Skip to content

Feat/refresh token#5

Open
yutianqin wants to merge 10 commits into
mainfrom
feat/refresh-token
Open

Feat/refresh token#5
yutianqin wants to merge 10 commits into
mainfrom
feat/refresh-token

Conversation

@yutianqin

Copy link
Copy Markdown
Member

NRP and Generic

  1. Refreshes the Keycloak access token in options_form before fetching workspace entities, since spawner.access_token is only set at server launch and can go stale

Generic:

  1. Shows a "session expired, please log out and log in again" message in the entity dropdown instead of an empty list when the token refresh fails
  2. Surfaces PVC fetch failures (get_user_pvcs) instead of silently swallowing them as []
  3. Applies the same token-refresh fix to helm/ndp-hub/spawner_test.py
  4. Fixes CORS/websocket rejection for JupyterLab behind the external nginx proxy (--ServerApp.allow_origin=*)
  5. Swaps in the new NDP-EP/SciDx ALL-IN-ONE Demo server template profile
  6. Drops the old NDP Endpoint Data Streaming & Data Staging Examples server template profile
  7. sync with nrp deployment: Installs pexpect>=4.9 in the user environment (works around a git-clone issue)
  8. sync with nrp deployment: Installs the Pelican CLI into ~/.local/bin
  9. Drops a stale commented-out storageClassName line
  10. Makefile: removes the status and get-ingress targets
  11. Makefile: adds create/delete targets for jupyterhub-metrics-secret
  12. Hub image update: Rewrites the 403 access-denied page to match the hub theme and updates the admin contact email
  13. Hub image update: Removes the build-and-push.sh script
  14. Bumps the hub image tag to latest

@saleemalharir1 @jessdtate this PR includes recent changes I made for ndp-jhub

@SidT12 Please review at your convenience, thanks

yutianqin added 10 commits July 14, 2026 11:40
Drop status/get-ingress targets and add create/delete for the
jupyterhub-metrics-secret alongside the existing jupyterhub-secret.
Extend page.html instead of error.html, add a logout link, and
update the admin contact email.
…ample

Replace the retired NDP Endpoint Data Streaming & Data Staging Examples
profile with the new NDP-EP/SciDx ALL-IN-ONE Demo image.
pexpect>=4.9 works around a git-clone issue in the extra install step;
the Pelican CLI is fetched into ~/.local/bin for users working with
Pelican federations.
Sets --ServerApp.allow_origin=* so the JupyterLab websocket connection
isn't rejected when the hub sits behind an external nginx that doesn't
forward the Origin header the way JupyterHub expects.
spawner.access_token is only set by auth_state_hook when a server
actually starts, so it can be stale by the time options_form runs.
Read fresh auth_state and attempt a refresh via
check_refresh_token_keycloak regardless of auth_refresh_age, and show
a 'session expired' notice in the entity dropdown instead of silently
rendering an empty list when the refresh fails. Also surface PVC
fetch failures from get_user_pvcs instead of swallowing them as [].
…s form

Same fix as the helm-generic chart: spawner.access_token is only set by
auth_state_hook when a server actually starts, so it can be stale by
the time options_form runs. Read fresh auth_state and attempt a refresh
via check_refresh_token_keycloak instead of using the possibly-stale
token directly.
@yutianqin
yutianqin requested a review from SidT12 July 16, 2026 18:54
@yutianqin yutianqin self-assigned this Jul 16, 2026
@SidT12

SidT12 commented Jul 18, 2026

Copy link
Copy Markdown
Contributor

Looks good to me! thanks Yutian!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants