...

Dockerfile

@@ -85,6 +85,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libxext6 \
     libfontconfig1 \
     nano \
+    openjdk-21-jre-headless \
     && rm -rf /var/lib/apt/lists/*
 
 RUN useradd -ms /bin/bash django

bayer/migrations/0004_package_shareable.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0.3 on 2026-09-08 08:54
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('bayer', '0003_pescompound_pesstructure_package_data_pool'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='package',
+            name='shareable',
+            field=models.BooleanField(default=True, verbose_name='Shareable'),
+        ),
+    ]

bayer/models.py

@@ -23,6 +23,7 @@ class Package(EnviPathModel):
     license = models.ForeignKey(
         "epdb.License", on_delete=models.SET_NULL, blank=True, null=True, verbose_name="License"
     )
+    shareable = models.BooleanField(verbose_name="Shareable", default=True)
 
     class Classification(models.IntegerChoices):
         INTERNAL = 0, "Internal"

bayer/templates/modals/collections/new_pes_modal.html

@@ -36,8 +36,8 @@
       img.onerror = () => {
         this.pesVizHtml = `
           <div class='alert alert-error' role='alert'>
-            <h4 class='alert-heading'>Could not render PES!</h4>
-            <p>Could not render PES - Do you have access?</p>
+            <h4 class='alert-heading'>Failed to fetch this PES!</h4>
+            <p>Either the PES-ID is incorrect, or you're missing sufficient permissions to access this (potentially secret) item. In case you're missing permissions you can request the entitlement cs.u.enviPath_secret_data_user_group on go/idnow to gain access.</p>
           </div>`;
       };
     },

bayer/views.py

@@ -8,7 +8,7 @@ from django.shortcuts import redirect
 
 from bayer.models import PESCompound
 from epdb.logic import PackageManager
-from epdb.models import Pathway, Node
+from epdb.models import Pathway, Node, Group
 from epdb.views import _anonymous_or_real, error
 from utilities.decorators import package_permission_required
 
@@ -18,6 +18,32 @@ Package = s.GET_PACKAGE_MODEL()
 logger = logging.getLogger(__name__)
 
 
+def has_pes_allowance(user):
+    if user.principal_type == user.PrincipalType.APP:
+        return user.app_details.pes_allowance != user.app_details.PESAllowance.NONE
+
+    return True
+
+def has_secret_pes_allowance(user):
+    """
+    Determines if the specified user belongs to any secret group.
+
+    This function checks whether the given user is a member of any group
+    that is marked as secret.
+
+    Args:
+        user: The user for whom the check is performed.
+
+    Returns:
+        bool: True if the user belongs to at least one secret group,
+        False otherwise.
+    """
+    if user.principal_type == user.PrincipalType.APP:
+        return user.app_details.pes_allowance == user.app_details.PESAllowance.SECRET
+
+    return Group.objects.filter(secret=True, user_member=user).exists()
+
+
 @package_permission_required()
 def create_pes(request, package_uuid):
     current_user = _anonymous_or_real(request)
@@ -38,7 +64,7 @@ def create_pes(request, package_uuid):
 
         if pes_link:
             try:
-                pes_data = fetch_pes(request, pes_link)
+                pes_data = fetch_pes(request, pes_link, current_user)
             except ValueError as e:
                 return error(
                     request,
@@ -98,12 +124,12 @@ def create_pes_node(request, package_uuid, pathway_uuid):
 
         if pes_link:
             try:
-                pes_data = fetch_pes(request, pes_link)
+                pes_data = fetch_pes(request, pes_link, current_user)
             except ValueError as e:
                 return error(
                     request,
-                    "Could not fetch PES",
-                    f"Could not fetch PES data for {pes_link}"
+                    "Failed to fetch this PES",
+                    "Either the PES-ID is incorrect, or you're missing sufficient permissions to access this (potentially secret) item. In case you're missing permissions you can request the entitlement cs.u.enviPath_secret_data_user_group on go/idnow to gain access."
                 )
 
             classification = pes_data.get("classificationLevel", "")
@@ -157,53 +183,86 @@ def create_pes_node(request, package_uuid, pathway_uuid):
         return HttpResponseNotAllowed(["POST"])
 
 
-def fetch_pes(request, pes_url) -> dict:
-    from epauth.views import get_access_token_from_request
-    token = get_access_token_from_request(request)
+def get_application_token(prod: bool) -> str:
+    scope = f"{s.PROD_PES_SCOPE if prod else s.NON_PROD_PES_SCOPE}/.default"
 
-    if token is None:
-        token = pes_url.split('/')[-1] == 'dummy'
+    url = f"https://login.microsoftonline.com/{s.MS_ENTRA_TENANT_ID}/oauth2/v2.0/token"
+    data = {
+        "grant_type": "client_credentials",
+        "client_id": s.MS_ENTRA_CLIENT_ID,
+        "client_secret": s.MS_ENTRA_CLIENT_SECRET,
+        "scope": scope,
+    }
 
-    if token:
-        for k, v in s.PES_API_MAPPING.items():
-            if pes_url.startswith(k):
-                pes_id = pes_url.split('/')[-1]
+    try:
+        response = requests.post(url, data=data)
+        response.raise_for_status()
+        return response.json()["access_token"]
+    except requests.exceptions.HTTPError as e:
+        logger.error(f"Could not fetch application token: {e}")
+        raise ValueError(f"Could not fetch application token!")
 
