Skip to content

Move template_server_configuration inside try/except#22151

Closed
dannon wants to merge 2 commits intogalaxyproject:devfrom
dannon:fix/oauth2-validation-error
Closed

Move template_server_configuration inside try/except#22151
dannon wants to merge 2 commits intogalaxyproject:devfrom
dannon:fix/oauth2-validation-error

Conversation

@dannon
Copy link
Member

@dannon dannon commented Mar 17, 2026

Summary

Fixes #22041 — the ValidationError happens in template_server_configuration() when read_oauth2_info_from_configuration tries to build an OAuth2ClientPair with environment variables that aren't set (e.g. GALAXY_DROPBOX_APP_CLIENT_ID). This crashes when viewing saved user file source configs for OAuth2-based sources like Google Drive or Dropbox.

The fix catches the error at the source in template_server_configuration() rather than in _template_parameter_generation. When OAuth2 credentials can't be resolved, we log a warning and return a TemplateServerConfiguration with oauth2_client_pair=None, which lets the rest of the configuration flow handle it gracefully.

When OAuth2 vault secrets are missing, the configuration call itself can
throw a ValidationError that wasn't caught. Initialize a default config
first and move the call inside the existing try block.
@mvdbeek
Copy link
Member

mvdbeek commented Mar 17, 2026

Is this this the correct behavior ? Note that this happen when opening the configuration for the user defined file source for a subset of user defined file sources. In particular google drive, and importantly the vault secrets are not missing

@github-actions github-actions bot added this to the 26.1 milestone Mar 17, 2026
…ation

The real crash is in template_server_configuration() when
read_oauth2_info_from_configuration tries to construct OAuth2ClientPair
with unresolvable environment variables (e.g. GALAXY_DROPBOX_APP_CLIENT_ID
not set). This happens when viewing saved user file source configs, not
when secrets are missing from the vault. Catch the error at the source
and log a warning instead of 500ing.
@dannon
Copy link
Member Author

dannon commented Mar 17, 2026

Dug into it further — you're right that the vault secrets aren't the issue. The crash is in template_server_configuration() when read_oauth2_info_from_configuration tries to build OAuth2ClientPair with env vars that aren't set. prepare_environment_from_root() silently omits missing env vars, then the Jinja expansion produces None values that fail Pydantic validation.

Updated the fix to catch the error in template_server_configuration() itself (not _template_parameter_generation) and log a warning. The returned config has oauth2_client_pair=None but still has oauth2_configuration set, so downstream code can tell OAuth2 was intended but credentials aren't available.

@mvdbeek mvdbeek added the Backport stable Backport this to last stable released branch label Mar 17, 2026
template.configuration, user_details, environment
)
except Exception:
log.warning(
Copy link
Member

@mvdbeek mvdbeek Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the wording implies unix env vars ? I think that's just the environment section from the template (https://github.com/galaxyproject/usegalaxy-playbook/blob/main/env/common/files/galaxy/config/file_source_template_google_drive.yml#L9), maybe this needs rewording ? Did you test the fix ? And why does it only affect google drive ?

@mvdbeek
Copy link
Member

mvdbeek commented Mar 24, 2026

Hmm, I suppose ultimately it'd be great if we can surface the real error, which is that the key is not in the vault for main (probably).

@dannon dannon closed this Mar 26, 2026
@github-project-automation github-project-automation bot moved this from Needs Review to Done in Galaxy Dev - weeklies Mar 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Backport stable Backport this to last stable released branch

Projects

Development

Successfully merging this pull request may close these issues.

ValidationError: 2 validation errors for OAuth2ClientPair

2 participants