jLab: you need to be logged in

[esraneufeld]

in view of the conclusion of the public jupyterlab and cybersecurity working group, let's prevent anonymous users from accessing studies with an editable jupyterlab in it. they should instead see a message saying that they need to be logged in to access this study.

[elisabettai]

I think it's becoming quite urgent. We'll need to make some templates containing jupyterlabs public, e.g.:

• The Codeathon 2022 studies will have a link on the SPARC Portal
• The ASCENT Studies for the Grill Lab

To achieve that, I think we need the following backend modifications:

• 1. Change the message and add an image that is displayed when a template is not published, right now it looks like:
  
• 2. Make sure that we can share the link to a template and that when the link is accessed then a copy (=a new study) is created.
  related case Link to share templates #806

Might be worth considering as well (maybe as part of another case): can we extend the disabling internet access feature to JupyterLabs (=i.e. all services that have a terminal)? @GitHK

fyi, @sanderegg, new SM.

[esraneufeld]

i am not sure that i understand the above. did we not conclude that we start by preventing anonymous users from accessing pipelines containing such services, but people with login would be accepted?

[elisabettai]

Yes, @esraneufeld, what you said it is what we are going to do, i.e. users that don't have an account and try to access a pipeline that has jupyterlabs will receive a clear and nice message that asks them to create an account.

[elisabettai]

Just had a brainstorming session with @pcrespov: there's a small piece of development needed for this one.

Basically we need a way to mark certain templates (in the database?) as being openable by guests or not. Let me know @pcrespov it that's not clear.

[esraneufeld]

hi, can i ask: why is this about a certain template and not about the presence of a certain service in the template/study? all the best esra