-                if pes_id == 'dummy':
-                    import json
-                    res_data = json.load(open(s.BASE_DIR / "fixtures/pes.json"))
+
+def fetch_pes(request, pes_url, user) -> dict:
+
+    if not has_pes_allowance(user):
+        logger.info(f"User {user.username} does not have permission to fetch PESs")
+        raise ValueError(f"User {user.username} does not have permission to fetch PESs")
+
+    for k, v in s.PES_API_MAPPING.items():
+        if pes_url.startswith(k):
+
+            prod = "cropkey-np" not in pes_url
+
+            pes_id = pes_url.split('/')[-1]
+
+            if pes_id == 'dummy':
+                import json
+                res_data = json.load(open(s.BASE_DIR / "fixtures/pes.json"))
+                res_data["pes_url"] = pes_url
+                return res_data
+            else:
+                headers = {
+                    "accept": "*/*",
+                    "authorization": "Bearer " + get_application_token(prod),
+                }
+
+                # Restrict request if user is not part of any secret group
+                if not has_secret_pes_allowance(user):
+                    headers["app-classification-level-restriction"] = "restrict-pes-secret-structure-access"
+
+
+                params = {"pes_reg_entity_corporate_id": pes_id}
+
+                res = requests.get(v, headers=headers, params=params, proxies=s.PROXIES or None)
+
+                try:
+                    res.raise_for_status()
+                    pes_data = res.json()
+
+                    # Handle missing response
+                    if "detail" in pes_data and "The following PES Reg Entities Corporate Ids could not be found" in pes_data["detail"]:
+                        raise ValueError(f"PES with id {pes_id} not found")
+
+                    # Ensure we have a entity
+                    if len(pes_data) == 0:
+                        raise ValueError(f"PES with id {pes_id} not found")
+
+                    res_data = pes_data[0]
                     res_data["pes_url"] = pes_url
                     return res_data
-                else:
-                    headers = {"Authorization": f"Bearer {token['access_token']}"}
-                    params = {"pes_reg_entity_corporate_id": pes_id}
 
-                    res = requests.get(v, headers=headers, params=params, proxies=s.PROXIES or None)
+                except requests.exceptions.HTTPError as e:
+                    raise ValueError(f"Error fetching PES with id {pes_id}: {e}")
 
-                    try:
-                        res.raise_for_status()
-                        pes_data = res.json()
-
-                        if len(pes_data) == 0:
-                            raise ValueError(f"PES with id {pes_id} not found")
-
-                        res_data = pes_data[0]
-                        res_data["pes_url"] = pes_url
-                        return res_data
-
-                    except requests.exceptions.HTTPError as e:
-                        raise ValueError(f"Error fetching PES with id {pes_id}: {e}")
-        else:
-            raise ValueError(f"Unknown URL {pes_url}")
-    else:
-        raise ValueError("Could not fetch access token from request.")
+    raise ValueError(f"Unknown URL {pes_url}")
 
 
 def visualize_pes(request):
     pes_link = request.GET.get('pesLink')
 
     if pes_link:
-        pes_data = fetch_pes(request, pes_link)
+        pes_data = fetch_pes(request, pes_link, request.user)
 
         representations = pes_data.get('representations')
 

envipath/settings.py

@@ -445,6 +445,8 @@ if MS_ENTRA_ENABLED:
     MS_ENTRA_AUTHORITY = f"https://login.microsoftonline.com/{MS_ENTRA_TENANT_ID}"
     MS_ENTRA_REDIRECT_URI = os.environ["MS_REDIRECT_URI"]
     MS_ENTRA_SCOPES = os.environ.get("MS_SCOPES", "").split(",")
+    NON_PROD_PES_SCOPE = os.environ.get("NON_PROD_PES_SCOPE")
+    PROD_PES_SCOPE = os.environ.get("PROD_PES_SCOPE")
 
 # Site ID 10 -> beta.envipath.org
 MATOMO_SITE_ID = os.environ.get("MATOMO_SITE_ID", "10")

epauth/views.py

@@ -9,7 +9,7 @@ from django.shortcuts import redirect
 
 from epdb.logic import UserManager, GroupManager
 from epdb.models import Group
-from epdb.views import get_remote_address
+from epdb.views import get_remote_address, error
 
 auth_log = logging.getLogger("auth")
 
@@ -72,6 +72,15 @@ def entra_callback(request):
 
     claims = result["id_token_claims"]
 
+    if claims.get("roles") is None or claims.get("roles") == [] or "envipath_registered_user" not in claims.get("roles"):
+        auth_log.error(f"Login attempt by {get_remote_address(request)} failed due to missing role")
+        return error(
+            request,
+            "Login Failed",
+            "Request access to role 1230/MON/APPS/Envipath/Envipath_Prod on go/idnow",
+            403,
+        )
+
     user_name = claims.get("name")
     # preferred_username is a fallback for 2nd CWID
     user_email = claims.get("emailaddress", claims.get("email", claims.get("preferred_username")))
@@ -93,7 +102,7 @@ def entra_callback(request):
 
     else:
         auth_log.info(f"Registering {user_name} with OID {user_oid}")
-        u = UserManager.create_user(user_name, user_email, None, uuid=user_oid, is_active=True)
+        u = UserManager.create_user(user_name, user_email, None, uuid=user_oid, is_active=True, add_to_group=False)
         registered = True
 
     auth_log.info(f"User {user_name} {'(admin) ' if u.is_superuser else ''}with OID {user_oid} successfully logged in as {u.username} from {get_remote_address(request)}")
@@ -130,10 +139,16 @@ def entra_callback(request):
                 auth_log.info(f"Login Group Sync: Adding {u.username} to Group {g.name} ({ uuid })")
         else:
             g = Group.objects.get(uuid=uuid)
-            if g.user_member.contains(u):
+            # Do not remove users from All enviPath Users
+            if g.user_member.contains(u) and g.name != 'All enviPath Users':
                 g.user_member.remove(u)
                 auth_log.info(f"Login Group Sync: Removing {u.username} from Group {g.name} ({ uuid })")
 
+    # Ensure people are part of All enviPath Users -> they have to as, envipath_registered_user is granted
+    all_envipath_users = Group.objects.get(name="All enviPath Users")
+    if not all_envipath_users.user_member.contains(u):
+        all_envipath_users.user_member.add(u)
+
     if registered:
         # #72 make package secret if user is part of a secret group
         for id, name in s.ENTRA_SECRET_GROUPS.items():

epdb/admin.py

@@ -6,11 +6,13 @@ from django.contrib import messages
 
 from .models import (
     AdditionalInformation,
+    AppDetails,
     ClassifierPluginModel,
     Compound,
     CompoundStructure,
     Edge,
     EnviFormer,
+    EnzymeLink,
     ExternalDatabase,
     ExternalIdentifier,
     Group,
@@ -39,6 +41,10 @@ class AdditionalInformationAdmin(admin.ModelAdmin):
     pass
 
 
+class AppDetailsAdmin(admin.ModelAdmin):
+    pass
+
+
 class UserAdmin(admin.ModelAdmin):
     list_display = [
         "username",
@@ -212,6 +218,10 @@ class CompoundStructureAdmin(EPAdmin):
     pass
 
 
+class EnzymeLinkAdmin(EPAdmin):
+    pass
+
+
 class SimpleAmbitRuleAdmin(EPAdmin):
     pass
 
@@ -266,6 +276,7 @@ admin.site.register(License, LicenseAdmin)
 admin.site.register(ClassifierPluginModel, ClassifierPluginModelAdmin)
 admin.site.register(Compound, CompoundAdmin)
 admin.site.register(CompoundStructure, CompoundStructureAdmin)
+admin.site.register(EnzymeLink, EnzymeLinkAdmin)
 admin.site.register(SimpleAmbitRule, SimpleAmbitRuleAdmin)
 admin.site.register(ParallelRule, ParallelRuleAdmin)
 admin.site.register(Reaction, ReactionAdmin)
@@ -276,3 +287,4 @@ admin.site.register(Setting, SettingAdmin)
 admin.site.register(Scenario, ScenarioAdmin)
 admin.site.register(ExternalDatabase, ExternalDatabaseAdmin)
 admin.site.register(ExternalIdentifier, ExternalIdentifierAdmin)
+admin.site.register(AppDetails, AppDetailsAdmin)

epdb/legacy_api.py

@@ -43,7 +43,7 @@ from .models import (
     Scenario,
     SimpleAmbitRule,
     User,
-    UserPackagePermission,
+    UserPackagePermission, AppDetails,
 )
 from .views import delete_with_log, get_remote_address
 
@@ -122,7 +122,6 @@ def validate_token(token: str) -> dict:
 class MSBearerTokenAuth(HttpBearer):
 
     def authenticate(self, request, token):
-
         auth_log.info(f"Authentication request by {get_remote_address(request)}")
 
         if token is None:
@@ -130,6 +129,11 @@ class MSBearerTokenAuth(HttpBearer):
 
         claims = validate_token(token)
 
+        if claims.get("roles") is None or claims.get("roles") == [] or "envipath_registered_user" not in claims.get(
+                "roles"):
+            auth_log.error(f"API authentication attempt by {get_remote_address(request)} failed due to missing role")
+            return None
+
         if not User.objects.filter(uuid=claims['oid']).exists():
             auth_log.info(f"Authentication request by {get_remote_address(request)} failed!")
             return None
@@ -564,7 +568,7 @@ class UpdatePackage(Schema):
     write: str | None = None
 
 
-@router.post("/package/{uuid:package_uuid}", response={200: PackageSchema | Any, 400: Error})
+@router.post("/package/{uuid:package_uuid}", response={200: PackageSchema | Any, 400: Error, 403: Error})
 def update_package(request, package_uuid, pack: Form[UpdatePackage]):
     try:
         p = get_package_for_write(request.user, package_uuid)
@@ -590,6 +594,9 @@ def update_package(request, package_uuid, pack: Form[UpdatePackage]):
                 grantee = GroupManager.get_group_lp(pack.ppsURI)
             else:
                 grantee = UserManager.get_user_lp(pack.ppsURI)
+                if grantee.principal_type == request.user.PrincipalType.APP:
+                    if not request.user.is_superuser:
+                        return 403, {"message": "You are not allowed to grant permissions to an app!"}
 
