opening classic notebook filebrowser from shared service lab GUI fails

[szazs89]

Bug description

https://jupyterhub/services/SHARED_SERVICE/lab works fine while
https://jupyterhub/services/SHARED_SERVICE/tree doesn't (Help -> Launch Jupyter Notebook File Browser)
It stucks with a blank page and a Jupyter logo.

How to reproduce

In jupyterhub_config.py

1. define service named SHARED_SERVICE with user share_user
2. define a role with scope to access SHARED_SERVICE for share_group
3. define group share_group with share_user and normal users

Create linux user share_user (adduser -q --gecos '' share_user)

(Re)Start JupyterHub and

4. Log in as a normal user (e.g. admin) added to share_group
5. Open service SHARED_SERVICE from (File ->) Hub Control Panel's Services drop-down menu
6. Launch Jupyter Notebook File Browser from Help menu of SHARED_SERVICE Lab Tab

Expected behaviour

The new tab with url https://jupyterhub/services/SHARED_SERVICE/tree should show the classic file browser with the file structure of share_user.

Actual behaviour

The new tab opens but does not show the file structure, only a single Jupyter logo on a white (blank) page.

Your personal set up

• docker image: jupyterhub/jupyterhub 4.0.2
• Python 3.10.12

Full environment

alembic @ file:///tmp/wheelhouse/alembic-1.11.2-py3-none-any.whl#sha256=7981ab0c4fad4fe1be0cf183aae17689fe394ff874fd2464adb774396faf0796
anyio==4.0.0
argon2-cffi==23.1.0
argon2-cffi-bindings==21.2.0
arrow==1.3.0
asttokens==2.4.0
async-generator @ file:///tmp/wheelhouse/async_generator-1.10-py3-none-any.whl#sha256=01c7bf666359b4967d2cda0000cc2e4af16a0ae098cbffcb8472fb9e8ad6585b
async-lru==2.0.4
attrs @ file:///tmp/wheelhouse/attrs-23.1.0-py3-none-any.whl#sha256=1f28b4522cdc2fb4256ac1a020c78acf9cba2c6b461ccd2c126f3aa8e8335d04
Babel==2.12.1
backcall==0.2.0
beautifulsoup4==4.12.2
bleach==6.0.0
certifi @ file:///tmp/wheelhouse/certifi-2023.7.22-py3-none-any.whl#sha256=92d6037539857d8206b8f6ae472e8b77db8058fec5937a1ef3f54304089edbb9
certipy @ file:///tmp/wheelhouse/certipy-0.1.3-py3-none-any.whl#sha256=f272c13bfa9af6b2f3f746329d08adb66af7dd0bbb08fc81175597f25a7284b5
cffi @ file:///tmp/wheelhouse/cffi-1.15.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl#sha256=dd86c085fae2efd48ac91dd7ccffcfc0571387fe1193d33b6394db7ef31fe2a4
charset-normalizer @ file:///tmp/wheelhouse/charset_normalizer-3.2.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl#sha256=193cbc708ea3aca45e7221ae58f0fd63f933753a9bfb498a3b474878f12caaad
comm==0.1.4
cryptography @ file:///tmp/wheelhouse/cryptography-41.0.3-cp37-abi3-manylinux_2_28_x86_64.whl#sha256=42cb413e01a5d36da9929baa9d70ca90d90b969269e5a12d39c1e0d475010116
debugpy==1.8.0
decorator==5.1.1
defusedxml==0.7.1
exceptiongroup==1.1.3
executing==2.0.0
fastjsonschema==2.18.1
fqdn==1.5.1
greenlet @ file:///tmp/wheelhouse/greenlet-2.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl#sha256=d75209eed723105f9596807495d58d10b3470fa6732dd6756595e89925ce2470
gyp==0.1
idna @ file:///tmp/wheelhouse/idna-3.4-py3-none-any.whl#sha256=90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2
ipykernel==6.25.2
ipython==8.16.0
ipywidgets==8.1.1
isoduration==20.11.0
jedi==0.19.0
jhub-shibboleth-user-authenticator==0.1.6
Jinja2 @ file:///tmp/wheelhouse/Jinja2-3.1.2-py3-none-any.whl#sha256=6088930bfe239f0e6710546ab9c19c9ef35e29792895fed6e6e31a023a182a61
json5==0.9.14
jsonpointer==2.4
jsonschema @ file:///tmp/wheelhouse/jsonschema-4.19.0-py3-none-any.whl#sha256=043dc26a3845ff09d20e4420d6012a9c91c9aa8999fa184e7efcfeccb41e32cb
jsonschema-specifications @ file:///tmp/wheelhouse/jsonschema_specifications-2023.7.1-py3-none-any.whl#sha256=05adf340b659828a004220a9613be00fa3f223f2b82002e273dee62fd50524b1
jupyter-events==0.7.0
jupyter-lsp==2.2.0
jupyter-telemetry @ file:///tmp/wheelhouse/jupyter_telemetry-0.1.0-py3-none-any.whl#sha256=1de3e423b23aa40ca4a4238d65c56dda544061ff5aedc3f7647220ed7e3b9589
jupyter_client==8.3.1
jupyter_core==5.3.2
jupyter_server==2.7.3
jupyter_server_terminals==0.4.4
jupyterhub @ file:///tmp/wheelhouse/jupyterhub-4.0.2-py3-none-any.whl#sha256=6ee953b6bdb15b911f4013a76e149ef02dc8103a849401e22a0f1ab69f62b5be
jupyterhub-idle-culler==1.2.1
jupyterlab==4.0.6
jupyterlab-pygments==0.2.2
jupyterlab-widgets==3.0.9
jupyterlab_server==2.25.0
Mako @ file:///tmp/wheelhouse/Mako-1.2.4-py3-none-any.whl#sha256=c97c79c018b9165ac9922ae4f32da095ffd3c4e6872b45eded42926deea46818
MarkupSafe @ file:///tmp/wheelhouse/MarkupSafe-2.1.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl#sha256=65c1a9bcdadc6c28eecee2c119465aebff8f7a584dd719facdd9e825ec61ab52
matplotlib-inline==0.1.6
mistune==3.0.2
nbclient==0.8.0
nbconvert==7.8.0
nbformat==5.9.2
nbgrader==0.9.1
nest-asyncio==1.5.8
notebook==7.0.4
notebook_shim==0.2.3
oauthlib @ file:///tmp/wheelhouse/oauthlib-3.2.2-py3-none-any.whl#sha256=8139f29aac13e25d502680e9e19963e83f16838d48a0d71c287fe40e7067fbca
overrides==7.4.0
packaging @ file:///tmp/wheelhouse/packaging-23.1-py3-none-any.whl#sha256=994793af429502c4ea2ebf6bf664629d07c1a9fe974af92966e4b8d2df7edc61
pamela @ file:///tmp/wheelhouse/pamela-1.1.0-py2.py3-none-any.whl#sha256=f4534bba9645665b01adfce0134772b0147faea72c278f67a1a732e7ebd46ec6
pandocfilters==1.5.0
parso==0.8.3
pexpect==4.8.0
pickleshare==0.7.5
platformdirs==3.10.0
prometheus-client @ file:///tmp/wheelhouse/prometheus_client-0.17.1-py3-none-any.whl#sha256=e537f37160f6807b8202a6fc4764cdd19bac5480ddd3e0d463c3002b34462101
prompt-toolkit==3.0.39
psutil==5.9.5
ptyprocess==0.7.0
pure-eval==0.2.2
pycparser @ file:///tmp/wheelhouse/pycparser-2.21-py2.py3-none-any.whl#sha256=8ee45429555515e1f6b185e78100aea234072576aa43ab53aefcae078162fca9
pycurl==7.44.1
Pygments==2.16.1
pyOpenSSL @ file:///tmp/wheelhouse/pyOpenSSL-23.2.0-py3-none-any.whl#sha256=24f0dc5227396b3e831f4c7f602b950a5e9833d292c8e4a2e06b709292806ae2
python-dateutil @ file:///tmp/wheelhouse/python_dateutil-2.8.2-py2.py3-none-any.whl#sha256=961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9
python-json-logger @ file:///tmp/wheelhouse/python_json_logger-2.0.7-py3-none-any.whl#sha256=f380b826a991ebbe3de4d897aeec42760035ac760345e57b812938dc8b35e2bd
PyYAML==6.0.1
pyzmq==25.1.1
rapidfuzz==3.3.1
referencing @ file:///tmp/wheelhouse/referencing-0.30.2-py3-none-any.whl#sha256=449b6669b6121a9e96a7f9e410b245d471e8d48964c67113ce9afe50c8dd7bdf
requests @ file:///tmp/wheelhouse/requests-2.31.0-py3-none-any.whl#sha256=58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f
rfc3339-validator==0.1.4
rfc3986-validator==0.1.1
rpds-py @ file:///tmp/wheelhouse/rpds_py-0.9.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl#sha256=a987578ac5214f18b99d1f2a3851cba5b09f4a689818a106c23dbad0dfeb760f
ruamel.yaml @ file:///tmp/wheelhouse/ruamel.yaml-0.17.32-py3-none-any.whl#sha256=23cd2ed620231677564646b0c6a89d138b6822a0d78656df7abda5879ec4f447
ruamel.yaml.clib @ file:///tmp/wheelhouse/ruamel.yaml.clib-0.2.7-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl#sha256=efa08d63ef03d079dcae1dfe334f6c8847ba8b645d08df286358b1f5293d24ab
Send2Trash==1.8.2
six @ file:///tmp/wheelhouse/six-1.16.0-py2.py3-none-any.whl#sha256=8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
sniffio==1.3.0
soupsieve==2.5
SQLAlchemy @ file:///tmp/wheelhouse/SQLAlchemy-2.0.19-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl#sha256=cb4e688f6784427e5f9479d1a13617f573de8f7d4aa713ba82813bcd16e259d1
stack-data==0.6.3
terminado==0.17.1
tinycss2==1.2.1
tomli==2.0.1
tornado @ file:///tmp/wheelhouse/tornado-6.3.2-cp38-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl#sha256=5b17b1cf5f8354efa3d37c6e28fdfd9c1c1e5122f2cb56dac121ac61baa47cbe
traitlets @ file:///tmp/wheelhouse/traitlets-5.9.0-py3-none-any.whl#sha256=9e6ec080259b9a5940c797d58b613b5e31441c2257b87c2e795c5228ae80d2d8
types-python-dateutil==2.8.19.14
typing_extensions @ file:///tmp/wheelhouse/typing_extensions-4.7.1-py3-none-any.whl#sha256=440d5dd3af93b060174bf433bccd69b0babc3b15b1a8dca43789fd7f61514b36
uri-template==1.3.0
urllib3 @ file:///tmp/wheelhouse/urllib3-2.0.4-py3-none-any.whl#sha256=de7df1803967d2c2a98e4b11bb7d6bd9210474c46e8a0401514e3a42a75ebde4
wcwidth==0.2.8
webcolors==1.13
webencodings==0.5.1
websocket-client==1.6.3
widgetsnbextension==4.0.9

