only when Group API System is disabled.

kennethrioja · 2026-08-12T08:07:27Z

  has_many :administrators, through: :administrator_roles, source: :user, class_name: 'User'
-  has_and_belongs_to_many :groups
+
+  has_and_belongs_to_many :groups unless TeSS::Config.feature['api_system_for_groups'] # Used only when Group API System is enabled.


Suggested change

has_and_belongs_to_many :groups unless TeSS::Config.feature['api_system_for_groups'] # Used only when Group API System is enabled.

has_and_belongs_to_many :groups unless TeSS::Config.feature['api_system_for_groups'] # Used only when Group API System is disabled.

kennethrioja · 2026-08-12T08:14:16Z

-  has_many :users, through: :group_memberships
+        # The users belonging to this group, through #group_memberships.
+        has_many :users, through: :group_memberships
+    end


Suggested change

end

this end closes the unless statement

kennethrioja · 2026-08-12T08:15:18Z

  # The spaces this group grants access to.
  has_and_belongs_to_many :spaces


There is an asymmetry with what's written in space.rb, if the space HABTM relation is disabled, it should be as well here in group

Suggested change

# The spaces this group grants access to.

has_and_belongs_to_many :spaces

# The spaces this group grants access to.

has_and_belongs_to_many :spaces

end

kennethrioja · 2026-08-12T08:26:18Z

Use Redis.cache here instead of @@redis

kennethrioja · 2026-08-12T08:49:40Z

+    )
+
+    token = response.parsed_response["access_token"]
+    Rails.cache.write("api_service:bearer_token", token, expires_in: (token['expires_in'] - 5).minutes)


Cool this is better now!

kennethrioja · 2026-08-12T09:03:33Z


-      <% if is_admin || is_curator || is_owner_in_any_group %>
+
+      <% if !TeSS::Config.feature['api_system_for_groups'] && (is_admin || is_curator || is_owner_in_any_group) %>


Note: Even if curator doesn't really care about the group, I understand we leave it like that as it is the case for the other <li> involving is_admin || is_curator

Co-authored-by: Kenneth Rioja <59597207+kennethrioja@users.noreply.github.com>

…ivate-spaces into api-integration

kennethrioja · 2026-08-14T08:56:13Z

API: fix -> After deleting a private space, I wanted to recreate the cernspace, I copied-pasted the name of the GMS group and there is the loading icon that is running forever OR if an admin gives the space administrator role to a user, and when connected with the user it runs forever too

URL checker: fix -> while entering an URL of a material that is already present in a private space, we can still see the help-block that shows the URL of the private material -> it is acceptable to have duplicate entries between public-private but it is not acceptable to see what's in the private spaces. ('worst' case if the private space becomes public, then we have a duplicate entry under different spaces/owner; or if the private space is deleted, the material is deleted and there is no duplicates here)

To address in TeSS upstream:

UI: feat -> admins should see groups for each space: add Groups field only shown to TeSS admins and space admins that lists the groups necessary to access the spaces (currently it demands to click on the Edit button for each and every space to see the groups, this is not convenient) + show space admin in the list in /spaces/ -> PR to upstream TeSS
Spaces: fix -> When User goes to unauthorized space, there is the 'You are not allowed', you go back and click on another page and there is the same error message whereas User is in an authorized space -> PR to upstream TeSS

To address in documentations:

Addressed in Deleting a public or private space, what happens to their resources? user-docs#2 - Deleting private space: documentation -> Deleting a private space, deletes private materials (as a non authorized user, it went from a Not authorized to 404; as admin you cannot see space nor materials in /Materials and using the URL) HOWEVER private space URL is still running (which is normal as the route is not deleted) but shows the default UI. -> to add in documentation: "Deleting a private space deletes the resources linked to the space, but the administrator must erase the route associated to the space to avoid users to still visit the private space URL (which shows the default space)."
Addressed in Deleting a public or private space, what happens to their resources? user-docs#2 - Deleting public space: documentation -> Deleting a public space, moves material in the default space, thus shows it to any user.

Co-authored-by: Kenneth Rioja <59597207+kennethrioja@users.noreply.github.com>

…oups

…ivate-spaces into api-integration

kennethrioja · 2026-08-17T15:10:29Z

API fix is done and works, now either admin while creating or editing or user while editing is shown with the right group name ✅
When a duplicate of a private material is being created, it doesn't show the private material through this URL checker ✅

Co-authored-by: Kenneth Rioja <59597207+kennethrioja@users.noreply.github.com>

…ivate-spaces into api-integration

kennethrioja · 2026-08-21T12:33:08Z

Can you fetch hep-training:api-integration-update and cherry-pick the two last commits? (For some reason I couldn't push them to your forked repo branch valentinRyckaert:api-integration)

git remote add hep-training https://github.com/hep-training/TeSS.git
git fetch hep-training
git checkout api-integration
git cherry-pick 872b7d2781043caf5176f0f2a666f7a4b18456b3
git cherry-pick dcbae222827afd8524ea8b6d01d623e5822bf718
git push

Thanks!

Valentin Ryckaert added 8 commits July 10, 2026 17:40

feat: add api integration

0c9b1b2

init: make API a feature

37a81c6

feat: finish making api integration as feature

a4ee360

update: move APIService

428c1b9

feat: fix minors errors + add redis cache system

0aa4c79

feat: add rdoc docstrings

5fb0dbb

fix: make space validation working

1e4321e

merge private-spaces implementation

c699e44

valentinRyckaert force-pushed the api-integration branch from f3151c5 to c699e44 Compare August 11, 2026 12:29

= added 3 commits August 11, 2026 14:37

feat: add modifications from removed commits

24acccf

fix: fix typo

0208a95

feat: add api_system_for_groups to tess.example.yml

41f8690

kennethrioja reviewed Aug 11, 2026

View reviewed changes

feat: improve service_api

1ca7272