             PackageManager.grant_read(request.user, p, grantee)
             return HttpResponse(status=200)
@@ -598,6 +605,9 @@ def update_package(request, package_uuid, pack: Form[UpdatePackage]):
                 grantee = GroupManager.get_group_lp(pack.ppsURI)
             else:
                 grantee = UserManager.get_user_lp(pack.ppsURI)
+                if grantee.principal_type == request.user.PrincipalType.APP:
+                    if not request.user.is_superuser:
+                        return 403, {"message": "You are not allowed to grant permissions to an app!"}
 
             PackageManager.grant_write(request.user, p, grantee)
             return HttpResponse(status=200)
@@ -889,7 +899,7 @@ def create_package_compound(
             from bayer.models import PESCompound
 
             try:
-                pes_data = fetch_pes(request, c.pesLink)
+                pes_data = fetch_pes(request, c.pesLink, request.user)
             except ValueError as e:
                 return 400, {"message": f"Could not fetch PES data for {c.pesLink}"}
 
@@ -2014,7 +2024,7 @@ def add_pathway_node(request, package_uuid, pathway_uuid, n: Form[CreateNode]):
             from bayer.models import PESCompound
 
             try:
-                pes_data = fetch_pes(request, n.pesLink)
+                pes_data = fetch_pes(request, n.pesLink, request.user)
             except ValueError as e:
                 return 400, {"message": f"Could not fetch PES data for {n.pesLink}"}
 
@@ -2473,3 +2483,78 @@ def export(request, q: Query[PackageExportInSchema]):
         return 403, {
             "message": f"Exporting Package with id {q.package_uuid} failed due to insufficient rights!"
         }
+
+
+class RegisterApplicationInSchema(Schema):
+    oid: str
+    client_id: str
+    name: str
+    secret: bool = False
+    data_pool_uuid: str | None = None
+    pes: str | None
+
+
+@router.post("/integration", response={200: Any, 403: Error})
+def register_app(request, app: Form[RegisterApplicationInSchema]):
+    try:
+        user = request.user
+        if user.is_superuser:
+            user_name = f"APP_{app.oid}"
+            user_email = f"{app.oid}@bayer.com"
+            u = UserManager.create_user(user_name, user_email, None, uuid=app.oid, is_active=True, add_to_group=False)
+
+            # Adjust objects
+            u.principal_type = User.PrincipalType.APP
+
+            if app.pes:
+                pes_choice = next(
+                    choice for choice in AppDetails.PESAllowance
+                    if choice.label.lower() == app.pes.lower()
+                )
+
+                if pes_choice is None:
+                    pes_choice = AppDetails.PESAllowance.NONE
+            else:
+                pes_choice = AppDetails.PESAllowance.NONE
+
+            if app.data_pool_uuid is not None:
+                if not Group.objects.filter(uuid=app.data_pool_uuid, secret=True).exists():
+                    return 400, {"message": f"Group with id {app.data_pool_uuid} does not exist!"}
+
+                data_pool = Group.objects.get(uuid=app.data_pool_uuid, secret=True)
+            else:
+                data_pool = None
+
+            app_details = AppDetails.objects.create(
+                owner=user,
+                client_id=app.client_id,
+                display_name=app.name,
+                secret_allowed=app.secret,
+                data_pool=data_pool,
+                pes_allowance=pes_choice,
+            )
+            u.app_details = app_details
+
+            u.save()
+
+            # Add the integration to the "All enviPath Users" Group
+            all_envipath_users = Group.objects.get(name="All enviPath Users")
+            if not all_envipath_users.user_member.contains(u):
+                all_envipath_users.user_member.add(u)
+
+            if app.secret:
+                if app.data_pool_uuid is None or app.data_pool_uuid.strip() == "":
+                    return 400, {"message": "Secret is only allowed if data pool is specified!"}
+
+                default_package = u.default_package
+                default_package.data_pool = Group.objects.get(uuid=app.data_pool_uuid, secret=True)
+                default_package.classification_level = default_package.Classification.SECRET
+                default_package.save()
+
+            return 200, {"message": "Application registered successfully"}
+        else:
+            raise ValueError("Only superusers can register apps")
+    except ValueError as e:
+        return 403, {
+            "message": f"Registering application failed due to {e}"
+        }

epdb/logic.py

@@ -211,7 +211,7 @@ class UserManager(object):
         # Create package
         package_name = f"{u.username}{'’' if u.username[-1] in 'sxzß' else 's'} Package"
         package_description = "This package was generated during registration."
-        p = PackageManager.create_package(u, package_name, package_description)
+        p = PackageManager.create_package(u, package_name, package_description, shareable=False)
         u.default_package = p
         u.save()
 
@@ -220,11 +220,14 @@ class UserManager(object):
             u.save()
 
         if add_to_group:
-            g = Group.objects.get(public=True, name="enviPath Users")
-            g.user_member.add(u)
-            g.save()
-            u.default_group = g
-            u.save()
+            if Group.objects.filter(public=True, name="enviPath Users").exists():
+                g = Group.objects.get(public=True, name="enviPath Users")
+                g.user_member.add(u)
+                g.save()
+                u.default_group = g
+                u.save()
+            else:
+                logger.info(f"add_to_group was set to True but no public group named 'enviPath Users' exists.")
 
