Skip to content

Move template_server_configuration inside try/except#22151

Open
dannon wants to merge 2 commits intogalaxyproject:devfrom
dannon:fix/oauth2-validation-error
Open

Move template_server_configuration inside try/except#22151
dannon wants to merge 2 commits intogalaxyproject:devfrom
dannon:fix/oauth2-validation-error

Conversation

@dannon
Copy link
Member

@dannon dannon commented Mar 17, 2026

Summary

Fixes #22041 — the ValidationError happens in template_server_configuration() when read_oauth2_info_from_configuration tries to build an OAuth2ClientPair with environment variables that aren't set (e.g. GALAXY_DROPBOX_APP_CLIENT_ID). This crashes when viewing saved user file source configs for OAuth2-based sources like Google Drive or Dropbox.

The fix catches the error at the source in template_server_configuration() rather than in _template_parameter_generation. When OAuth2 credentials can't be resolved, we log a warning and return a TemplateServerConfiguration with oauth2_client_pair=None, which lets the rest of the configuration flow handle it gracefully.

When OAuth2 vault secrets are missing, the configuration call itself can
throw a ValidationError that wasn't caught. Initialize a default config
first and move the call inside the existing try block.
@mvdbeek
Copy link
Member

mvdbeek commented Mar 17, 2026

Is this this the correct behavior ? Note that this happen when opening the configuration for the user defined file source for a subset of user defined file sources. In particular google drive, and importantly the vault secrets are not missing

@github-actions github-actions bot added this to the 26.1 milestone Mar 17, 2026
…ation

The real crash is in template_server_configuration() when
read_oauth2_info_from_configuration tries to construct OAuth2ClientPair
with unresolvable environment variables (e.g. GALAXY_DROPBOX_APP_CLIENT_ID
not set). This happens when viewing saved user file source configs, not
when secrets are missing from the vault. Catch the error at the source
and log a warning instead of 500ing.
@dannon
Copy link
Member Author

dannon commented Mar 17, 2026

Dug into it further — you're right that the vault secrets aren't the issue. The crash is in template_server_configuration() when read_oauth2_info_from_configuration tries to build OAuth2ClientPair with env vars that aren't set. prepare_environment_from_root() silently omits missing env vars, then the Jinja expansion produces None values that fail Pydantic validation.

Updated the fix to catch the error in template_server_configuration() itself (not _template_parameter_generation) and log a warning. The returned config has oauth2_client_pair=None but still has oauth2_configuration set, so downstream code can tell OAuth2 was intended but credentials aren't available.

@mvdbeek mvdbeek added the Backport stable Backport this to last stable released branch label Mar 17, 2026
template.configuration, user_details, environment
)
except Exception:
log.warning(
Copy link
Member

@mvdbeek mvdbeek Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the wording implies unix env vars ? I think that's just the environment section from the template (https://github.com/galaxyproject/usegalaxy-playbook/blob/main/env/common/files/galaxy/config/file_source_template_google_drive.yml#L9), maybe this needs rewording ? Did you test the fix ? And why does it only affect google drive ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Backport stable Backport this to last stable released branch

Projects

Status: Needs Review

Development

Successfully merging this pull request may close these issues.

ValidationError: 2 validation errors for OAuth2ClientPair

2 participants