Smoke-test ui-react on a Vercel preview against TACC's real Hasura and CKAN

Question

First contact with TACC's own data and services.

Rescoped by #69. This was originally a parallel deploy on TACC's cluster alongside the
untouched ui component. There are no users on Lit at TACC, so there is nothing to deploy
beside — the staged rollout bought nothing. Testing happens on a Vercel preview pointed at
TACC's Hasura and CKAN, and production is then upgraded directly in #77.

What a Vercel preview cannot prove moves to #77: the OAuth2 round-trip at the real
mint.tacc.utexas.edu origin, because previews use a dedicated OAuth path for preview origins
(see ADR-0002). #73 settles the redirect URI; #77 confirms it end to end at the real origin.

Everything else is provable here. Walk it by hand, in a real browser:

Log in on the preview. Token attaches to writes.
/models — the faceted browser. Check the "Output variable" facet is populated. ADR-0001
warns the anonymous role cannot read modelcatalog_standard_variable, and it fails as
null, not as an error — so an empty facet is silent. Check logged out as well as in.
The §8 acceptance criterion: register or configure a model input and set variable +
standard variable + unit in one submission. This is the contracted deliverable; it must work
here, against TACC's catalog, not just locally.
The standard-variable and unit typeaheads actually return results — confirm TACC's catalog
holds the ~303 variables and ~107 units the form assumes.
/datasets/* against real CKAN. Note a Vercel preview has no container nginx, so if Verify CKAN from a browser origin against ckan.tacc.utexas.edu — is CORS actually broken? #71 finds
CORS is broken this is exercised through whatever Proxy CKAN through the container nginx (only if T3 says CORS is broken) #74 lands on — or deferred to Flip mint.tacc.utexas.edu to ui-react #77.
/modeling/* — problem statement → task → thread wizard.

Verify in a real browser, not jsdom. ADR-0002 records that jsdom cannot catch the cmdk
data-[disabled] bug — no Tailwind is applied and userEvent.click ignores pointer-events,
so combobox options that are greyed and unclickable in production test green.

Whatever breaks here becomes new tickets.

Sharpened by Settle the window.MINT_CONFIG values for the TACC deployment:
three checks are already done, and one is off the list.

No CKAN API key. Lit sets DATA_CATALOG_KEY from a chart secret. ui-react has no such
key and needs none — it calls only package_search and package_show, with GET. Do not
chase a missing credential if a dataset does not appear. Anonymous read is the whole contract.
CORS is settled for Hasura and the Ensemble Manager. Both send
Access-Control-Allow-Origin: * to every origin, verified live. Only CKAN uses an allowlist,
which Verify CKAN from a browser origin against ckan.tacc.utexas.edu — is CORS actually broken? #71 already fixed for the branch alias. A CORS failure in this smoke test means the
preview is on the wrong URL, not that a service needs a change.
TACC's Hasura answers anonymously. A live query returned a row from
modelcatalog_standard_variable. The remaining permission question is what the Tapis token
unlocks after login, not whether the endpoint is reachable.
ENSEMBLE_MANAGER_API is set, to https://ensemble-manager.mint.tacc.utexas.edu/v1. The
service is live: GET /v1/executions/<id>/logs returns 404 for an unknown id. So thread
execution is now in scope for this smoke test. It would have silently done nothing before.

Narrowed by the local smoke test (see the resolution comment below). The anonymous half is
done and passed: the Output variable facet is populated, the cmdk click bug is absent, CKAN
search works, /variables and /models render, and the console is clean. TACC holds 668
standard variables and 129 units, so the typeaheads have data.

What remains needs a signed-in human, on the Vercel preview
monorepo-git-develop-mosoriobs-projects.vercel.app:

Sign in; confirm the token attaches to writes.
§8 acceptance criterion — one model input, variable + standard variable + unit, in a
single submission, against TACC's catalog. The contracted deliverable.
The standard-variable and unit typeaheads inside that form return results.
/modeling/* — problem statement → task → thread.
Thread execution, now that ENSEMBLE_MANAGER_API is set.

Local login cannot substitute: client mint-local is registered to a callback_url that matches
no local origin, so every ProtectedRoute is unreachable on localhost.

Constraint from #71: the /datasets/* leg cannot run on a Vercel preview.