         return u
 
@@ -547,7 +550,7 @@ class PackageManager(object):
 
     @staticmethod
     @transaction.atomic
-    def create_package(current_user, name: str, description: str = None):
+    def create_package(current_user, name: str, description: str = None, *args, **kwargs):
         p = Package()
 
         # Clean for potential XSS
@@ -556,6 +559,9 @@ class PackageManager(object):
         if description is not None and description.strip() != "":
             p.description = nh3.clean(description.strip(), tags=s.ALLOWED_HTML_TAGS).strip()
 
+        if "shareable" in kwargs:
+            p.shareable = kwargs["shareable"]
+
         p.save()
 
         up = UserPackagePermission()
@@ -578,6 +584,9 @@ class PackageManager(object):
         if caller_perm != Permission.ALL[0] and not caller.is_superuser:
             raise ValueError("Only owner are allowed to modify permissions")
 
+        if isinstance(grantee, Group) and package.classification_level == package.Classification.SECRET:
+            raise ValueError("Cannot grant permissions to a Group on a secret package")
+
         data = {
             "package": package,
         }
@@ -623,6 +632,10 @@ class PackageManager(object):
     def grant_write(caller: User, package: Package, grantee: Union[User, Group]):
         PackageManager.update_permissions(caller, package, grantee, Permission.WRITE[0])
 
+    @staticmethod
+    def grant_owner(caller: User, package: Package, grantee: Union[User, Group]):
+        PackageManager.update_permissions(caller, package, grantee, Permission.ALL[0])
+
     @staticmethod
     @transaction.atomic
     def import_legacy_package(
@@ -665,11 +678,11 @@ class PackageManager(object):
         # EDIT START
         if data.get("classification"):
             if data["classification"] == "INTERNAL":
-                pack.classification = Package.Classification.RESTRICTED
+                pack.classification_level = Package.Classification.RESTRICTED
             elif data["classification"] == "RESTRICTED":
-                pack.classification = Package.Classification.RESTRICTED
+                pack.classification_level = Package.Classification.RESTRICTED
             elif data["classification"] == "SECRET":
-                pack.classification = Package.Classification.SECRET
+                pack.classification_level = Package.Classification.SECRET
 
                 if not "datapool" in data:
                     raise ValueError("Missing datapool in package")
@@ -821,7 +834,14 @@ class PackageManager(object):
             r.name = rule["name"]
             r.description = rule["description"]
             r.aliases = rule.get("aliases", [])
-            r.smirks = rule["smirks"]
+
+            if rule.get("smirks") is not None:
+                r.smirks = rule["smirks"]
+            elif rule.get("reactionSmarts") is not None:
+                r.smirks = rule["reactionSmarts"]
+            else:
+                raise ValueError(f"No SMIRKS or reactionSmarts found for rule {rule['id']}")
+
             r.reactant_filter_smarts = rule.get("reactantFilterSmarts", None)
             r.product_filter_smarts = rule.get("productFilterSmarts", None)
             r.save()

epdb/migrations/0031_user_principal_type_appdetails_user_app_details.py

@@ -0,0 +1,34 @@
+# Generated by Django 6.0.3 on 2026-10-07 08:08
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('epdb', '0030_auto_20260814_0741'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='user',
+            name='principal_type',
+            field=models.IntegerField(choices=[(0, 'Internal'), (10, 'Restricted')], default=0),
+        ),
+        migrations.CreateModel(
+            name='AppDetails',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('client_id', models.TextField(verbose_name='Client ID')),
+                ('display_name', models.TextField(verbose_name='Display Name')),
+                ('owner', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
+            ],
+        ),
+        migrations.AddField(
+            model_name='user',
+            name='app_details',
+            field=models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, to='epdb.appdetails'),
+        ),
+    ]

epdb/migrations/0032_alter_user_principal_type.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0.3 on 2026-10-07 08:56
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('epdb', '0031_user_principal_type_appdetails_user_app_details'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='user',
+            name='principal_type',
+            field=models.IntegerField(choices=[(0, 'User'), (10, 'App')], default=0),
+        ),
+    ]

epdb/migrations/0033_remove_user_app_details.py

@@ -0,0 +1,17 @@
+# Generated by Django 6.0.3 on 2026-10-07 08:57
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('epdb', '0032_alter_user_principal_type'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='user',
+            name='app_details',
+        ),
+    ]

epdb/migrations/0034_user_app_details.py

@@ -0,0 +1,19 @@
+# Generated by Django 6.0.3 on 2026-10-07 10:14
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('epdb', '0033_remove_user_app_details'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='user',
+            name='app_details',
+            field=models.OneToOneField(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, to='epdb.appdetails'),
+        ),
+    ]

epdb/migrations/0035_appdetails_data_pool_appdetails_secret_allowed.py

@@ -0,0 +1,24 @@
+# Generated by Django 6.0.3 on 2026-10-07 10:26
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('epdb', '0034_user_app_details'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='appdetails',
+            name='data_pool',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, to='epdb.group'),
+        ),
+        migrations.AddField(
+            model_name='appdetails',
+            name='secret_allowed',
+            field=models.BooleanField(default=False),
+        ),
+    ]