Configuration

# jupyterhub_config.py
c = get_config()  #noqa
service_token  = '...'
c.JupyterHub.services = [
    { 'name': 'culler-service',
      'command': [
            'jupyterhub-idle-culler', '--timeout=21600', '--url=http://127.0.0.1:8081/hub/api'
      ],
      'api_token': service_token
    },
    { 'name': 'SHARED_SERVICE',
      'url':  'http://127.0.0.1:9999',
      'command': [ 'jupyterhub-singleuser',
        '--group=share_group', '--debug' ],
      'user': 'share_user',
      'cwd':  '/home/share_user',
    }
]
c.JupyterHub.load_roles = [
    { 
        'name': 'server',
        'scopes': [ 'inherit' ]
    },
    {   'name':   'idle-culler-role',
        'scopes': [
            'read:servers', 'delete:servers', 'admin:users',
            'admin:groups', 
        ],
        'services': [ 'culler-service' ]
    },
    # access courses by its tutors only:
    {   'name':   'share-role',
        'scopes': [ 'access:services!service=SHARED_SERVICE' ],
        'groups': [ 'share_group' ]
    }
]
c.JupyterHub.load_groups = {
    'share_group': { 'users': [ 'share_user', 'admin' ] },
}
c.Authenticator.admin_users = {'admin'}

Logs

D 17:18:01.415 ServerApp] Checking user admin with scopes ['access:services!service=SHARED_SERVICE', 'read:users:groups!user=admin', 'read:users:name!user=admin'] against {'access:services!service=SHARED_SERVICE', 'access:services'}
D 17:18:01.415 ServerApp] Allowing user admin with scopes {'access:services!service=SHARED_SERVICE'}
D 17:18:01.416 ServerApp] 304 GET /services/SHARED_SERVICE/lab/extensions/@jupyter-notebook/lab-extension/static/776.c7baadfaddfd4518c935.js?v=c7baadfaddfd4518c935 (admin@192.168.33.1) 2.32ms
D 17:18:01.517 ServerApp] HubAuth cache miss: token:04a83242c3224c91b7dfe90fafd84eee:94162264e2e6a4e40a4397b91866b8477815563becace5d31dce2c65bdcefc63
D 17:18:01.522 ServerApp] Paths used for configuration of default_setting_overrides: 
        /etc/jupyter/labconfig/default_setting_overrides.json
D 17:18:01.523 ServerApp] Paths used for configuration of default_setting_overrides: 
        /usr/local/etc/jupyter/labconfig/default_setting_overrides.json
D 17:18:01.524 ServerApp] Paths used for configuration of default_setting_overrides: 
        /usr/etc/jupyter/labconfig/default_setting_overrides.json
D 17:18:01.524 ServerApp] Paths used for configuration of default_setting_overrides: 
        /home/grader-00yz/.local/etc/jupyter/labconfig/default_setting_overrides.json
D 17:18:01.525 ServerApp] Paths used for configuration of default_setting_overrides: 
        /home/grader-00yz/.jupyter/labconfig/default_setting_overrides.json
D 17:18:01.527 ServerApp] HubAuth cache miss: token:...
D 17:18:01.527 ServerApp] HubAuth cache miss: token:...
D 17:18:01.533 ServerApp] HubAuth cache miss: token:...
D 17:18:01.533 ServerApp] HubAuth cache miss: token:...
D 17:18:01.533 ServerApp] HubAuth cache miss: token:...
D 17:18:01.674 ServerApp] HubAuth cache miss: token:...
I 17:18:01.964 JupyterHub log:191] 200 GET /hub/api/user (SHARED_SERVICE@127.0.0.1) 422.80ms
D 17:18:01.965 ServerApp] Received request from Hub user {'name': 'SHARED_SERVICE', 'kind': 'service', 'admin': False, 'session_id': None, 'scopes': []}
D 17:18:01.965 ServerApp] Checking user SHARED_SERVICE with scopes [] against {'access:services!service=SHARED_SERVICE', 'access:services'}
W 17:18:01.966 ServerApp] Not allowing user SHARED_SERVICE
D 17:18:01.968 ServerApp] Redirecting to login url: /hub/api/oauth2/authorize?client_id=service-SHARED_SERVICE&redirect_uri=%2Fservices%2FSHARED_SERVICE%2Foauth_callback&response_type=code&state=eyJ1dWlkIjogImY2OWM3ZmZkNDQ4YzQ0NzdhOTMzYjUxNmE5MmYxYjRhIiwgIm5leHRfdXJsIjogIi9zZXJ2aWNlcy8wMFlaL2FwaS9rZXJuZWxzcGVjcz8xNjk2MTgwNjgxNDU0In0
I 17:18:01.972 JupyterHub log:191] 200 GET /hub/api/user (SHARED_SERVICE@127.0.0.1) 429.59ms
W 17:18:01.968 ServerApp] wrote error: 'Forbidden'
   Traceback (most recent call last):
     File "/usr/local/lib/python3.10/dist-packages/tornado/web.py", line 1784, in _execute
       result = method(*self.path_args, **self.path_kwargs)
     File "/usr/local/lib/python3.10/dist-packages/tornado/web.py", line 3278, in wrapper
       url = self.get_login_url()
     File "/usr/local/lib/python3.10/dist-packages/jupyterhub/singleuser/extension.py", line 148, in get_login_url
       return original_get_login_url()
     File "/usr/local/lib/python3.10/dist-packages/jupyter_server/base/handlers.py", line 753, in get_login_url
       raise web.HTTPError(403)
   tornado.web.HTTPError: HTTP 403: Forbidden
W 17:18:01.973 ServerApp] 403 GET /services/SHARED_SERVICE/api/kernelspecs?1696180681454 (@152.66.33.1) 457.73ms

[szazs89]

It seems to be similar to #3671 but in the opposite way ( /tree <-> /lab )

[szazs89]

Hm... the following modifications in jupyterhub_config.py seem to help:

    {   'name':   'share-role',
        'scopes': [ 'access:services!service=SHARED_SERVICE', 'read:users' ],
        'groups': [ 'share_group' ],
        'services': [ 'SHARED_SERVICE' ]
    }

The read:users options may be needed for the specific use of the service (it is a grader service for nbgrader).
However, the services key referring to the appropriate service is important.

[szazs89]

This issue of jupyterlab-rise may be also related: jupyterlab-contrib/rise#71