WIP: 🕸️ Bug / Support AWS OpenSearch Auth by demariadaniel · Pull Request #1081 · overture-stack/arranger

demariadaniel · 2026-07-02T17:56:54Z

Summary

Adds AWS SDK Client Auth support for OpenSearch client

Issues

nci-hcmi-catalog/portal#1145

Description of Changes

Adds AWS SDK & authentication boilerplate
Adds additional config for indicating connection with AWS

Readiness Checklist

Self Review
- I have performed a self review of code
- I have run the application locally and manually tested the feature
- I have checked all updates to correct typos and misspellings
Formatting
- Code follows the project style guide
- Autmated code formatters (ie. Prettier) have been run
Local Testing
- Successfully built all packages locally
- Successfully ran all test suites, all unit and integration tests pass
Updated Tests
- Unit and integration tests have been added that describe the bug that was fixed or the features that were added
Documentation
- All new environment variables added to .env.schema file and documented in the README
- All changes to server HTTP endpoints have open-api documentation
- All new functions exported from their module have TSDoc comment documentation

…o bug/support-aws-auth

justincorrigible · 2026-07-02T19:20:14Z

please exclude the modules/graphql-router/src/admin files out of this and all PRs

thanks

There are a lot of distracting Type errors in this folder, maybe we can remove it or gitignore? I'm often using Type errors to validate that my new changes haven't broken anything, but frequently end up impacting code in /admin

Suggested gitignore change:
https://github.com/overture-stack/arranger/pull/1081/changes#diff-bc37d034bad564583790a46f19d807abfe519c5671395fd494d8cce506c42947

I will revert the changes in this file, but that's the context / source of repeat issues

justincorrigible · 2026-07-02T19:21:21Z

-			enableDebug,
+			enableDebug: !!enableDebug,


how is this change necessary?

This is a Type error, enableDebug at line 58 is boolean | undefined, and getIndexMapping expects only a boolean.
We had to leverage enableDebug to troubleshoot in HCMI Dev.

Alternately we could change the getIndexMapping signature to make enableDebug an optional argument and be false by default.

sounds like a type problem in the function's definition, rather than something to be coerced in this manner 🤔

@joneubank thoughts on this?

justincorrigible · 2026-07-07T13:21:32Z

To summarize my previous comments, as confirmed by reading the source of the installed package.

@aws-sdk/credential-provider-node is not needed and the getCredentials wrapper can be removed entirely.
AwsSigv4Signer from @opensearch-project/opensearch/aws already does the dynamic import internally:

// seen in node_modules/@opensearch-project/opensearch/lib/aws/AwsSigv4Signer.js
const getAwsSDKCredentialsProvider = async () => {
  try {
    const awsV3 = await import('@aws-sdk/credential-provider-node');
    if (typeof awsV3.defaultProvider === 'function') {
      return awsV3.defaultProvider();
    }
  } catch (err) { /* falls back to aws-sdk v2 */ }
  // ...
};

The explicit defaultProvider import and the getCredentials wrapper in the AwsSigv4Signer call are duplicating this exactly. The fix is to drop both:

// remove: import { defaultProvider } from '@aws-sdk/credential-provider-node';

...AwsSigv4Signer({
  region: auth.region || '',
  service: auth.service,
  // no getCredentials - AwsSigv4Signer resolves credentials automatically
}),

And drop @aws-sdk/credential-provider-node from apps/search-server/package.json (and it should not be added to modules/graphql-router either... it is not needed there at all).

Runtime note: on AWS infrastructure (ECS task role, EC2 instance profile), `@aws-sdk/credential-provider-node` is already present via the SDK layer. Deployments that need it will have it; those that don't will get an explicit error from the OpenSearch client on startup.

justincorrigible · 2026-07-08T14:32:12Z

 		"apps/search-server": {
 			"name": "@overture-stack/arranger-search-server",
 			"version": "0.0.0-dev",
 			"dependencies": {
+				"@aws-sdk/credential-provider-node": "^3.972.60",


this file seems to be out of date now

joneubank

Thanks for adopting the new configuration pattern.

joneubank · 2026-07-06T13:42:49Z

+	id: string;
+	index: string;
+	body: Record<string, any>;
+	refresh?: boolean | 'false' | 'true' | 'wait_for';


This list of types is peculiar, is this inherited from some third party library or did we decide these types? If we decided them, lets simplify to a list of string literals and add some documentation for why we chose these. If they are inherited, could we simplify them in a similar way?

I see the problem too. Just to be clear, this is comment points to an outdated change, the latest version does not contain string literals for 'false' or 'true'. These are definitions that reflect the expected types for the OS/ES libraries.

joneubank · 2026-07-06T14:32:00Z

-			enableDebug,
+			enableDebug: !!enableDebug,


Alternately we could change the getIndexMapping signature to make enableDebug an optional argument and be false by default.

joneubank · 2026-07-08T14:56:00Z

We aren't adding any code to consume these env variables, in fact we make no code changes to the server. Let's not add new env variables to our schema that are unused.