epdb/migrations/0036_appdetails_pes_allowance.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0.3 on 2026-10-07 10:27
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('epdb', '0035_appdetails_data_pool_appdetails_secret_allowed'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='appdetails',
+            name='pes_allowance',
+            field=models.IntegerField(choices=[(0, 'None'), (10, 'Non Secret'), (20, 'Secret')], default=0),
+        ),
+    ]

epdb/models.py

@@ -84,6 +84,17 @@ class User(AbstractUser):
     USERNAME_FIELD = "email"
     REQUIRED_FIELDS = ["username"]
 
+    class PrincipalType(models.IntegerChoices):
+        USER = 0, "User"
+        APP = 10 , "App"
+
+    principal_type = models.IntegerField(
+        choices=PrincipalType,
+        default=PrincipalType.USER,
+    )
+
+    app_details = models.OneToOneField("epdb.AppDetails", on_delete=models.CASCADE, null=True, blank=True)
+
     def get_name(self):
         return self.username
 
@@ -103,6 +114,25 @@ class User(AbstractUser):
         return self.default_setting
 
 
+class AppDetails(models.Model):
+    owner = models.ForeignKey(User, on_delete=models.CASCADE)
+    client_id = models.TextField(blank=False, null=False, verbose_name="Client ID")
+    display_name = models.TextField(blank=False, null=False, verbose_name="Display Name")
+
+    secret_allowed = models.BooleanField(default=False)
+    data_pool = models.ForeignKey("epdb.Group", null=True, blank=True, on_delete=models.SET_NULL)
+
+    class PESAllowance(models.IntegerChoices):
+        NONE = 0, "None"
+        NON_SECRET = 10 , "Non Secret"
+        SECRET = 20, "Secret"
+
+    pes_allowance = models.IntegerField(
+        choices=PESAllowance,
+        default=PESAllowance.NONE,
+    )
+
+
 class APIToken(TimeStampedModel):
     """
     API authentication token for users.
@@ -2456,6 +2486,20 @@ class Node(EnviPathModel, AliasMixin, ScenarioMixin, AdditionalInformationMixin)
             else:
                 return self.default_node_label.name
 
+    def get_description(self, include_suffix=True):
+        default_desc = False
+
+        if self.description == "no description":
+            default_desc = True
+
+        if not default_desc:
+            return self.description
+        else:
+            if include_suffix:
+                return f"{self.default_node_label.description} (taken from underlying structure)"
+            else:
+                return self.default_node_label.description
+
     def d3_json(self):
         app_domain_data = self.get_app_domain_assessment_data()
 
@@ -2773,6 +2817,20 @@ class Edge(EnviPathModel, AliasMixin, ScenarioMixin, AdditionalInformationMixin)
             else:
                 return self.edge_label.name
 
+    def get_description(self, include_suffix=True):
+        default_desc = False
+
+        if self.description == "no description":
+            default_desc = True
+
+        if not default_desc:
+            return self.description
+        else:
+            if include_suffix:
+                return f"{self.edge_label.description} (taken from underlying reaction)"
+            else:
+                return self.edge_label.description
+
 
 class EPModel(PolymorphicModel, EnviPathModel, AdditionalInformationMixin):
     package = models.ForeignKey(

epdb/views.py

@@ -1292,14 +1292,21 @@ def package(request, package_uuid):
                 "user_id", flat=True
             )
         )
-        users = users.filter(is_active=True)
+        users = users.filter(is_active=True).exclude(username="anonymous")
+
+        if not current_user.is_superuser:
+            users = users.exclude(principal_type=User.PrincipalType.APP)
 
         group_perms = GroupPackagePermission.objects.filter(package=current_package)
-        groups = Group.objects.exclude(
-            id__in=GroupPackagePermission.objects.filter(package=current_package).values_list(
-                "group_id", flat=True
+
+        if current_package.classification_level == current_package.Classification.SECRET:
+            groups = Group.objects.none()
+        else:
+            groups = Group.objects.exclude(
+                id__in=GroupPackagePermission.objects.filter(package=current_package).values_list(
+                    "group_id", flat=True
+                )
             )
-        )
 
         context["users"] = users
         context["groups"] = groups
@@ -1324,6 +1331,12 @@ def package(request, package_uuid):
 
                 return redirect(s.SERVER_URL + "/package")
             elif hidden == "publish-package":
+                if current_package.classification_level == current_package.Classification.SECRET:
+                    return error(
+                        request,
+                        "Cannot publish a secret package",
+                        "You cannot publish a secret package.",
+                    )
                 for g in Group.objects.filter(public=True):
                     PackageManager.grant_read(current_user, current_package, g)
                 return redirect(current_package.url)
@@ -1376,6 +1389,9 @@ def package(request, package_uuid):
         elif any([grantee_url, read, write, owner]):
             if "user" in grantee_url:
                 grantee = UserManager.get_user_lp(grantee_url)
+                if grantee.principal_type == current_user.PrincipalType.APP:
+                    if not request.user.is_superuser:
+                        return error(request, "You are not allowed to grant permissions to an app!")
             else:
                 grantee = GroupManager.get_group_lp(grantee_url)
 
@@ -3314,6 +3330,11 @@ def jobs(request):
                 "This Package was generated automatically for the batch prediction task.",
             )
 
+            if current_user.default_package.classification_level == current_user.default_package.Classification.SECRET:
+                target_package.classification_level = current_user.default_package.Classification.SECRET
+                target_package.data_pool = current_user.default_package.data_pool
+                target_package.save()
+
             from .tasks import batch_predict, dispatch
 
             res = dispatch(

templates/actions/objects/package.html

@@ -7,6 +7,7 @@
       <i class="glyphicon glyphicon-edit"></i> Edit Package</a
     >
   </li>
+  {% if meta.current_package.shareable  %}
   <li>
     <a
       role="button"
@@ -15,6 +16,7 @@
       <i class="glyphicon glyphicon-user"></i> Edit Permissions</a
     >
   </li>
+  {% endif %}
   {% if meta.current_package.get_classification_level_display != "Secret" %}
   <li>
     <a
@@ -52,7 +54,7 @@
     >
   </li>
 {% endif %}
-{% if not meta.can_edit %}
+{% if not meta.can_edit and meta.current_package.shareable %}
   <li>
     <a
       role="button"

templates/actions/objects/user.html

@@ -7,6 +7,7 @@
       <i class="glyphicon glyphicon-edit"></i> Update</a
     >
   </li>
+  {% if 1 == 0 %}
   <li>
     <a
       role="button"
@@ -15,6 +16,7 @@
       <i class="glyphicon glyphicon-lock"></i> Update Password</a
     >
   </li>
+  {% endif %}
   <li>
     <a
       role="button"

templates/index/index.html

@@ -180,12 +180,25 @@
                       >Aspartame</a
                     >
                   </div>
-                  <a
-                    class="absolute top-0 left-[calc(100%-5.4rem)]"
-                    href="/predict"
-                    >Advanced</a
-                  >
                 </div>
+                  {% if meta.current_package %}
+                  <div
+                    class="mt-4 rounded-lg border border-base-300 bg-base-50 px-4 py-2.5 text-sm text-base-content/70"
+                  >
+                    Prediction will be stored in Package
+                    <strong class="text-base-content"
+                    ><a class="link" href="{{ meta.current_package.url }}">{{ meta.current_package.name|safe }}</a></strong
+                    >
+                    {% if meta.user.default_setting %}
+                      using setting
+                      <strong class="text-base-content"
+                      ><a class="link" href="{{ meta.user.default_setting.url}}">{{ meta.user.default_setting.name|safe }}</a></strong
+                      >
+                    {% endif %}
+                    To use a different setting click
+                    <a class="link" href="/predict">here</a>
+                  </div>
+                {% endif %}
               </div>
               <div
                 id="ketcher-container"
@@ -208,9 +221,24 @@
                 >
                   Predict!
                 </button>
-                <div class="mt-1 flex w-full justify-end">
-                  <a class="label justify-end" href="/predict">Advanced</a>
-                </div>
+                  {% if meta.current_package %}
+                  <div
+                    class="mt-4 rounded-lg border border-base-300 bg-base-50 px-4 py-2.5 text-sm text-base-content/70"
+                  >
+                    Prediction will be stored in Package
+                    <strong class="text-base-content"
+                    ><a class="link" href="{{ meta.current_package.url }}">{{ meta.current_package.name|safe }}</a></strong
+                    >
+                    {% if meta.user.default_setting %}
+                      using setting
+                      <strong class="text-base-content"
+                      ><a class="link" href="{{ meta.user.default_setting.url}}">{{ meta.user.default_setting.name|safe }}</a></strong
+                      >
+                    {% endif %}
+                    To use a different setting click
+                    <a class="link" href="/predict">here</a>
+                  </div>
+                {% endif %}
               </div>
               <input
                 type="hidden"

templates/modals/objects/edit_user_modal.html

@@ -31,6 +31,7 @@
         {% csrf_token %}
 
         <div class="form-control mb-3">
+          {% if 1 == 0 %}
           <label class="label" for="default-package">
             <span class="label-text">Default Package</span>
           </label>
@@ -50,7 +51,7 @@
             {% endfor %}
           </select>
         </div>
-
+        {% endif %}
         <div class="form-control mb-3">
           <label class="label" for="default-group">
             <span class="label-text">Default Group</span>

templates/objects/edge.html

@@ -57,7 +57,7 @@
     <div class="collapse-arrow bg-base-200 collapse">
       <input type="checkbox" checked />
       <div class="collapse-title text-xl font-medium">Description</div>
-      <div class="collapse-content">{{ edge.description }}</div>
+      <div class="collapse-content">{{ edge.get_description }}</div>
     </div>
 
     {% if edge.aliases %}

templates/objects/node.html

@@ -60,7 +60,7 @@
       <div class="collapse-arrow bg-base-200 collapse">
         <input type="checkbox" checked />
         <div class="collapse-title text-xl font-medium">Description</div>
-        <div class="collapse-content">{{ node.description }}</div>
+        <div class="collapse-content">{{ node.get_description }}</div>
       </div>
     {% endif %}
     {% epdb_slot_templates "epdb.objects.node.viz" as viz_templates %}

templates/predict_pathway.html

@@ -2,11 +2,23 @@
 {% load static %}
 {% block content %}
   <div class="mx-auto w-full p-8">
-    <h1 class="h1 mb-4 text-3xl font-bold">
+    <h1 class="h1 mb-4 flex items-center gap-2 text-3xl font-bold">
       Predict a Pathway
 
-      <span class="text-base-content/50 text-xs"
-        >in <strong>{{ meta.current_package.name|safe }}</strong>
+      <span class="inline-flex items-center gap-1 text-base-content/50 text-xs"
+        >in <strong>{{ meta.current_package.name|safe }}</strong>{% if meta.url_contains_package %}
+      {% if meta.current_package.get_classification_level_display == "Restricted" %}
+        <img src="{% static 'images/restricted_mid.png' %}" width="100">
+      {% elif meta.current_package.get_classification_level_display == "Secret" %}
+        <img src="{% static 'images/secret_mid.png' %}" width="60">
+      {% endif %}
+    {% else %}
+      {% if meta.user.default_package.get_classification_level_display == "Restricted" %}
+        <img src="{% static 'images/restricted_mid.png' %}" width="100">
+      {% elif meta.user.default_package.get_classification_level_display == "Secret" %}
+        <img src="{% static 'images/secret_mid.png' %}" width="60">
+      {% endif %}
+    {% endif %}
       </span>
     </h1>
 

utilities/misc.py

@@ -21,6 +21,8 @@ from epdb.models import (
     Compound,
     CompoundStructure,
     Edge,
+    EnzymeLink,
+    Group,
     License,
     Node,
     ParallelRule,
@@ -150,6 +152,8 @@ class ReactionExportSchema(RefReactionExportSchema):
 # Rules #
 #########
 class EnzymeExportSchema(RefEnzymeExportSchema):
+    name: str
+    description: str
     ec_number: str
     classification_level: int
     linking_method: str
@@ -162,12 +166,12 @@ class EnzymeRuleExportSchema(RefRuleExportSchema):
 
     @staticmethod
     def resolve_enzymes(obj):
-        if isinstance(obj, dict):
-            res = []
-            for e in obj.get("enzymes", []):
-                res.append(EnzymeExportSchema.model_validate(e))
-            return res
-        return obj.enzymelink_set.all()
+        if isinstance(obj, EnzymeRuleExportSchema):
+            return obj.enzymes
+        elif isinstance(obj, dict):
+            return obj.get("enzymes", [])
+        else:
+            return obj.enzymelink_set.all()
 
 
 class RuleExportSchema(EnzymeRuleExportSchema):
@@ -271,7 +275,7 @@ class PackageExportSchema(Schema):
     @staticmethod
     def resolve_classification_level(obj):
         if isinstance(obj, dict):
-            return obj["classification_level"]
+            return obj.get("classification_level", "Internal")
         return obj.Classification(obj.classification_level).name
 
 
@@ -679,6 +683,27 @@ class PackageImporter:
                 for scen in elem.scenarios:
                     elem_obj.scenarios.add(self._cache[scen.uuid])
 
+    def _import_enzyme(self, rule: Rule, enzyme: EnzymeExportSchema):
+        e = EnzymeLink()
+        e.uuid = str(uuid.uuid4()) if not self.preserve_uuids else enzyme.uuid
+        e.rule = rule
+        e.name = enzyme.name
+        e.description = enzyme.description
+        e.ec_number = enzyme.ec_number
+        e.classification_level = enzyme.classification_level
+        e.linking_method = enzyme.linking_method
+        e.save()
+        for reaction in enzyme.reaction_evidence:
+            e.reaction_evidence.add(self._cache[reaction.uuid])
+        for edge in enzyme.edge_evidence:
+            e.edge_evidence.add(self._cache[edge.uuid])
+        self._cache[enzyme.uuid] = e
+
+    def _import_and_link_enzymes(self, data: PackageExportSchema):
+        for rule in data.composite_rules:
+            for enzyme in rule.enzymes:
+                self._import_enzyme(self._cache[rule.uuid], enzyme)
+
     def _import_package_from_json(
         self,
     ) -> Package:
@@ -717,6 +742,7 @@ class PackageImporter:
         self._import_scenarios(package, parsed.scenarios)
         self._import_additional_information(package, parsed.additional_information)
         self._link_scenarios_after_import(parsed)
+        self._import_and_link_enzymes(parsed)
 
         return package
 

uv.lock

@@ -894,7 +894,7 @@ provides-extras = ["ms-login", "dev", "pepper-plugin"]
 [[package]]
 name = "envipy-additional-information"
 version = "0.4.2"
-source = { git = "ssh://git@git.envipath.com/enviPath/enviPy-additional-information.git?branch=develop#ad825570480bbe2f1a35c04923fede756c450751" }
+source = { git = "ssh://git@git.envipath.com/enviPath/enviPy-additional-information.git?branch=develop#4909e35aac5a0a3969ac2a01f8d4ad8bdadae04c" }
 dependencies = [
     { name = "pydantic" },
 ]