adjusted migration

Initial bayer app

Show Pack Classification

Adjusted docker compose to bayer specifics

Adjusted Dockerfile for Bayer

Adding secret flags to group, add secret pools to packages

Adjusted View for Package creation

Prep configs, added Package Create Modal

wip

More on PES

wip

wip

Wip

minor

PW interactions

API PES

wip

Make Select Widget reflect required

make required generallay available

Update UI if pathway mode is set to build

Added ais

circle adjustments

Initial Zoom, fix AD Creation

wip

auth log, bb4g fix

missing import

Added viz hint if PES is part of reaction

Add Edge check for pes

flip boolean

...

pes

Added extra

...

In / Out Edges Viz, Submitting Button Text

...

Make PES Link clickable

Return proper http response instead of error

Fixed error return, removed unused options

Fix PES Link HTML for other entities

Fixed molfile assignment, adjusted Export

Package Export/Import cycle

highlight Description links

implemented non persistent

Harmonised proposed field in Json output

Added pesLink field to PW Api output

PES Fields in API Output

removed debug

Fix Classification import, Fix PES Deserialization

underline pes link in templates

Fix alter name/desc for node, make /node /edge funcitonal

provide setting link and copy button

Implemented Compound Names / Reaction Names View Option

Unconnected Nodes

Make links thicker, reduce timeout trigger time

Show proposed info in popover

Pathway Build no stereo removal

Include probs in reaction name option viz

Detect clicks outside nodes/edges

Provide proper Error Pages

View Package Perm

wip

sync

Auth log

auth log leftovers

...

secret packs viz

auth log for api

model stats

Fix Package Adjustment

Adjust Group Auth Log

Fix Secret image size in Navbar

leftover

...

minor

epdb/legacy_api.py

@@ -1,17 +1,20 @@
+import logging
 from collections import defaultdict
 from typing import Any, Dict, List, Optional
 
+import jwt
 import nh3
+import requests
 from django.conf import settings as s
 from django.contrib.auth import get_user_model
+from django.core.cache import cache
 from django.http import HttpResponse, JsonResponse
 from django.shortcuts import redirect
 from ninja import Field, Form, Query, Router, Schema
-from ninja.security import SessionAuth
+from ninja.security import HttpBearer
 
 from utilities.chem import FormatConverter
 from utilities.misc import PackageExporter
-
 from .logic import (
     EPDBURLParser,
     GroupManager,
@@ -42,9 +45,32 @@ from .models import (
     User,
     UserPackagePermission,
 )
+from .views import delete_with_log, get_remote_address
 
 Package = s.GET_PACKAGE_MODEL()
 
+auth_log = logging.getLogger("auth")
+
+
+def get_cached_jwks(tenant_id: str, force=False) -> Dict:
+    """Get JWKS using Django cache"""
+    cache_key = f"jwks_{tenant_id}"
+
+    jwks = cache.get(cache_key)
+
+    if jwks is None or force:
+        # Cache miss, fetch new keys
+        jwks_uri = f"https://login.microsoftonline.com/{tenant_id}/discovery/v2.0/keys"
+        response = requests.get(jwks_uri)
+        response.raise_for_status()
+
+        jwks = response.json()
+
+        # Cache for 1 hour (3600 seconds)
+        cache.set(cache_key, jwks, 3600)
+
+    return jwks
+
 
 def get_package_for_read(user, package_uuid):
     return PackageManager.get_package_by_id(user, package_uuid)
@@ -63,7 +89,59 @@ def _anonymous_or_real(request):
     return get_user_model().objects.get(username="anonymous")
 
