[24.0] Fix authentication error for anonymous users querying jobs

[davelopez]

Fixes #18331

I added the check at the API level (to fail fast) and at the manager level in case it gets called from somewhere else.

How to test the changes?

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. [add testing steps and prerequisites here if you didn't write automated tests covering all your changes]

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.

[galaxyproject-sentryintegration]

🔍 Existing Issues For Review

Your pull request is modifying functions with the following pre-existing issues:

📄 File: lib/galaxy/managers/jobs.py

Function	Unhandled Issue
index_query	AttributeError: 'NoneType' object has no attribute 'id' /a... Event Count: 7

📄 File: lib/galaxy/webapps/galaxy/services/jobs.py (Click to Expand)

Function	Unhandled Issue
index	AttributeError: 'NoneType' object has no attribute 'id' /a... Event Count: 7

---

_{Did you find this useful? React with a 👍 or 👎}

[mvdbeek]

Can we instead query the jobs using the session id or current session history ? I think there's no reason anon user can't see their jobs

[davelopez]

Sure! I forgot there was a way to differentiate jobs from other anonymous users. I'll give it a try 👍

[davelopez]

I tried to write an API or selenium test but I couldn't figure out how to use the session. I manually tested and seems to work though.

[nsoranzo]

I'm wondering if we should raise an AuthenticationRequired exception here instead, so the error is not hidden from the user.

[mvdbeek]

This is not an error, if a session doesn't have a history it also doesn't have any jobs.

[nsoranzo]

But None is returned also is trans.galaxy_session is None.

[mvdbeek]

Which is fine and not a error ?

[mvdbeek]

You could as well query some public thing, like jobs belonging to a history, raising an exception here feels very unpredictable.

[nsoranzo]

Then I don't understand the changes in lines 131-133 above: if we want a session-less user to be able to view public history jobs, we should overwrite history_id only when it's None .

[mvdbeek]

That is a good point, we might want to instead filter on the job itself using the session id.

[nsoranzo]

If history_id is passed in the API payload, the job's history accessibility is checked on the jobs returned by this method at

galaxy/lib/galaxy/webapps/galaxy/services/jobs.py

Line 89 in 7caee0b

if check_security_of_jobs and not security_check(trans, job.history, check_accessible=True):

[davelopez]

Thanks for the catch! I'll follow up with the proposed change 👍