I wanted get a start on documenting the Auth changes and new config values, then updated the client side without revisiting. Will revise.

joneubank · 2026-07-08T15:06:42Z

+export type BaseAuthConfig = {
+	password: string;
+	type?: AuthTypes;
+	username: string;
+};
+export type DefaultAuthConfig = Prettify<
+	BaseAuthConfig & {
+		type: 'standard';
+	}
+>;
+export type AWSAuthConfig = Prettify<
+	BaseAuthConfig & {
+		type: 'AWS';
+		region: string;
+		service?: 'es' | 'aoss';
+	}
+>;


No reason to extend a base config.

Suggested change

export type BaseAuthConfig = {

password: string;

type?: AuthTypes;

username: string;

};

export type DefaultAuthConfig = Prettify<

BaseAuthConfig & {

type: 'standard';

}

>;

export type AWSAuthConfig = Prettify<

BaseAuthConfig & {

type: 'AWS';

region: string;

service?: 'es' | 'aoss';

}

>;

export type StandardAuthConfig = {

type: 'standard';

password: string;

username: string;

}

export type AWSAuthConfig = {

type: 'AWS';

password: string;

username: string;

region: string;

service?: 'es' | 'aoss';

}

Yeah I saw that BaseAuthConfig just ends up cluttering Type things downstream. This is updated using StandardAuth. Would BasicAuth be fitting var name you think?

…o bug/support-aws-auth

demariadaniel added 3 commits July 2, 2026 11:08

Add AWS auth setup & type corrections

4685670

Merge branch 'main' of https://github.com/overture-stack/arranger int…

16daf53

…o bug/support-aws-auth

Remove local logging

bf529fc

demariadaniel self-assigned this Jul 2, 2026

demariadaniel added bug Something isn't working authorization Issue is related to user auth or permissions. labels Jul 2, 2026

justincorrigible reviewed Jul 2, 2026

View reviewed changes

demariadaniel added 5 commits July 2, 2026 15:40

Remove pnpm lock

d636aac

Restore admin/utils.ts changes

da47b8b

Use .gitignore for /admin

d4edc0f

Change setup for AWS Auth

7275919

Revise boilerplate comment

eaa1762

demariadaniel requested a review from joneubank July 6, 2026 18:40

demariadaniel changed the title ~~WIP: 🕸️ Bug / Support AWS OpenSearch Auth~~ 🕸️ Bug / Support AWS OpenSearch Auth Jul 6, 2026

demariadaniel marked this pull request as ready for review July 6, 2026 18:41

demariadaniel changed the title ~~🕸️ Bug / Support AWS OpenSearch Auth~~ WIP: 🕸️ Bug / Support AWS OpenSearch Auth Jul 6, 2026

demariadaniel marked this pull request as draft July 6, 2026 18:41

Auth config changes

ab084cf

justincorrigible reviewed Jul 7, 2026

View reviewed changes

Comment thread apps/search-server/package.json Outdated

justincorrigible reviewed Jul 7, 2026

View reviewed changes

Comment thread modules/graphql-router/src/searchClient/index.ts

demariadaniel added 6 commits July 7, 2026 11:28

Remove aws-sdk

0ee6553

Improve getOptions / createSearchClient

f74aa4a

Error & Type improvements

a61d27f

Type cleanup

eb2f820

Add Readme docs for AWS OpenSearch

17070fd

Change key name to clientType, removed unused import

897442d

justincorrigible reviewed Jul 8, 2026

View reviewed changes

Reinstall, Remove AWS SDK

439d760

joneubank requested changes Jul 8, 2026

View reviewed changes

demariadaniel added 7 commits July 8, 2026 14:06

Use StandardAuth config definition

5fa7b18

Use Type aliases

94db9a7

Lowercase Aws names

7393589

Revert enableDebugging coercion

e39af2a

Additional Capitalize Changes

7f995d3

Standard Refresh type

b97e8f2

Merge branch 'main' of https://github.com/overture-stack/arranger int…

ce4504d

…o bug/support-aws-auth

Uh oh!

Conversation

demariadaniel commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Issues

Description of Changes

Readiness Checklist

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

demariadaniel Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

demariadaniel Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

justincorrigible Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

justincorrigible commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joneubank left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

demariadaniel Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

demariadaniel commented Jul 2, 2026 •

edited

Loading

demariadaniel Jul 2, 2026 •

edited

Loading

demariadaniel Jul 2, 2026 •

edited

Loading

justincorrigible Jul 6, 2026 •

edited

Loading

justincorrigible commented Jul 7, 2026 •

edited

Loading

demariadaniel Jul 8, 2026 •

edited

Loading