 
-router = Router(auth=SessionAuth(csrf=False))
+def validate_token(token: str) -> dict:
+    TENANT_ID = s.MS_ENTRA_TENANT_ID
+    CLIENT_ID = s.MS_ENTRA_CLIENT_ID
+
+    jwks = get_cached_jwks(TENANT_ID)
+
+    header = jwt.get_unverified_header(token)
+
+    public_key = jwt.algorithms.RSAAlgorithm.from_jwk(
+        next(k for k in jwks["keys"] if k["kid"] == header["kid"])
+    )
+
+    # Handle V1 and V2 tokens
+    try:
+        claims = jwt.decode(
+            token,
+            public_key,
+            algorithms=["RS256"],
+            audience=[CLIENT_ID, f"api://{CLIENT_ID}"],
+            issuer=[
+                f"https://sts.windows.net/{TENANT_ID}/",
+                f"https://login.microsoftonline.com/{TENANT_ID}/v2.0"
+            ]
+        )
+    except Exception as e:
+        raise ValueError(f"Token verification failed! - {e}")
+
+    return claims
+
+
+class MSBearerTokenAuth(HttpBearer):
+
+    def authenticate(self, request, token):
+
+        auth_log.info(f"Authentication request by {get_remote_address(request)}")
+
+        if token is None:
+            return None
+
+        claims = validate_token(token)
+
+        if not User.objects.filter(uuid=claims['oid']).exists():
+            auth_log.info(f"Authentication request by {get_remote_address(request)} failed!")
+            return None
+
+        user = User.objects.get(uuid=claims['oid'])
+        request.user = user
+        auth_log.info(
+            f"User {user.username} {'(admin) ' if user.is_superuser else ''}with OID {user.uuid} successfully logged in as {user.username} from {get_remote_address(request)}")
+        return request.user
+
+
+router = Router(auth=MSBearerTokenAuth())
 
 
 class Error(Schema):
@@ -157,21 +235,6 @@ class SimpleModel(SimpleObject):
     identifier: str = "relative-reasoning"
 
 
-################
-# Login/Logout #
-################
-@router.post("/", response={200: SimpleUser, 403: Error}, auth=None)
-def login(request, loginusername: Form[str], loginpassword: Form[str]):
-    from django.contrib.auth import authenticate, login
-
-    email = User.objects.get(username=loginusername).email
-    user = authenticate(username=email, password=loginpassword)
-    if user:
-        login(request, user)
-        return user
-    else:
-        return 403, {"message": "Invalid username and/or password"}
-
 
 ########
 # User #
@@ -508,7 +571,10 @@ def update_package(request, package_uuid, pack: Form[UpdatePackage]):
 
         if pack.hiddenMethod:
             if pack.hiddenMethod == "DELETE":
-                p.delete()
+                if PackageManager.administrable(request.user, p):
+                    delete_with_log(request, p)
+                else:
+                    raise ValueError("You do not have the rights to delete this Package!")
 
         elif pack.packageDescription is not None:
             description = nh3.clean(pack.packageDescription, tags=s.ALLOWED_HTML_TAGS).strip()
@@ -545,7 +611,7 @@ def delete_package(request, package_uuid):
         p = PackageManager.get_package_by_id(request.user, package_uuid)
 
         if PackageManager.administrable(request.user, p):
-            p.delete()
+            delete_with_log(request, p)
             return redirect(f"{s.SERVER_URL}/package")
         else:
             raise ValueError("You do not have the rights to delete this Package!")
@@ -584,9 +650,14 @@ class CompoundSchema(Schema):
     reviewStatus: str = Field(False, alias="review_status")
     scenarios: List["SimpleScenario"] = Field([], alias="scenarios")
     structures: List["CompoundStructureSchema"] = []
+    pesLink: str | None = Field(None, alias="pes_link")
 
     @staticmethod
-    def resolve_review_status(obj: CompoundStructure):
+    def resolve_pes_link(obj: Compound):
+        return getattr(obj.default_structure, "pes_link", None)
+
+    @staticmethod
+    def resolve_review_status(obj: Compound):
         return "reviewed" if obj.package.reviewed else "unreviewed"
 
