Skip to content

Symposium Data Server 0.1.2

Choose a tag to compare

View all tags
@sreuland sreuland released this 14 Oct 21:33
· 9 commits to data-store since this release
data-server-v0.1.2
28ea224
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[Data Server 0.1.2] - 2026-10-14

Dockerhub Image

ndexbio/symposium-data:0.1.2

API

Use /v1 and provisioned API keys to authenticate. Start with Data API README for overview of how to use this api.

Changed

  • One API, at /v1. The record's routes, formerly the Symposium Data API at /api/v1,
    now sit beside the data server's own routes for communities, members, keys, collections
    and files, under one contract, api/openapi.yaml, which describes
    every route with the roles it allows; every route applies the rule the contract states.
  • One credential, the API key (sak_…), for every route. It is either a session key or
    an issued key. The session management routes (POST /v1/{community}/auth/token,
    POST /v1/admin/token) answer a session key in key, obtained with the member's or the
    admin's private key file, in place of a JWT access token. Routes that change access, keys
    or the server take a session key.
  • Collections decide access, for every key. The record's routes read the record
    collection: a key reads them while its holder may read record, by a grant or because it
    is public. Publishing takes the Member's write grant on inbox. A withdrawn grant is
    felt on the next request and closes an open stream.
  • Any Member issues a non-member issued key (role: non-member), and a collection's
    owner, or the admin, grants it read (PUT /v1/{community}/collections/{collection}/grants
    with api_key_id).
  • Settings are SYMPOSIUM_SERVER_*: SYMPOSIUM_SERVER_SESSION_TTL,
    SYMPOSIUM_SERVER_INVITE_HOURS, SYMPOSIUM_SERVER_PUBLIC_URL,
    SYMPOSIUM_SERVER_MAX_STREAMS, SYMPOSIUM_SERVER_STREAM_HEARTBEAT and
    SYMPOSIUM_SERVER_CONTRACT.
  • GET /v1/{community}/me reports the calling key: its kind, role, Member, label, grants
    and the public key whose private key file obtained a session key. It replaces whoami.
  • Every refusal answers one body, {detail, code}.
  • A cited file is read on the same API. Resolving a Content Object whose location is a
    symposium-data: citation, or reading the Object, answers its location_url, the file
    version's content, which its collection's access governs.

Added

  • The 8 MiB limit on a request body is enforced (413). A file's content and an import
    stream past it, bounded by the quota.
  • Browser apps: SYMPOSIUM_SERVER_CORS_ORIGINS lists the origins allowed to call the API.
  • GET /v1/{community}/collections lists the collections the caller may use, with the
    caller's read, write and manage access on each; with no key, the public ones.

Removed

  • FastAPI's generated /docs, /redoc and /openapi.json. The contract is served at
    /v1/openapi.yaml and /v1/openapi.json.
  • Read keys (sdr_…) and their routes. A file has its collection's access: share it with
    a grant to a non-member issued key, or by making its collection public.
  • The JWT access token and the server's token signing key.
Assets 2
Loading