CKAN echoes Access-Control-Allow-Origin only for *.tacc.utexas.edu, localhost and 127.0.0.1. *.vercel.app gets no ACAO, so every CKAN call from a preview is blocked by the browser — surfacing as a fetch TypeError, not an HTTP error. This is not a ui-react defect; production at mint.tacc.utexas.edu is allowlisted and works.

The escape hatch this ticket names — "exercised through whatever #74 lands on" — is gone: #74 is closed unopened, because the container nginx proxy only serves the already-working production origin and never touches a preview.

Run the /datasets/* leg from localhost instead. npm run dev (or the container run locally) pointed at TACC's real Hasura and CKAN is an allowlisted origin, so it exercises the real catalog with no proxy and no config request to TACC. Everything else on this ticket stays on the Vercel preview as written.

Still a real-browser check either way — jsdom proves nothing here (ADR-0002).

Incidental measurements from #71 — not a resolution of this ticket, just facts that fell
out of probing origins. Everything below still needs the real-browser walk this ticket
describes.

TACC's Hasura is https://graphql.mint.tacc.utexas.edu/v1/graphql (found by probing; #75 still
owns pinning it in config).

Hasura CORS is wide open: Access-Control-Allow-Origin: *. The CKAN origin allowlist is
not mirrored here, so the Hasura half of this smoke test runs fine on a Vercel preview.
Only the /datasets/* leg has to move to localhost.
anonymous can read modelcatalog_standard_variable and modelcatalog_unit at TACC —
unlike the ISI endpoint ADR-0001 warns about. A two-row limit: 2 query returns real ids
from both. So the silent-empty-facet failure mode this ticket flags may simply not exist
here. Still worth eyeballing the facet logged out, since a read permission is not the same
as the facet query succeeding.
*_aggregate is absent for anonymous (field 'modelcatalog_standard_variable_aggregate' not found in type: 'query_root') — same gap as ISI, so no server-side facet counts, and the
~303 / ~107 counts could not be taken this way.

The localhost constraint is lifted — disregard my earlier comment on this point.

Max added *.vercel.app to CKAN's nginx origin map and reloaded; I re-measured and
Access-Control-Allow-Origin is now echoed to Vercel origins on every action this app calls,
preflight included. See the amendment on
#71.

So this ticket runs entirely on the Vercel preview as originally written, /datasets/*
included. Nothing moves to localhost, no proxy, no split test surface.

The rest of that earlier comment still stands: Hasura is at
https://graphql.mint.tacc.utexas.edu/v1/graphql with Access-Control-Allow-Origin: *,
anonymous can read modelcatalog_standard_variable and modelcatalog_unit at TACC
(unlike ISI, so the silent-empty-facet trap may not bite here — still worth eyeballing the
facet logged out), and *_aggregate is absent for anonymous, so facet counts and the
~303 / ~107 tallies can't come from there.

Test on the branch alias, not the per-deployment URL.

CKAN's origin allowlist was narrowed to two exact Vercel origins (see
#71 amendment 2):

https://monorepo-mosoriobs-projects.vercel.app — production alias
https://monorepo-git-develop-mosoriobs-projects.vercel.app — use this one

Per-deployment URLs like monorepo-d21dd85we-mosoriobs-projects.vercel.app are refused, and
deliberately cannot be allowlisted — the hash changes on every push. The branch alias serves the
latest develop build, so it is the same artifact.

If /datasets/* comes up empty with fetch TypeErrors and no HTTP error in the network panel,
check the origin in the address bar before filing it as a defect — that failure is this
allowlist. Testing any other branch needs its alias added to CKAN's nginx map first.

Verified live: all four CKAN actions this app calls return 200 with the header from the branch
alias, preflight included.

Partial result: the anonymous half passes. The authenticated half is untested and still needs a human.

I could not use the Vercel preview. It sits behind Vercel SSO, and I will not log in to Vercel
as you. So I ran the app locally against TACC's real Hasura, CKAN and Ensemble Manager, and drove
it in a real Chrome — not jsdom, per the ADR-0002 warning.

localhost is in CKAN's allowlist (#71), so a local origin tests more than the preview does,
not less. The one thing it cannot test is login. See the blocker below.

Passed, against TACC's real data

The Output variable facet is populated. This was the flagged silent-failure risk.
ADR-0001 warns anonymous cannot read modelcatalog_standard_variable and that it fails as
null, not as an error. That warning does not apply to TACC. The facet returned 47 options
for the query water, logged out.
The cmdk data-[disabled] bug is absent. I measured the rendered options rather than
trusting the screenshot: all 47 report data-disabled="false", pointer-events: auto and
opacity: 1. A real hit test with elementFromPoint landed on the option, and a real pointer
sequence selected it. The page then filtered to the one matching model and put the variable in
the URL. This is the check jsdom cannot do.
/datasets/search works against real CKAN. bayou returned 2 datasets with full metadata.
GLDAS returned 0 — and that is correct, not a silent failure: TACC's CKAN holds 215
datasets and none match GLDAS. I confirmed both counts against the CKAN API directly.
/variables renders TACC's standard variables with categories and units.
/models lists 35+ models from TACC's catalog.
Console is clean. Only two React Router v7 future-flag warnings. No errors.

Catalog counts — the fog item is settled

anonymous has no *_aggregate at TACC, so #75 could not take counts. I counted by paging
instead:

Table	Rows at TACC	Form assumed
`modelcatalog_standard_variable`	668	~303
`modelcatalog_unit`	129	~107

Both are well above the assumption. The typeaheads have data to return.

Blocker: local login is impossible

Every remaining check is behind ProtectedRoute — /models/register,
/models/configure/:slugid, and all of /modeling/*. Signing in locally dead-ends at Tapis:

{"message":"redirect_uri query parameter does not match the registered callback_url for the client."}

The client mint-local exists — a bogus client id returns Invalid client. instead — but its
registered callback_url matches none of localhost:3000, :5173, :4173, :8080,
127.0.0.1:3000, the https:// form, or the /callback and trailing-slash path variants.

This is minor debt, not a rollout risk. Production uses client mint, which #73 verified is
registered correctly for https://mint.tacc.utexas.edu/oauth2/callback. But it means
.env.example ships an AUTH_CLIENT_ID that cannot log in, so the local setup from #72 is
read-only in practice. Worth a line in the README.

What is left — needs you signed in

Do this on the Vercel preview monorepo-git-develop-mosoriobs-projects.vercel.app, where login
works and CKAN is allowlisted:

Sign in. Confirm the token attaches to writes.
The §8 acceptance criterion. Configure a model input and set variable + standard variable
- unit in one submission, against TACC's catalog. This is the contracted deliverable and
  the only item that must not be deferred.
Confirm the standard-variable and unit typeaheads inside that form return results. The data is
there (668 / 129); this checks the form reaches it.
/modeling/* — problem statement → task → thread.
Thread execution, now that ENSEMBLE_MANAGER_API is set.

The OAuth round-trip at the real origin stays with #77, as originally scoped.

Login now works on localhost:3000, and it immediately found a defect.

The blocker in the comment above is fixed. Tapis client mint-localhost-3000 is registered
to http://localhost:3000/oauth2/callback and is now the repo's default AUTH_CLIENT_ID.
mint-local is untouched and still serves http://mint.local/oauth2/callback — verified by
probing the authorize endpoint for both clients against both URIs.

Max signed in against TACC's Tapis. The OAuth round trip completed and the token landed in
localStorage.

The defect: the token is stored as mint.access_token, but MintThread.tsx and
MintRuns.tsx read access-token — a key nothing writes. Both Ensemble Manager calls
therefore go out with no Authorization header, and they fail silently because the header is
spread conditionally. Tracked as #85.

This is why item 5 of the remaining checklist could not have passed. Do #85 before retrying
thread execution.

Local login fix is up as PR #86 against develop. It only changes the default AUTH_CLIENT_ID; production and Vercel override it. #85 is deliberately not included.

Resolved. The §8 acceptance criterion passes against TACC's real catalog — for a new input. Editing an existing one fails, which is #91.

Run signed in as mosorio@portals (Tapis client mint-localhost-3000, token live), in a real
Chrome, against TACC's Hasura, CKAN and Ensemble Manager.

On localhost:3000, not the Vercel preview. The preview sits behind Vercel SSO and I will not
log in as you. localhost is in CKAN's allowlist (#71) and now has a working OAuth client, so it
tests strictly more than the preview does. The one thing it cannot test — the OAuth round trip at
the real origin — was already #77's, and stays there.