     @staticmethod
@@ -660,6 +731,7 @@ class CompoundStructureSchema(Schema):
     reviewStatus: str = Field(None, alias="review_status")
     scenarios: List["SimpleScenario"] = Field([], alias="scenarios")
     smiles: str = Field(None, alias="smiles")
+    pesLink: str | None = Field(None, alias="pes_link")
 
     @staticmethod
     def resolve_review_status(obj: CompoundStructure):
@@ -799,6 +871,7 @@ class CreateCompound(Schema):
     compoundName: str | None = None
     compoundDescription: str | None = None
     inchi: str | None = None
+    pesLink: str | None = None
 
 
 @router.post("/package/{uuid:package_uuid}/compound")
@@ -809,14 +882,37 @@ def create_package_compound(
 ):
     try:
         p = get_package_for_write(request.user, package_uuid)
-        c = Compound.create(
-            p,
-            c.compoundSmiles,
-            molfile=c.compoundMolFile,
-            name=c.compoundName,
-            description=c.compoundDescription,
-            inchi=c.inchi,
-        )
+        # inchi is not used atm
+
+        if c.pesLink is not None:
+            from bayer.views import fetch_pes
+            from bayer.models import PESCompound
+
+            try:
+                pes_data = fetch_pes(request, c.pesLink)
+            except ValueError as e:
+                return 400, {"message": f"Could not fetch PES data for {c.pesLink}"}
+
+            classification = pes_data.get("classificationLevel", "")
+            if "secret" == classification.lower():
+
+                if p.classification_level != Package.Classification.SECRET:
+                    return 400, {"message": "Cannot create secret PESs in non-secret packages."}
+
+                if not p.data_pool or not p.data_pool.secret:
+                    return 400, {"message": "Cannot create secret PESs in package without a secret data pool."}
+
+
+            c = PESCompound.create(p, pes_data, c.compoundName, c.compoundDescription)
+        else:
+            c = Compound.create(
+                p,
+                c.compoundSmiles,
+                molfile=c.compoundMolFile,
+                name=c.compoundName,
+                description=c.compoundDescription,
+                inchi=c.inchi
+            )
         return redirect(c.url)
     except ValueError as e:
         return 400, {"message": str(e)}
@@ -1627,6 +1723,7 @@ class PathwayNode(Schema):
     proposed: List[Dict[str, Any]] = []
     smiles: str = Field(None, alias="smiles")
     pseudo: bool = Field(False, alias="pseudo")
+    pesLink: str | None = Field(None, alias="pes_link")
 
     @staticmethod
     def resolve_atom_count(obj: Node):
@@ -1795,7 +1892,7 @@ def delete_pathway(request, package_uuid, pathway_uuid):
         p = get_package_for_write(request.user, package_uuid)
 
         pw = Pathway.objects.get(package=p, uuid=pathway_uuid)
-        pw.delete()
+        delete_with_log(request, pw)
         return redirect(f"{p.url}/pathway")
 
     except ValueError:
@@ -1893,35 +1990,73 @@ def get_package_pathway_node(request, package_uuid, pathway_uuid, node_uuid):
 
 
 class CreateNode(Schema):
-    nodeAsSmiles: str
+    nodeAsSmiles: str | None = None
     nodeAsMolFile: str | None = None
     nodeName: str | None = None
     nodeReason: str | None = None
     nodeDepth: str | None = None
+    pesLink: str | None = None
 
 
 @router.post(
     "/package/{uuid:package_uuid}/pathway/{uuid:pathway_uuid}/node",
-    response={200: str | Any, 403: Error},
+    response={200: str | Any, 400: Error, 403: Error},
 )
 def add_pathway_node(request, package_uuid, pathway_uuid, n: Form[CreateNode]):
     try:
         p = get_package_for_write(request.user, package_uuid)
         pw = Pathway.objects.get(package=p, uuid=pathway_uuid)
 
-        if n.nodeDepth is not None and n.nodeDepth.strip() != "":
-            node_depth = int(float(n.nodeDepth))
-        else:
-            node_depth = -1
+        # TODO Code Dup from bayer.views
 
