<commit_before># `healthcare-federated-access-tools`

This repository contains an implementation of the
[GA4GH](https://www.ga4gh.org/) Researcher Identity and
Authentication Profile specifications.

**IMPORTANT: This is an early pre-release that should only be used for testing and demo purposes. Only synthetic or public datasets should be used. Customer support is not currently provided.**

## Contributing

See the [contributing](CONTRIBUTING.md) document for information about how to
contribute to this repository.

## Notice

This is not an officially supported Google product.

## Getting started

### Install Google Cloud SDK

https://cloud.google.com/sdk/docs

```
gcloud auth application-default login
gcloud config set account [YOUR_GCP_ACCOUNT, eg: <EMAIL>]
```

### Prepare Google Cloud project(s)

For minimum setup, only one project is needed.

#### Setup one project

- create a gcp project

  ```bash
  export PROJECT="[YOUR_PROJECT_NAME]"
  gcloud projects create $PROJECT --set-as-default
  gcloud config set project $PROJECT
  ```

- Setup for app engine, https://cloud.google.com/appengine/docs/standard/go112/quickstart#before-you-begin
- In the Cloud Developer Console's [IAM page](https://console.cloud.google.com/iam-admin/iam) for your project", add `Service Account Token Creator` and `IAM Admin` role to `App Engine default service account`

More information for cross project/environment scenarios:

-   data hosting project: the GCP project hosting datasets.
-   service account project: the GCP project hosting service accounts for
    researchers.
-   server (IC/DAM) hosting project: the GCP project hosting IC and DAM server.

#### Setup a server hosting project

https://cloud.google.com/appengine/docs/standard/go112/quickstart#before-you-begin

#### Setup a data hosting project

Add the IAM Admin role to the `App Engine default service account` of the server hosting project, e.g. ${server-<EMAIL>.

#### Setup service account project

Add `Service Account Token Creator` role to `App Engine default service account` of server hosting project.

### Configuare

- Fill in `gcp/{dam|ic}/app.yaml`. Example:

  ```
  # dam/app.yaml
  runtime: go112
  service: "dam"

  env_variables:
    DAM_URL: "https://dam-dot-${dam-hosting-project}.appspot.com"
    SERVICE_NAME: "dam"
    PROJECT: "${dam-hosting-project}"
    CONFIG_PATH: "config"
    STORAGE: "datastore"

  # ic/app.yaml
  runtime: go112
  service: "ic"

  env_variables:
    SERVICE_NAME: "ic"
    SERVICE_DOMAIN: "ic-dot-${ic-hosting-project}.appspot.com"
    ACCOUNT_DOMAIN: "${account-project-domain}"
    CONFIG_PATH: "config"
    PROJECT: "${ic-hosting-project}"
    PERSONA_DAM: "https://dam-dot-${dam-hosting-project}.appspot.com"
    STORAGE: "datastore"
  ```

- In `config/dam/config_master_main_latest.json`, add your IC to "trustedPassportIssuers".

  ```
  "ic": {
      "issuer": "https://ic-dot-${ic-hosting-project}.appspot.com/oidc",
      "clientId": "${client-id}"
  },
  ```

- Generate keys for `config/{dam|ic}/secrets_master_main_latest.json`

  ```bash
  openssl genrsa -out private.pem 2048
  openssl rsa -in private.pem -RSAPublicKey_out > public.pem
  cat private.pem
  cat public.pem
  ```

### Start servers

```
gcloud app deploy gcp/ic/app.yaml
gcloud app deploy gcp/dam/app.yaml
```

### Test with test client

In browser, open `https://ic-dot-${ic-hosting-project}.appspot.com/identity/v1alpha/master/test`
<commit_msg>Update README title from "tools" to "services".<commit_after># `healthcare-federated-access-services`

This repository contains an implementation of the
[GA4GH](https://www.ga4gh.org/) Researcher Identity and
Authentication Profile specifications.

**IMPORTANT: This is an early pre-release that should only be used for testing and demo purposes. Only synthetic or public datasets should be used. Customer support is not currently provided.**

## Contributing

See the [contributing](CONTRIBUTING.md) document for information about how to
contribute to this repository.

## Notice

This is not an officially supported Google product.

## Getting started

### Install Google Cloud SDK

https://cloud.google.com/sdk/docs

```
gcloud auth application-default login
gcloud config set account [YOUR_GCP_ACCOUNT, eg: <EMAIL>]
```

### Prepare Google Cloud project(s)

For minimum setup, only one project is needed.

#### Setup one project

- create a gcp project

  ```bash
  export PROJECT="[YOUR_PROJECT_NAME]"
  gcloud projects create $PROJECT --set-as-default
  gcloud config set project $PROJECT
  ```

- Setup for app engine, https://cloud.google.com/appengine/docs/standard/go112/quickstart#before-you-begin
- In the Cloud Developer Console's [IAM page](https://console.cloud.google.com/iam-admin/iam) for your project", add `Service Account Token Creator` and `IAM Admin` role to `App Engine default service account`

More information for cross project/environment scenarios:

-   data hosting project: the GCP project hosting datasets.
-   service account project: the GCP project hosting service accounts for
    researchers.
-   server (IC/DAM) hosting project: the GCP project hosting IC and DAM server.

#### Setup a server hosting project

https://cloud.google.com/appengine/docs/standard/go112/quickstart#before-you-begin

#### Setup a data hosting project

Add the IAM Admin role to the `App Engine default service account` of the server hosting project, e.g. ${server-<EMAIL>.

#### Setup service account project

Add `Service Account Token Creator` role to `App Engine default service account` of server hosting project.

### Configuare

- Fill in `gcp/{dam|ic}/app.yaml`. Example:

  ```
  # dam/app.yaml
  runtime: go112
  service: "dam"

  env_variables:
    DAM_URL: "https://dam-dot-${dam-hosting-project}.appspot.com"
    SERVICE_NAME: "dam"
    PROJECT: "${dam-hosting-project}"
    CONFIG_PATH: "config"
    STORAGE: "datastore"

  # ic/app.yaml
  runtime: go112
  service: "ic"

  env_variables:
    SERVICE_NAME: "ic"
    SERVICE_DOMAIN: "ic-dot-${ic-hosting-project}.appspot.com"
    ACCOUNT_DOMAIN: "${account-project-domain}"
    CONFIG_PATH: "config"
    PROJECT: "${ic-hosting-project}"
    PERSONA_DAM_URL: "https://dam-dot-${dam-hosting-project}.appspot.com"
    PERSONA_DAM_CLIENT_ID: "${dam-client-id}"
    PERSONA_DAM_CLIENT_SECRET: "${dam-client-secret}"
    STORAGE: "datastore"
  ```

- In `config/dam/config_master_main_latest.json`, add your IC to "trustedPassportIssuers".

  ```
  "ic": {
      "issuer": "https://ic-dot-${ic-hosting-project}.appspot.com/oidc",
      "clientId": "${client-id}"
  },
  ```

- Generate keys for `config/{dam|ic}/secrets_master_main_latest.json`

  ```bash
  openssl genrsa -out private.pem 2048
  openssl rsa -in private.pem -RSAPublicKey_out > public.pem
  cat private.pem
  cat public.pem
  ```

### Start servers

```
gcloud app deploy gcp/ic/app.yaml
gcloud app deploy gcp/dam/app.yaml
```

### Test with test client

In browser, open `https://ic-dot-${ic-hosting-project}.appspot.com/identity/v1alpha/master/test`

{'fraction_non_alphanumeric': 0.12175024861486007, 'fraction_numerical': 0.005398494104276176, 'mean_word_length': 4.1088534107402035, 'pattern_counts': {'":': 6, '<': 7, '<?xml version=': 0, '>': 9, 'https://': 18, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2906964', 'n_tokens_mistral': 2274, 'n_tokens_neox': 2199, 'n_words': 664}