zstash "ConsentRequired" error

[golaz]

Question criteria

• I added a descriptive title here.
• I searched the zstash GitHub Discussions to find a similar question and didn't find it.
• I searched the zstash documentation.

Describe your question

Using the latest E3SM Unified (1.9.0) on Chrysalis and running into an error when rtyng to retrieve files using zstash through Globus.

Are there are any possible answers you came across?

No response

What machine were you running on?

Chrysalis

Environment

source /lcrc/soft/climate/e3sm-unified/load_e3sm_unified_1.9.0_chrysalis.sh

Minimal Complete Verifiable Example (MCVE)

zstash ls --hpss=globus://nersc/home/f/forsyth/E3SMv2/v2.LR.historical_0101 "v2.LR.historical_0101/post/atm/180x360_aave/ts/monthly/5yr/*"

Relevant log output

For help, please see https://e3sm-project.github.io/zstash. Ask questions at https://github.com/E3SM-Project/zstash/discussions/categories/q-a.
INFO: Transferring file from HPSS: zstash/index.db
INFO: Creating client of type <class 'globus_sdk.services.auth.client.native_client.NativeAppAuthClient'> for service "auth"
INFO: Finished initializing AuthClient. client_id='6c1629cf-446c-49e7-af95-323c6412397f', type(authorizer)=<class 'globus_sdk.authorizers.base.NullAuthorizer'>
INFO: Setting up RefreshTokenAuthorizer with auth_client=[instance:23455991615680]
INFO: Setting up a RenewingAuthorizer. It will use an auth type of Bearer and can handle 401s.
INFO: RenewingAuthorizer will start by using access_token with hash "a74aa8e5fbf2a45fb5ba8ed45fbe8c13181423bd4241affa90ecf9c1635f1d1d"
INFO: Setting up RefreshTokenAuthorizer with auth_client=[instance:23455991615680]
INFO: Setting up a RenewingAuthorizer. It will use an auth type of Bearer and can handle 401s.
INFO: RenewingAuthorizer will start by using access_token with hash "0ba2fbc0f5d5e3e3ed59360cf21785a5dd37ced717b77e55785389450176b8b0"
INFO: Creating client of type <class 'globus_sdk.services.transfer.client.TransferClient'> for service "transfer"
INFO: TransferClient.endpoint_autoactivate(61f9954c-a4fa-11ea-8f07-0a21f750d19b)
INFO: request done (success)
INFO: TransferClient.endpoint_autoactivate(9cd89cfd-6d04-11e5-ba46-22000b92c6ec)
INFO: request done (success)
INFO: TransferClient.operation_ls(9cd89cfd-6d04-11e5-ba46-22000b92c6ec, {'path': '/home/f/forsyth/E3SMv2/v2.LR.historical_0101'})
INFO: request done (success)
Traceback (most recent call last):
  File "/lcrc/soft/climate/e3sm-unified/base/envs/e3sm_unified_1.9.0_login/bin/zstash", line 10, in <module>
    sys.exit(main())
  File "/lcrc/soft/climate/e3sm-unified/base/envs/e3sm_unified_1.9.0_login/lib/python3.10/site-packages/zstash/main.py", line 74, in main
    ls()
  File "/lcrc/soft/climate/e3sm-unified/base/envs/e3sm_unified_1.9.0_login/lib/python3.10/site-packages/zstash/ls.py", line 34, in ls
    matches: List[FilesRow] = ls_database(args, cache)
  File "/lcrc/soft/climate/e3sm-unified/base/envs/e3sm_unified_1.9.0_login/lib/python3.10/site-packages/zstash/ls.py", line 105, in ls_database
    hpss_get(hpss, get_db_filename(cache), cache)
  File "/lcrc/soft/climate/e3sm-unified/base/envs/e3sm_unified_1.9.0_login/lib/python3.10/site-packages/zstash/hpss.py", line 118, in hpss_get
    hpss_transfer(hpss, file_path, "get", cache, False)
  File "/lcrc/soft/climate/e3sm-unified/base/envs/e3sm_unified_1.9.0_login/lib/python3.10/site-packages/zstash/hpss.py", line 90, in hpss_transfer
    globus_transfer(endpoint, url_path, name, transfer_type)
  File "/lcrc/soft/climate/e3sm-unified/base/envs/e3sm_unified_1.9.0_login/lib/python3.10/site-packages/zstash/globus.py", line 144, in globus_transfer
    archive_directory_listing = transfer_client.operation_ls(
  File "/lcrc/soft/climate/e3sm-unified/base/envs/e3sm_unified_1.9.0_login/lib/python3.10/site-packages/globus_sdk/services/transfer/client.py", line 1304, in operation_ls
    self.get(f"operation/endpoint/{endpoint_id}/ls", query_params=query_params)
  File "/lcrc/soft/climate/e3sm-unified/base/envs/e3sm_unified_1.9.0_login/lib/python3.10/site-packages/globus_sdk/client.py", line 146, in get
    return self.request("GET", path, query_params=query_params, headers=headers)
  File "/lcrc/soft/climate/e3sm-unified/base/envs/e3sm_unified_1.9.0_login/lib/python3.10/site-packages/globus_sdk/client.py", line 321, in request
    raise self.error_class(r)
globus_sdk.services.transfer.errors.TransferAPIError: ('GET', 'https://transfer.api.globus.org/v0.10/operation/endpoint/9cd89cfd-6d04-11e5-ba46-22000b92c6ec/ls?path=%2Fhome%2Ff%2Fforsyth%2FE3SMv2%2Fv2.LR.historical_0101', 'Bearer', 403, 'ConsentRequired', 'Missing required data_access consent', 'Vy7NojQyb')

Anything else we need to know?

No response

[forsyth2]

This error occurs because of #298.

@tylern4 suggested the following work-around script:

import argparse
import globus_sdk


CLIENT = globus_sdk.NativeAppAuthClient(client_id="6c1629cf-446c-49e7-af95-323c6412397f",
                                        app_name="Zstash"
                                        )

def globus_flow(ep=""):
    scopes = f"urn:globus:auth:scope:transfer.api.globus.org:all"
    endpoint_scope = f"[ *https://auth.globus.org/scopes/{ep}/data_access ]"
    data_access_sopes = scopes + endpoint_scope
    CLIENT.oauth2_start_flow(refresh_tokens=True, requested_scopes=data_access_sopes)
    authorize_url = CLIENT.oauth2_get_authorize_url()
    print(f'Please go to this URL and login:\n\n{authorize_url}\n\n')

    get_input = getattr(__builtins__, 'raw_input', input)
    auth_code = get_input(
        'Please enter the code you get after login here: ')
    token_response = CLIENT.oauth2_exchange_code_for_tokens(auth_code)
    print(token_response)

if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument("uuid", help="GCSv5 endpoint UUID")
    args = parser.parse_args()
    globus_flow(args.uuid)

I was able to run zstash successfully by running the following:

# Copy the above to zstash_globus_consent.py 
$ python zstash_globus_consent.py "6bdc7956-fc0f-4ad2-989c-7aa5ee643a79" # Perlmutter endpoint uuid
# Copy Link
# Log in to Globus
# Name the consent
# Copy the code and paste it to the terminal
$ source /global/common/software/e3sm/anaconda_envs/load_latest_e3sm_unified_pm-cpu.sh
$ python -m unittest tests/test_globus.py
# Test passes

I began trying to automate this consent requirement in #300. However, I expect to a create a new pull request that uses the approach listed above. That said, I'm running into some difficulty incorporating it into the zstash code. Ideally, I will finish debugging that soon, so zstash will be ready if there's a Unified patch release.

@tylern4 Is there a way to disable the consent once it's given? I need to be able to do that to test that the new consent code actually works.

[tylern4]

@golaz I will point out from the instructions, you will want to give the NERSC HPSS endpoint consent, which has a different UUID. So after copy/pasting the script above run.

python zstash_globus_consent.py "9cd89cfd-6d04-11e5-ba46-22000b92c6ec" 

@forsyth2 Yes you should be able to remove consents from the Globus web interface, on the left side "Setting", the top tab "Consents", the button on the right labeled "Manage Consents" will give you a list of all consents. You should be able to delete the one associated with your application client_id to reset the consent in order to run tests.

[golaz]

Thank you @forsyth2 and @tylern4. It worked!