-        node = Node.create(
-            pw,
-            n.nodeAsSmiles,
-            node_depth,
-            molfile=n.nodeAsMolFile,
-            name=n.nodeName,
-            description=n.nodeReason,
-        )
+        if n.pesLink:
+            from bayer.views import fetch_pes
+            from bayer.models import PESCompound
+
+            try:
+                pes_data = fetch_pes(request, n.pesLink)
+            except ValueError as e:
+                return 400, {"message": f"Could not fetch PES data for {n.pesLink}"}
+
+            classification = pes_data.get("classificationLevel", "")
+            if "secret" == classification.lower():
+
+                if p.classification_level != Package.Classification.SECRET:
+                    return 400, {"message": "Cannot create secret PESs in non-secret packages."}
+
+                if not p.data_pool or not p.data_pool.secret:
+                    return 400, {"message": "Cannot create secret PESs in package without a secret data pool."}
+
+            c = PESCompound.create(p, pes_data, n.nodeName, n.nodeReason)
+
+            node_qs = Node.objects.filter(pathway=pw, default_node_label=c.default_structure)
+            if node_qs.exists():
+                return redirect(pw.url)
+
+            node = Node()
+            node.stereo_removed = False
+            node.pathway = pw
+            node.depth = 0
+
+            node.default_node_label = c.default_structure
+            node.save()
+
+            node.node_labels.add(c.default_structure)
+            node.save()
+        else:
+            if n.nodeDepth is not None and n.nodeDepth.strip() != "":
+                node_depth = int(n.nodeDepth)
+            else:
+                node_depth = -1
+
+            node = Node.create(
+                pw,
+                n.nodeAsSmiles,
+                node_depth,
+                molfile=n.nodeAsMolFile,
+                name=n.nodeName,
+                description=n.nodeReason,
+            )
 
         return redirect(node.url)
     except ValueError:
@@ -1935,7 +2070,7 @@ def delete_node(request, package_uuid, pathway_uuid, node_uuid):
 
         pw = Pathway.objects.get(package=p, uuid=pathway_uuid)
         n = Node.objects.get(pathway=pw, uuid=node_uuid)
-        n.delete()
+        delete_with_log(request, n)
         return redirect(f"{pw.url}/node")
 
     except ValueError:
@@ -2033,13 +2168,16 @@ def add_pathway_edge(request, package_uuid, pathway_uuid, e: Form[CreateEdge]):
         educts = []
         products = []
 
+        subclasses = CompoundStructure.__subclasses__()
+
         if e.edgeAsSmirks:
             for ed in e.edgeAsSmirks.split(">>")[0].split("\\."):
                 stand_ed = FormatConverter.standardize(ed, remove_stereo=True)
                 educts.append(
                     Node.objects.get(
                         pathway=pw,
-                        default_node_label=CompoundStructure.objects.get(
+                        default_node_label=CompoundStructure.objects.not_instance_of(*subclasses).
+                        get(
                             compound__package=p, smiles=stand_ed
                         ).compound.default_structure,
                     )
@@ -2050,7 +2188,8 @@ def add_pathway_edge(request, package_uuid, pathway_uuid, e: Form[CreateEdge]):
                 products.append(
                     Node.objects.get(
                         pathway=pw,
-                        default_node_label=CompoundStructure.objects.get(
+                        default_node_label=CompoundStructure.objects.not_instance_of(*subclasses).
+                        get(
                             compound__package=p, smiles=stand_pr
                         ).compound.default_structure,
                     )
@@ -2091,7 +2230,7 @@ def delete_edge(request, package_uuid, pathway_uuid, edge_uuid):
 
         pw = Pathway.objects.get(package=p, uuid=pathway_uuid)
         e = Edge.objects.get(pathway=pw, uuid=edge_uuid)
-        e.delete()
+        delete_with_log(request, e)
         return redirect(f"{pw.url}/edge")
 
     except ValueError: