User selects "create new workspace" | GET https://fair.dap.c-path.org/api/workspaces-forms/workspace_request | None | "name": "Request a workspace", "sections": { "workspace": { "label": "Details of the workspace being requested:", "fields": [ { "name": "project_name", "type": "string", "label": "Project name", "placeholder": "Add the name of the project and project ID if applicable", "validation": { "required": true, "maximum": "250" } }, { "name": "project_description", "type": "markdown", "label": "Project description", "validation": { "required": true, "maximum": "4096" } }, { "name": "emails", "type": "text", "label": "Additional users", "placeholder": "Provide email addresses of other users who should be invited to the workspace", "validation": { "maximum": "4096" } }, { "name": "region", "type": "list", "label": "What hub do you need your workspace to be located?", "placeholder": "Select Hub location...", "validation": { "required": true }, "options": [ { "text": "West Europe", "value": "westeurope", "description": "(Europe) West Europe" }, { "text": "North Europe", "value": "northeurope", "description": "(Europe) North Europe" } ], "default_options": "westeurope" }, { "name": "vm_check", "type": "label", "label": "Do you require a virtual machine?" }, { "name": "windows_vm", "type": "boolean", "label": "Windows Virtual Machine" }, { "name": "linux_vm", "type": "boolean", "label": "Linux Virtual Machine" }, { "name": "interests", "type": "label", "label": "What is your area of interest? Check all that apply?" }, { "name": "data_science", "type": "boolean", "label": "Data science - general" }, { "name": "bio_informatics", "type": "boolean", "label": "Bioinformatics/BioStatistics" }, { "name": "maths", "type": "boolean", "label": "Mathematics/Statistics" }, { "name": "ai", "type": "boolean", "label": "AI/Machine Learning" } ] } } }` |
User advances to Project / About tab | GET https://fair.dap.c-path.org/api/workflows/rdca_access_request | None | { "code": "rdca_access_request", "created_at": "2021-09-10T13:42:00.899Z", "updated_at": "2024-06-12T09:00:46.749Z", "controls_requests": "workflow", "workflow": { "id": "rdca_access_request:45:48bd6eb5-6c90-11f0-91ac-de8d4e31b0a3", "key": "rdca_access_request", "version": 45, "name": "RDCA Access Request", "description": null }, "enabled": true, "sections": { "about": { "label": "About", "fields": [ { "name": "code", "type": "string", "label": "ID", "validation": { "maximum": "256", "identifier": true }, "placeholder": "Enter a unique ID or leave blank and we will allocate one for you", "defaultValue": "" }, { "name": "name", "type": "string", "label": "Request name", "validation": { "maximum": "256", "required": true }, "placeholder": "Name this request", "defaultValue": "" }, { "name": "applicant_affiliation", "type": "label", "label": "Applicant Affiliation" }, { "name": "full_name", "type": "string", "label": "Applicant name", "validation": { "maximum": "256", "required": true }, "placeholder": "Your first and last name", "defaultValue": "" }, { "name": "organization", "type": "string", "label": "Institution or organization", "validation": { "maximum": "256", "required": true }, "placeholder": "Add the name of your institution or organization", "defaultValue": "" }, { "name": "org_country", "type": "string", "label": "Country of institution or organization", "validation": { "maximum": "256", "required": true }, "placeholder": "Enter the country of your institution or organization", "defaultValue": "" }, { "name": "org_state", "type": "string", "label": "State or Region of institution or organization", "validation": { "maximum": "256", "required": false }, "placeholder": "Enter the state or region of your institution or organization", "defaultValue": "" }, { "name": "org_address", "type": "text", "label": "Street address of institution or organization", "validation": { "maximum": "4096", "required": true }, "placeholder": "Add the street address of your institution or organization", "defaultValue": "" }, { "name": "sector", "type": "list", "label": "Sector", "options": [ { "text": "Academia", "value": "Academia", "description": "" }, { "text": "Pharma", "value": "Pharma", "description": "Pharmaceutical" }, { "text": "Non-profit", "value": "Non-profit", "description": "" }, { "text": "Government", "value": "Government", "description": "" }, { "text": "Other", "value": "Other", "description": "" } ], "validation": { "required": true }, "placeholder": "The sector of the institution or organization" }, { "name": "dept", "type": "string", "label": "Department", "validation": { "maximum": "256", "required": true }, "placeholder": "Add the name of your department", "defaultValue": "" }, { "name": "position", "type": "list", "label": "Position", "options": [ { "text": "Research", "value": "Research", "description": "" }, { "text": "Faculty", "value": "Faculty", "description": "" }, { "text": "Postdoc", "value": "Postdoc", "description": "" }, { "text": "Other", "value": "Other", "description": "" } ], "validation": { "required": true }, "placeholder": "Your position or role" }, { "name": "education", "type": "string", "label": "Education", "validation": { "maximum": "256", "required": false }, "placeholder": "Degree(s) and respective college or university", "defaultValue": "" }, { "name": "websites", "type": "markdown", "label": "LinkedIn, ResearchGate, or other relevant websites", "validation": { "maximum": "4096", "required": false }, "defaultValue": "" }, { "name": "email", "type": "string", "label": "Institutional email address", "validation": { "maximum": "256", "required": true }, "placeholder": "Add your institutional email address", "defaultValue": "" }, { "name": "phone_number", "type": "phone", "label": "Phone number", "country": "us", "validation": { "maximum": "64", "required": true }, "placeholder": "", "defaultValue": "", "preferredCountries": [ "us", "gb" ] }, { "name": "user_country", "type": "string", "label": "Country of residence", "validation": { "maximum": "256", "required": true }, "placeholder": "Enter your country of residence", "defaultValue": "" }, { "name": "user_state", "type": "string", "label": "State or Region of residence", "validation": { "maximum": "256", "required": false }, "placeholder": "Enter your state or region of residence", "defaultValue": "" } ] }, "project": { "label": "Project", "fields": [ { "name": "project_name", "type": "string", "label": "Title of proposed research or study", "validation": { "maximum": "250", "required": true }, "placeholder": "Add the title of the research plan or study to be made publicly available", "defaultValue": "" }, { "name": "project_synopsis", "type": "text", "label": "Synopsis of proposed research or study", "validation": { "maximum": "4096", "required": true }, "placeholder": "Describe goals, expected milestones, and how RDCA-DAP supports your goals", "defaultValue": "" }, { "name": "results_pub_intent", "type": "text", "label": "Results and publication intent", "validation": { "maximum": "4096", "required": true }, "placeholder": "Describe how results will be used and any publication intentions", "defaultValue": "" }, { "name": "curation_req", "type": "list", "label": "If approved, in what format would you prefer the data?", "options": [ { "text": "Raw", "value": "Raw", "description": "" }, { "text": "Curated OMOP", "value": "Curated OMOP", "description": "" }, { "text": "Curated SDTM", "value": "Curated SDTM", "description": "" } ], "validation": { "required": false }, "placeholder": "The preferred format of the data" }, { "name": "principal_investigator", "type": "string", "label": "Principal Investigator (Name, Title, and Email)", "validation": { "maximum": "250", "required": true }, "placeholder": "Name and email for the PI (if different than the requester)", "defaultValue": "" }, { "name": "check_PI", "type": "boolean", "label": "Have you included the title, name, and email of the PI? *", "validation": { "required": true }, "defaultValue": "" }, { "name": "additional_user_access", "type": "text", "label": "Additional Access (Name, Title, and Email)", "validation": { "maximum": "4096", "required": true }, "placeholder": "List any additional users who will need access (name, title, and email)", "defaultValue": "" }, { "name": "check_users", "type": "boolean", "label": "Have you included the title, name, and email of all users? *", "validation": { "required": true }, "defaultValue": "" }, { "name": "project_signatories", "type": "text", "label": "Authorized Signatories (Name, Title, and Email)", "validation": { "maximum": "4096", "required": true }, "placeholder": "Institutional authorized signatory(s) (name, title, and email)", "defaultValue": "" }, { "name": "check_sig", "type": "boolean", "label": "Have you included the title, name, and email of all signatories? *", "validation": { "required": true }, "defaultValue": "" }, { "name": "project_end_date", "type": "date", "label": "Project end date", "validation": { "minimum": "today", "required": true }, "placeholder": "Anticipated end date of your research or study", "defaultValue": "" } ] } }}` |
Major Security Concern: Access Requirement (AR) Coupling
The current design attempts to map C-Path external approval status directly to a local Synapse
AccessRequirement(AR). Because Synapse relies on a backend service account token exchange rather than OAuth/identity federation, Synapse cannot cryptographically verify that SynapseUser Ais authorized to submit requests on behalf of RDCA-DAPUser B.Security Vulnerability
If a malicious user submits false identity details in the static DAR form, C-Path’s resulting approval will cause Synapse to set
hasUnmetAccessRequirement = false. This creates a severe security vulnerability where an unauthorized user can unlock and access Synapse-hosted data gated under that same AR within Synapse—completely bypassing Synapse's access control boundaries.Recommendation
We should decouple C-Path external request tracking from Synapse’s internal
AccessRequirementengine, or require a one-time OAuth identity linking step with RDCA-DAP before allowing DAR submission.