fix: use cache for github actions

.dockerignore

@@ -0,0 +1,8 @@
+.git
+.github
+*.md
+.venv/
+venv/
+*.pyc
+__pycache__/
+.idea/

.github/workflows/pr-next-build.yml

@@ -11,6 +11,11 @@ env:
 on:
   pull_request:
     branches: [next]
+    paths:
+      - 'backend/**'
+      - 'frontend/**'
+      - 'docker/**'
+      - 'VERSION'
   workflow_dispatch:  # optional manual trigger
 
 jobs:
@@ -36,6 +41,9 @@ jobs:
           PR_VERSION="${BASE_VERSION}-pr${{ github.event.pull_request.number }}.${{ github.run_number }}"
           echo "VERSION=$PR_VERSION" >> $GITHUB_ENV
 
+      - name: Set up Docker Buildx (to enable caching)
+        uses: docker/setup-buildx-action@v3
+
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
         with:
@@ -52,6 +60,8 @@ jobs:
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_BACKEND }}:${{ env.VERSION }}
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_BACKEND }}:pr-next-${{ github.event.pull_request.number }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Build & Push Frontend
         uses: docker/build-push-action@v5
@@ -63,4 +73,6 @@ jobs:
             APP_VERSION=${{ env.VERSION }}
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_FRONTEND }}:${{ env.VERSION }}
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_FRONTEND }}:pr-next-${{ github.event.pull_request.number }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_FRONTEND }}:pr-next-${{ github.event.pull_request.number }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

backend/rest_api/oauth/apps.py

@@ -21,6 +21,7 @@
 
 """Apps.py for the OAuth application."""
 import logging
+import os
 
 from django.apps import AppConfig
 from django.conf import settings
@@ -37,12 +38,37 @@ class OauthConfig(AppConfig):
     authz = None  # Placeholder for the authorization service instance
 
     def ready(self):
+        """
+        1) Import signals so that they are registered.
+        2) Initialize the authorization service when the app is ready. Use policy file specified in the settings via
+            environment variable 'AUTHORIZATION_POLICY_PATH',
+            or experiment policy from policies directory,
+            or default policy.
+        """
+
         # import signals so that they are registered
         import rest_api.signals  # noqa: F401
 
-        # Initialize authorization service
+        # initialize the authorization service
+        policy_path = getattr(settings, "AUTHORIZATION_POLICY_PATH", None)
+        if not policy_path:
+            base_policy_dir = os.path.join(settings.BASE_DIR, "oauth", "policies")
+            # try to find vo-specific policy file, if not found, use default policy
+            vo = getattr(settings, "MON_VO", "").lower().strip()
+            vo_policy_file = os.path.join(base_policy_dir, f"policy_{vo}.csv")
+            default_policy_file = os.path.join(base_policy_dir, "policy__default.csv")
+            if vo and os.path.exists(vo_policy_file):
+                policy_path = vo_policy_file
+                _logger.info(f"Targeting VO policy file for: '{vo}'")
+            else:
+                policy_path = default_policy_file
+                _logger.info(f"VO policy file '{default_policy_file}' not found. Falling back to default.")
+
         try:
-            self.authz = AuthorizationService(settings.AUTHORIZATION_POLICY_PATH)
-            _logger.debug(f"Total policies loaded: {len(self.authz.enforcer.get_policy())} from {settings.AUTHORIZATION_POLICY_PATH}")
+            if os.path.exists(policy_path):
+                self.authz = AuthorizationService(policy_path)
+                _logger.debug(f"Total policies loaded: {len(self.authz.enforcer.get_policy())} from {policy_path}")
+            else:
+                _logger.error(f"Critical: Chosen policy path does not exist: {policy_path}")
         except Exception as e:
-            raise f"Critical: AuthorizationService failed: {e}"
+            raise RuntimeError(f"Critical: AuthorizationService failed to initialize: {e}")

backend/rest_api/oauth/policies/policy__default.csv

@@ -0,0 +1,2 @@
+# This is a default policy file. It is used when no other policy file is found.
+p, guest, job, read, {}, {}, allow

backend/rest_api/oauth/policies/policy_atlas.csv

@@ -0,0 +1,2 @@
+p,atlas-adc-pandamon,error_description,read,{},{},allow
+p,atlas-adc-pandamon,error_description,write,{},{},allow

backend/rest_api/settings/oauth.py

@@ -74,5 +74,3 @@
 USE_X_FORWARDED_HOST = True
 
 AUTHORIZATION_POLICY_PATH = os.getenv("AUTHORIZATION_POLICY_PATH", None)
-if not AUTHORIZATION_POLICY_PATH or not os.path.isfile(AUTHORIZATION_POLICY_PATH):
-    raise ValueError("AUTHORIZATION_POLICY_PATH environment variable is not set")

docker/frontend/Dockerfile.frontend

@@ -19,10 +19,14 @@ RUN echo "{\"version\": \"${APP_VERSION}\"}" > /app/src/assets/version.json
 RUN npm run build --output-path=dist --configuration=production --aot --build-optimizer --vendor-chunk --source-map=false
 
 # Stage 2: serve
-FROM nginx:alpine
+FROM docker.io/almalinux:9
 
-# remove default nginx config and add custom one
-RUN rm /etc/nginx/conf.d/default.conf
+# install Nginx and clean the cache to keep the image slim
+RUN dnf install -y nginx && \
+    dnf clean all
+
+# remove default nginx config and add your custom one
+RUN rm -f /etc/nginx/conf.d/default.conf
 COPY docker/frontend/nginx/nginx.conf /etc/nginx/conf.d/default.conf
 
 # Copy built Angular app to NGINX html folder