The acceptance criterion

Added a new input to End to end testing / hello world file input test and set label +
standard variable + unit in one submission. All three landed:


label	`WAYFINDER TEST INPUT (delete me) — issue 76`
standard variable	`soil__porosity`
unit	`m3 m-3`

The form is genuinely flattened. "Standard variable & unit" is one control: pick the standard
variable and the dialog offers the units already used with it — m³ m⁻³ volume water per volume soil as a one-tap. No second modal.

The cmdk trap ADR-0002 warns about is absent here, and could not have applied. This picker is
plain buttons, not cmdk — I checked the attributes. I verified it the hard way anyway:
pointer-events: auto, opacity: 1, and elementFromPoint at the option's centre landing on the
option, then a real CDP mouse click.

Typeahead returns real results. soil returned many CSDMS-named variables. soil moisture
returned none — correct, not a silent failure; it is not a CSDMS name, and the dialog offers to
create it.

Checklist

Sign in; token attaches to writes — every Hasura call carried Authorization: Bearer …
§8 criterion — passes on add; fails on edit (Editing an existing model input fails: the junction upsert names a column Hasura does not expose #91)
Typeaheads inside the form return results
/modeling/* — problem statement → task → thread
Thread execution — carved out as Submit one thread run end to end against TACC's Ensemble Manager #92

What broke: #91

Editing any existing input fails at save, with
expected one of the values ['_PLACEHOLDER'] for type 'modelcatalog_configuration_input_update_column', but found 'is_optional'.
The junction upsert names a column this repo's own metadata never exposes, so it is not
TACC-specific. It half-applies: the dataset-spec update commits before the throw.

A second, minor fault on the same path: after a successful save the detail view still showed
INPUTS (2). The row was in the database; nothing refetches, so the pre-save cache entry sticks
until a manual reload.

Both are in #91, which now blocks #77.

`/modeling/*`

Renders against TACC's real data. The wizard — Framing → Variables → Models → Datasets →
Parameters → Runs → Results → Summary — opens with the model already resolved.

One thing to know for the walkthrough: the region filter defaults to California, and TACC has no
problem statements there. The page says "No problem statements yet". Switch to Texas and 20-odd
appear, SUBSIDE Allocation among them. Not a defect, but it reads as an empty deployment.

Facts for #92 and #77

TACC's Ensemble Manager publishes /executionEngines/tapis, /executions and
/executionsLocal — exactly the three separate mounts ui-react submits runs to /executionEngines/localex, a route that does not exist #88 predicted.
mint.tacc.utexas.edu/config.js sets REACT_APP_EXECUTION_ENGINE = "tapis", so the
EXECUTION_ENGINE: tapis constraint on Flip mint.tacc.utexas.edu to ui-react #77 holds.
But TACC's 264 executions are 263 localex and 1 tapis — that path is all but unused
there. Budget for a Tapis-side failure in Submit one thread run end to end against TACC's Ensemble Manager #92 that is not ours.

Housekeeping

Console clean apart from the two known React Router v7 future-flag warnings. Every test row was
removed — the junction, the dataset specification and the variable presentation. I checked the
orphans: deleting an input through the UI removes only the junction row and leaves the entity rows
behind. Worth knowing, not worth a ticket. TACC's catalog is back to its prior state.

Navigation Menu

Repository navigation

Smoke-test ui-react on a Vercel preview against TACC's real Hasura and CKAN #76

Question

Passed, against TACC's real data

Catalog counts — the fog item is settled

Blocker: local login is impossible

What is left — needs you signed in

The acceptance criterion

Checklist

What broke: #91

`/modeling/*`

Facts for #92 and #77

Housekeeping

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Smoke-test ui-react on a Vercel preview against TACC's real Hasura and CKAN #76

Description

Question

Activity

mosoriob commented on Aug 8, 2026

mosoriob commented on Aug 8, 2026

mosoriob commented on Aug 8, 2026

mosoriob commented on Aug 8, 2026

mosoriob commented on Aug 8, 2026

Passed, against TACC's real data

Catalog counts — the fog item is settled

Blocker: local login is impossible

What is left — needs you signed in

mosoriob commented on Aug 8, 2026

mosoriob commented on Aug 8, 2026

mosoriob commented on Aug 8, 2026

The acceptance criterion

Checklist

What broke: #91

/modeling/*

Facts for #92 and #77

Housekeeping

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

`/modeling/*`