htsget auth support

[brainstorm]

Hello @cmdcolin,

We are deploying JBrowse2 @UMCCR, primarily for the htsget support, so that different web-based clients work fine using one data access interface (htsget).

Unfortunately we hit a snag with the Bearer token support, which would allow our users to access private data via htsget, namely:

https://github.com/GMOD/bam-js/blob/25ba6e838ce45f46d6acf6a4e702d80588dcf8c7/src/htsget.ts#L65-L68

Do you have plans to add Bearer token support to htsget in JBrowse2?

@andrewpatto @victorskl

/cc @ohofmann @mlin

[brainstorm]

I suspect that was the plan with issue https://github.com/GMOD/jbrowse/issues/1142 ?

[cmdcolin]

cool! glad to have interest

there is likely a bit of nuance to some of this, so i'll try to mention a couple of various related things

1. we have some support of htsget in jbrowse 2. this is a little driver that I use to test out htsget loading data from a dnanexus endpoint http://s3.amazonaws.com/jbrowse.org/code/jb2/main/index.html?config=test_data%2Fconfig_demo.json&session=share-06G4abghy6&password=bwLI5 we still have a bit of work with #67 to make the

2. this is the track config for that https://github.com/GMOD/jbrowse-components/blob/607_stats_estimation_v3/test_data/config_demo.json#L1545-L1555

3. the code for htsget in this library uses a plain fetch. if someone wanted to supply extra headers they could, in principle, use the "opts" argument to supply e.g. an opts.headers.Authorization field, however, the jbrowse code is not hooked up to do this

4. the jbrowse 2 codebase created a concept for accessing authenticated resources (called internet accounts, which can be configured or added to via plugins), but this is not hooked up to htsget.

5. in general actually, the htsget support in jbrowse 2 is quite basic e.g. we don't let users input htsget:// urls yet but with interest, we could definitely add stuff like this

[cmdcolin]

if you have any more info about your needs let us know:)

[brainstorm]

Thanks @cmdcolin! @jb-adams will be tilting the GA4GH htsget server back by the end of this week so you can tackle that issue.

Points 3&4: Understood, our team has its hands a bit full with other tasks, so it might take some time to cobble it up, test and submit a PR for that but we definitely would like to see that in place at some point :-S

Point 5: The htsget:// scheme is still under debate on whether it's standard or not (see https://github.com/samtools/hts-specs/issues/581).