From 6f1344e9fc97af573a325d88660cad6cb24569e0 Mon Sep 17 00:00:00 2001
From: Martin Cech <marten@bx.psu.edu>
Date: Fri, 22 Mar 2024 18:23:55 -0700
Subject: [PATCH 01/60] do not expand datasets that are known to be
 inaccessible

---
 client/src/components/History/Content/ContentItem.vue | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/client/src/components/History/Content/ContentItem.vue b/client/src/components/History/Content/ContentItem.vue
index e0d6acdb8178..19c8040201ab 100644
--- a/client/src/components/History/Content/ContentItem.vue
+++ b/client/src/components/History/Content/ContentItem.vue
@@ -9,6 +9,7 @@ import { useRoute, useRouter } from "vue-router/composables";
 
 import type { ItemUrls } from "@/components/History/Content/Dataset/index";
 import { updateContentFields } from "@/components/History/model/queries";
+import { Toast } from "@/composables/toast";
 import { useEntryPointStore } from "@/stores/entryPointStore";
 import { useEventStore } from "@/stores/eventStore";
 import { clearDrag } from "@/utils/setDrag";
@@ -238,7 +239,11 @@ function onClick(e?: Event) {
         return;
     }
     if (props.isDataset) {
-        emit("update:expand-dataset", !props.expandDataset);
+        if (props.item.accessible === false) {
+            Toast.error(`You are not allowed to access this dataset`);
+        } else {
+            emit("update:expand-dataset", !props.expandDataset);
+        }
     } else {
         emit("view-collection", props.item, props.name);
     }

From fb77ea2db4100ea2774589fe828e6c45a0385c5c Mon Sep 17 00:00:00 2001
From: Martin Cech <marten@bx.psu.edu>
Date: Mon, 25 Mar 2024 15:52:59 -0700
Subject: [PATCH 02/60] include HDAInaccessible in AnyHDA union

I assume the union_mode does not trickle down...

type accessible as literal False
---
 client/src/api/schema/schema.ts | 96 ++++++++++++++++++++++++++++++++-
 lib/galaxy/schema/schema.py     |  4 +-
 2 files changed, 97 insertions(+), 3 deletions(-)

diff --git a/client/src/api/schema/schema.ts b/client/src/api/schema/schema.ts
index cb7b0dc21217..13de4b70d8e5 100644
--- a/client/src/api/schema/schema.ts
+++ b/client/src/api/schema/schema.ts
@@ -5997,6 +5997,87 @@ export interface components {
              */
             visible: boolean;
         };
+        /**
+         * HDAInaccessible
+         * @description History Dataset Association information when the user can not access it.
+         */
+        HDAInaccessible: {
+            /**
+             * Accessible
+             * @constant
+             */
+            accessible: Record<string, never>;
+            /** Copied From Ldda Id */
+            copied_from_ldda_id?: string | null;
+            /**
+             * Create Time
+             * @description The time and date this item was created.
+             */
+            create_time: string | null;
+            /**
+             * Deleted
+             * @description Whether this item is marked as deleted.
+             */
+            deleted: boolean;
+            /**
+             * HID
+             * @description The index position of this item in the History.
+             */
+            hid: number;
+            /**
+             * History Content Type
+             * @description This is always `dataset` for datasets.
+             * @constant
+             */
+            history_content_type: "dataset";
+            /**
+             * History ID
+             * @example 0123456789ABCDEF
+             */
+            history_id: string;
+            /**
+             * Id
+             * @example 0123456789ABCDEF
+             */
+            id: string;
+            /**
+             * Name
+             * @description The name of the item.
+             */
+            name: string | null;
+            /**
+             * State
+             * @description The current state of this dataset.
+             */
+            state: components["schemas"]["DatasetState"];
+            tags: components["schemas"]["TagCollection"];
+            /**
+             * Type
+             * @description The type of this item.
+             */
+            type: string;
+            /**
+             * Type - ID
+             * @description The type and the encoded ID of this item. Used for caching.
+             */
+            type_id?: string | null;
+            /**
+             * Update Time
+             * @description The last time and date this item was updated.
+             */
+            update_time: string | null;
+            /**
+             * URL
+             * @deprecated
+             * @description The relative URL to access this item.
+             */
+            url: string;
+            /**
+             * Visible
+             * @description Whether this item is visible or hidden to the user by default.
+             */
+            visible: boolean;
+        };
         /**
          * HDAObject
          * @description History Dataset Association Object
@@ -6924,6 +7005,7 @@ export interface components {
             | components["schemas"]["HDACustom"]
             | components["schemas"]["HDADetailed"]
             | components["schemas"]["HDASummary"]
+            | components["schemas"]["HDAInaccessible"]
             | components["schemas"]["HDCADetailed"]
             | components["schemas"]["HDCASummary"]
         )[];
@@ -6940,6 +7022,7 @@ export interface components {
                 | components["schemas"]["HDACustom"]
                 | components["schemas"]["HDADetailed"]
                 | components["schemas"]["HDASummary"]
+                | components["schemas"]["HDAInaccessible"]
                 | components["schemas"]["HDCADetailed"]
                 | components["schemas"]["HDCASummary"]
             )[];
@@ -13530,6 +13613,7 @@ export interface operations {
                         | components["schemas"]["HDACustom"]
                         | components["schemas"]["HDADetailed"]
                         | components["schemas"]["HDASummary"]
+                        | components["schemas"]["HDAInaccessible"]
                         | components["schemas"]["HDCADetailed"]
                         | components["schemas"]["HDCASummary"]
                     )[];
@@ -13710,7 +13794,8 @@ export interface operations {
                     "application/json":
                         | components["schemas"]["HDACustom"]
                         | components["schemas"]["HDADetailed"]
-                        | components["schemas"]["HDASummary"];
+                        | components["schemas"]["HDASummary"]
+                        | components["schemas"]["HDAInaccessible"];
                 };
             };
             /** @description Validation Error */
@@ -16460,12 +16545,14 @@ export interface operations {
                         | components["schemas"]["HDACustom"]
                         | components["schemas"]["HDADetailed"]
                         | components["schemas"]["HDASummary"]
+                        | components["schemas"]["HDAInaccessible"]
                         | components["schemas"]["HDCADetailed"]
                         | components["schemas"]["HDCASummary"]
                         | (
                               | components["schemas"]["HDACustom"]
                               | components["schemas"]["HDADetailed"]
                               | components["schemas"]["HDASummary"]
+                              | components["schemas"]["HDAInaccessible"]
                               | components["schemas"]["HDCADetailed"]
                               | components["schemas"]["HDCASummary"]
                           )[];
@@ -17049,6 +17136,7 @@ export interface operations {
                         | components["schemas"]["HDACustom"]
                         | components["schemas"]["HDADetailed"]
                         | components["schemas"]["HDASummary"]
+                        | components["schemas"]["HDAInaccessible"]
                         | components["schemas"]["HDCADetailed"]
                         | components["schemas"]["HDCASummary"];
                 };
@@ -17100,6 +17188,7 @@ export interface operations {
                         | components["schemas"]["HDACustom"]
                         | components["schemas"]["HDADetailed"]
                         | components["schemas"]["HDASummary"]
+                        | components["schemas"]["HDAInaccessible"]
                         | components["schemas"]["HDCADetailed"]
                         | components["schemas"]["HDCASummary"];
                 };
@@ -17332,12 +17421,14 @@ export interface operations {
                         | components["schemas"]["HDACustom"]
                         | components["schemas"]["HDADetailed"]
                         | components["schemas"]["HDASummary"]
+                        | components["schemas"]["HDAInaccessible"]
                         | components["schemas"]["HDCADetailed"]
                         | components["schemas"]["HDCASummary"]
                         | (
                               | components["schemas"]["HDACustom"]
                               | components["schemas"]["HDADetailed"]
                               | components["schemas"]["HDASummary"]
+                              | components["schemas"]["HDAInaccessible"]
                               | components["schemas"]["HDCADetailed"]
                               | components["schemas"]["HDCASummary"]
                           )[];
@@ -17388,6 +17479,7 @@ export interface operations {
                         | components["schemas"]["HDACustom"]
                         | components["schemas"]["HDADetailed"]
                         | components["schemas"]["HDASummary"]
+                        | components["schemas"]["HDAInaccessible"]
                         | components["schemas"]["HDCADetailed"]
                         | components["schemas"]["HDCASummary"];
                 };
@@ -17438,6 +17530,7 @@ export interface operations {
                         | components["schemas"]["HDACustom"]
                         | components["schemas"]["HDADetailed"]
                         | components["schemas"]["HDASummary"]
+                        | components["schemas"]["HDAInaccessible"]
                         | components["schemas"]["HDCADetailed"]
                         | components["schemas"]["HDCASummary"];
                 };
@@ -17669,6 +17762,7 @@ export interface operations {
                         | components["schemas"]["HDACustom"]
                         | components["schemas"]["HDADetailed"]
                         | components["schemas"]["HDASummary"]
+                        | components["schemas"]["HDAInaccessible"]
                         | components["schemas"]["HDCADetailed"]
                         | components["schemas"]["HDCASummary"]
                     )[];
diff --git a/lib/galaxy/schema/schema.py b/lib/galaxy/schema/schema.py
index 34fe24988095..9e9360d56764 100644
--- a/lib/galaxy/schema/schema.py
+++ b/lib/galaxy/schema/schema.py
@@ -688,7 +688,7 @@ class HDASummary(HDACommon):
 class HDAInaccessible(HDACommon):
     """History Dataset Association information when the user can not access it."""
 
-    accessible: bool = AccessibleField
+    accessible: Literal[False]
     state: DatasetStateField
 
 
@@ -3271,7 +3271,7 @@ class HDACustom(HDADetailed):
     model_config = ConfigDict(extra="allow")
 
 
-AnyHDA = Union[HDACustom, HDADetailed, HDASummary]
+AnyHDA = Union[HDACustom, HDADetailed, HDASummary, HDAInaccessible]
 AnyHDCA = Union[HDCADetailed, HDCASummary]
 AnyHistoryContentItem = Annotated[
     Union[

From 422d7879d2a5f35d9775e776db626cc2b2cfa613 Mon Sep 17 00:00:00 2001
From: Martin Cech <marten@bx.psu.edu>
Date: Wed, 27 Mar 2024 17:21:57 -0700
Subject: [PATCH 03/60] reintroduce missing inaccessible state

that does not fetch dataset details or allow other interactions

minor adjustments
---
 .../History/Content/ContentItem.vue           | 29 ++++++++++++-------
 .../History/Content/model/states.ts           | 14 ++++++++-
 client/src/style/scss/base.scss               |  2 ++
 3 files changed, 34 insertions(+), 11 deletions(-)

diff --git a/client/src/components/History/Content/ContentItem.vue b/client/src/components/History/Content/ContentItem.vue
index 19c8040201ab..6cd89d478b24 100644
--- a/client/src/components/History/Content/ContentItem.vue
+++ b/client/src/components/History/Content/ContentItem.vue
@@ -9,7 +9,6 @@ import { useRoute, useRouter } from "vue-router/composables";
 
 import type { ItemUrls } from "@/components/History/Content/Dataset/index";
 import { updateContentFields } from "@/components/History/model/queries";
-import { Toast } from "@/composables/toast";
 import { useEntryPointStore } from "@/stores/entryPointStore";
 import { useEventStore } from "@/stores/eventStore";
 import { clearDrag } from "@/utils/setDrag";
@@ -92,7 +91,9 @@ const contentId = computed(() => {
 
 const contentCls = computed(() => {
     const status = contentState.value && contentState.value.status;
-    if (props.selected) {
+    if (props.item.accessible === false) {
+        return "alert-inaccessible";
+    } else if (props.selected) {
         return "alert-info";
     } else if (!status) {
         return `alert-success`;
@@ -100,7 +101,6 @@ const contentCls = computed(() => {
         return `alert-${status}`;
     }
 });
-
 const contentState = computed(() => {
     return STATES[state.value] && STATES[state.value];
 });
@@ -117,6 +117,9 @@ const state = computed<keyof StateMap>(() => {
     if (props.isPlaceholder) {
         return "placeholder";
     }
+    if (props.item.accessible === false) {
+        return "inaccessible";
+    }
     if (props.item.populated_state === "failed") {
         return "failed_populated_state";
     }
@@ -136,7 +139,13 @@ const state = computed<keyof StateMap>(() => {
 });
 
 const dataState = computed(() => {
-    return state.value === "new_populated_state" ? "new" : state.value;
+    if (props.item.accessible === false) {
+        return "inaccessible";
+    } else if (state.value === "new_populated_state") {
+        return "new";
+    } else {
+        return state.value;
+    }
 });
 
 const tags = computed(() => {
@@ -239,11 +248,7 @@ function onClick(e?: Event) {
         return;
     }
     if (props.isDataset) {
-        if (props.item.accessible === false) {
-            Toast.error(`You are not allowed to access this dataset`);
-        } else {
-            emit("update:expand-dataset", !props.expandDataset);
-        }
+        emit("update:expand-dataset", !props.expandDataset);
     } else {
         emit("view-collection", props.item, props.name);
     }
@@ -433,8 +438,12 @@ function unexpandedClick(event: Event) {
         </span>
         <!-- collections are not expandable, so we only need the DatasetDetails component here -->
         <BCollapse :visible="expandDataset" class="px-2 pb-2">
+            <div v-if="item.accessible === false">
+                You are not allowed to access this dataset
+                {{ item.id }}
+            </div>
             <DatasetDetails
-                v-if="expandDataset && item.id"
+                v-else-if="expandDataset && item.id"
                 :id="item.id"
                 :writable="writable"
                 :show-highlight="(isHistoryItem && filterable) || addHighlightBtn"
diff --git a/client/src/components/History/Content/model/states.ts b/client/src/components/History/Content/model/states.ts
index f3e52df90c5c..b24664e9a1ec 100644
--- a/client/src/components/History/Content/model/states.ts
+++ b/client/src/components/History/Content/model/states.ts
@@ -2,7 +2,13 @@ import type { components } from "@/api/schema";
 
 type DatasetState = components["schemas"]["DatasetState"];
 // The 'failed' state is for the collection job state summary, not a dataset state.
-type State = DatasetState | "failed" | "placeholder" | "failed_populated_state" | "new_populated_state";
+type State =
+    | DatasetState
+    | "failed"
+    | "placeholder"
+    | "failed_populated_state"
+    | "new_populated_state"
+    | "inaccessible";
 
 interface StateRepresentation {
     status: "success" | "warning" | "info" | "danger" | "secondary";
@@ -120,6 +126,12 @@ export const STATES: StateMap = {
         icon: "clock",
         nonDb: true,
     },
+    inaccessible: {
+        status: "warning",
+        text: "User not allowed to access this dataset.",
+        icon: "lock",
+        nonDb: true,
+    },
 } as const satisfies StateMap;
 
 /** We want to display a single state for a dataset collection whose elements may have mixed states.
diff --git a/client/src/style/scss/base.scss b/client/src/style/scss/base.scss
index 0b08c0aa0af1..d43fbd3c900c 100644
--- a/client/src/style/scss/base.scss
+++ b/client/src/style/scss/base.scss
@@ -203,6 +203,7 @@ $galaxy-state-border: (
     "deleted": darken($state-default-border, 30%),
     "hidden": $state-default-border,
     "setting_metadata": $state-warning-border,
+    "inaccessible": darken($state-default-border, 10%),
 );
 
 $galaxy-state-bg: (
@@ -216,6 +217,7 @@ $galaxy-state-bg: (
     "deleted": darken($state-default-bg, 30%),
     "hidden": $state-default-bg,
     "setting_metadata": $state-warning-bg,
+    "inaccessible": darken($state-default-bg, 10%),
 );
 
 @each $state in map-keys($galaxy-state-border) {

From ac7dbb846d30c7513fa7e1c80fe149c76d90f20c Mon Sep 17 00:00:00 2001
From: Martin Cech <marten@bx.psu.edu>
Date: Wed, 27 Mar 2024 17:24:05 -0700
Subject: [PATCH 04/60] fix a bug with using a supposedly optional caching key
 for a required operation

---
 client/src/components/History/CurrentHistory/HistoryPanel.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/components/History/CurrentHistory/HistoryPanel.vue b/client/src/components/History/CurrentHistory/HistoryPanel.vue
index 5e287c961ec2..074af66947c0 100644
--- a/client/src/components/History/CurrentHistory/HistoryPanel.vue
+++ b/client/src/components/History/CurrentHistory/HistoryPanel.vue
@@ -418,7 +418,7 @@ function updateFilterValue(filterKey: string, newValue: any) {
 }
 
 function getItemKey(item: HistoryItem) {
-    return item.type_id;
+    return itemUniqueKey(item);
 }
 
 function itemUniqueKey(item: HistoryItem) {

From 743a5f3c32451076ce79efd891835f286cc25bae Mon Sep 17 00:00:00 2001
From: Martin Cech <marten@bx.psu.edu>
Date: Wed, 27 Mar 2024 17:34:08 -0700
Subject: [PATCH 05/60] remove debug

---
 client/src/components/History/Content/ContentItem.vue | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/client/src/components/History/Content/ContentItem.vue b/client/src/components/History/Content/ContentItem.vue
index 6cd89d478b24..c515a952c3f7 100644
--- a/client/src/components/History/Content/ContentItem.vue
+++ b/client/src/components/History/Content/ContentItem.vue
@@ -438,10 +438,7 @@ function unexpandedClick(event: Event) {
         </span>
         <!-- collections are not expandable, so we only need the DatasetDetails component here -->
         <BCollapse :visible="expandDataset" class="px-2 pb-2">
-            <div v-if="item.accessible === false">
-                You are not allowed to access this dataset
-                {{ item.id }}
-            </div>
+            <div v-if="item.accessible === false">You are not allowed to access this dataset</div>
             <DatasetDetails
                 v-else-if="expandDataset && item.id"
                 :id="item.id"

From d952df78c193fe4c061a6572cfe810c13a7e505d Mon Sep 17 00:00:00 2001
From: Martin Cech <marten@bx.psu.edu>
Date: Fri, 29 Mar 2024 09:29:20 -0700
Subject: [PATCH 06/60] prevent id conflict between hda and dataset

---
 .../components/History/CurrentCollection/CollectionPanel.vue    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/components/History/CurrentCollection/CollectionPanel.vue b/client/src/components/History/CurrentCollection/CollectionPanel.vue
index 10c830ca4601..be760caaa42d 100644
--- a/client/src/components/History/CurrentCollection/CollectionPanel.vue
+++ b/client/src/components/History/CurrentCollection/CollectionPanel.vue
@@ -76,7 +76,7 @@ function updateDsc(collection: any, fields: Object | undefined) {
 }
 
 function getItemKey(item: DCESummary) {
-    return item.id;
+    return `${item.element_type}-${item.id}`;
 }
 
 function onScroll(newOffset: number) {

From 3bfdd3e08f268379266b239f00dc973479388ddb Mon Sep 17 00:00:00 2001
From: Martin Cech <marten@bx.psu.edu>
Date: Fri, 29 Mar 2024 11:28:30 -0700
Subject: [PATCH 07/60] do not show storage selection to anons

---
 .../components/History/CurrentHistory/HistoryCounter.vue    | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/client/src/components/History/CurrentHistory/HistoryCounter.vue b/client/src/components/History/CurrentHistory/HistoryCounter.vue
index 98efa0bf11b8..272a93c3ce9c 100644
--- a/client/src/components/History/CurrentHistory/HistoryCounter.vue
+++ b/client/src/components/History/CurrentHistory/HistoryCounter.vue
@@ -46,7 +46,7 @@ const emit = defineEmits(["update:filter-text", "reloadContents"]);
 
 const router = useRouter();
 const { config } = useConfig();
-const { currentUser } = storeToRefs(useUserStore());
+const { currentUser, isAnonymous } = storeToRefs(useUserStore());
 const { historySize, numItemsActive, numItemsDeleted, numItemsHidden } = useDetailedHistory(toRef(props, "history"));
 
 const reloadButtonLoading = ref(false);
@@ -145,7 +145,7 @@ onMounted(() => {
 
         <BButtonGroup v-if="currentUser">
             <BButton
-                v-if="config && config.object_store_allows_id_selection"
+                v-if="config && config.object_store_allows_id_selection && !isAnonymous"
                 :id="`history-storage-${history.id}`"
                 title="Manage Preferred History Storage"
                 variant="link"
@@ -156,7 +156,7 @@ onMounted(() => {
             </BButton>
 
             <PreferredStorePopover
-                v-if="config && config.object_store_allows_id_selection"
+                v-if="config && config.object_store_allows_id_selection && !isAnonymous"
                 :history-id="history.id"
                 :history-preferred-object-store-id="historyPreferredObjectStoreId"
                 :user="currentUser">

From a5b208bea461966ba6eb6bbb9390cfec2ddf94cb Mon Sep 17 00:00:00 2001
From: Martin Cech <marten@bx.psu.edu>
Date: Fri, 29 Mar 2024 12:09:38 -0700
Subject: [PATCH 08/60] make inaccessible items non-draggable

---
 client/src/components/History/Content/ContentItem.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/components/History/Content/ContentItem.vue b/client/src/components/History/Content/ContentItem.vue
index c515a952c3f7..cba8f0bdc4d3 100644
--- a/client/src/components/History/Content/ContentItem.vue
+++ b/client/src/components/History/Content/ContentItem.vue
@@ -344,7 +344,7 @@ function unexpandedClick(event: Event) {
         :data-state="dataState"
         tabindex="0"
         role="button"
-        draggable
+        :draggable="props.item.accessible === false ? false : true"
         @dragstart="onDragStart"
         @dragend="onDragEnd"
         @keydown="onKeyDown">

From f3a554743eabdf07abb9d9a1248cb7ecdb34593a Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Mon, 20 May 2024 10:27:07 +0200
Subject: [PATCH 09/60] Trigger redirct before rendering form

---
 client/src/components/Tool/ToolSuccess.vue | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/client/src/components/Tool/ToolSuccess.vue b/client/src/components/Tool/ToolSuccess.vue
index 76a3613a7a25..befaa48e9b99 100644
--- a/client/src/components/Tool/ToolSuccess.vue
+++ b/client/src/components/Tool/ToolSuccess.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import { BAlert } from "bootstrap-vue";
-import { computed, onMounted } from "vue";
+import { computed } from "vue";
 import { useRouter } from "vue-router/composables";
 
 import { useConfig } from "@/composables/config";
@@ -22,13 +22,10 @@ const responseVal = computed(() => jobStore.getLatestResponse);
 const showRecommendation = computed(() => config.value.enable_tool_recommendations);
 const toolName = computed(() => responseVal.value.toolName);
 
-/* lifecyle */
-onMounted(() => {
-    // no response means that no tool was run in this session i.e. no data in the store
-    if (Object.keys(responseVal.value).length === 0) {
-        router.push(`/`);
-    }
-});
+// no data means that no tool was run in this session i.e. no data in the store
+if (Object.keys(responseVal.value).length === 0) {
+    router.push(`/`);
+}
 </script>
 
 <template>

From 7444544cdbcdb9997daa94ac38f7879a41915d63 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Mon, 20 May 2024 10:39:57 +0200
Subject: [PATCH 10/60] Fix undefined errors in ToolSucess component

The data is either present in the store if a user has actually submitted
or job,  or it is not. That includes both `jobDef` and `jobResponse`.
Followup to https://github.com/galaxyproject/galaxy/pull/18141.
---
 client/src/components/Tool/ToolSuccess.vue | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/client/src/components/Tool/ToolSuccess.vue b/client/src/components/Tool/ToolSuccess.vue
index befaa48e9b99..8ac04d5c4c4d 100644
--- a/client/src/components/Tool/ToolSuccess.vue
+++ b/client/src/components/Tool/ToolSuccess.vue
@@ -31,15 +31,15 @@ if (Object.keys(responseVal.value).length === 0) {
 <template>
     <section>
         <BAlert v-if="!jobResponse" variant="info" show>
-            <LoadingSpan message="Waiting on a job response" />
+            <LoadingSpan message="Waiting on data" />
         </BAlert>
         <div v-else>
             <div v-if="jobResponse?.produces_entry_points">
                 <ToolEntryPoints v-for="job in jobResponse.jobs" :key="job.id" :job-id="job.id" />
             </div>
             <ToolSuccessMessage :job-response="jobResponse" :tool-name="toolName" />
+            <Webhook type="tool" :tool-id="jobDef.tool_id" />
+            <ToolRecommendation v-if="showRecommendation" :tool-id="jobDef.tool_id" />
         </div>
-        <Webhook type="tool" :tool-id="jobDef.tool_id" />
-        <ToolRecommendation v-if="showRecommendation" :tool-id="jobDef.tool_id" />
     </section>
 </template>

From 8d896b17210f8b0aa9baed6446d180c0dbf39a81 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Mon, 20 May 2024 16:51:30 +0200
Subject: [PATCH 11/60] Don't fail metadata if we only have an extra output
 files dir

---
 lib/galaxy/metadata/set_metadata.py | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/lib/galaxy/metadata/set_metadata.py b/lib/galaxy/metadata/set_metadata.py
index f1c8906c39fd..58b8a2f5a15f 100644
--- a/lib/galaxy/metadata/set_metadata.py
+++ b/lib/galaxy/metadata/set_metadata.py
@@ -409,15 +409,22 @@ def set_meta(new_dataset_instance, file_dict):
                 external_filename = unnamed_id_to_path.get(dataset_instance_id, dataset_filename_override)
                 if not os.path.exists(external_filename):
                     matches = glob.glob(external_filename)
-                    assert len(matches) == 1, f"{len(matches)} file(s) matched by output glob '{external_filename}'"
-                    external_filename = matches[0]
-                    assert safe_contains(
-                        tool_job_working_directory, external_filename
-                    ), f"Cannot collect output '{external_filename}' from outside of working directory"
-                    created_from_basename = os.path.relpath(
-                        external_filename, os.path.join(tool_job_working_directory, "working")
-                    )
-                    dataset.dataset.created_from_basename = created_from_basename
+                    if matches:
+                        assert len(matches) == 1, f"{len(matches)} file(s) matched by output glob '{external_filename}'"
+                        external_filename = matches[0]
+                        assert safe_contains(
+                            tool_job_working_directory, external_filename
+                        ), f"Cannot collect output '{external_filename}' from outside of working directory"
+                        created_from_basename = os.path.relpath(
+                            external_filename, os.path.join(tool_job_working_directory, "working")
+                        )
+                        dataset.dataset.created_from_basename = created_from_basename
+                    elif os.path.exists(dataset_path_to_extra_path(external_filename)):
+                        # Only output extra files dir, but no primary output file, that's fine
+                        pass
+                    else:
+                        raise Exception(f"Output file '{external_filename}' not found")
+
                 # override filename if we're dealing with outputs to working directory and dataset is not linked to
                 link_data_only = metadata_params.get("link_data_only")
                 if not link_data_only:

From fa5e852c67a23e946544980994c4db9925d5b126 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Mon, 20 May 2024 16:55:36 +0200
Subject: [PATCH 12/60] Revert "Always create output"

This reverts commit 90d04a017e3dacd7c5638f8d2c17ad6d10c63995.
---
 test/functional/tools/composite_output.xml       | 1 -
 test/functional/tools/composite_output_tests.xml | 1 -
 2 files changed, 2 deletions(-)

diff --git a/test/functional/tools/composite_output.xml b/test/functional/tools/composite_output.xml
index e634ea49315e..9e5f574809d5 100644
--- a/test/functional/tools/composite_output.xml
+++ b/test/functional/tools/composite_output.xml
@@ -1,6 +1,5 @@
 <tool id="composite_output" name="composite_output" version="1.0.0">
     <command><![CDATA[
-touch '$output' &&
 mkdir '$output.extra_files_path' &&
 cp '$input.extra_files_path'/* '$output.extra_files_path' &&
 cp '$input.extra_files_path'/Log '$output.extra_files_path'/second_log &&
diff --git a/test/functional/tools/composite_output_tests.xml b/test/functional/tools/composite_output_tests.xml
index 1ea58bb18828..39a702c8417a 100644
--- a/test/functional/tools/composite_output_tests.xml
+++ b/test/functional/tools/composite_output_tests.xml
@@ -3,7 +3,6 @@
   <command>
     mkdir '$output.files_path';
     mkdir '$output.files_path/output';
-    touch '$output';
     cp '$input.extra_files_path'/* '$output.files_path';
     echo "1 2 3" > '$output.files_path/md5out';
     echo "1" > '$output.extra_files_path/output/1';

From d6087e56cff2cfa4a6e274dcea44fdffa674c841 Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Tue, 21 May 2024 12:32:13 +0200
Subject: [PATCH 13/60] Do not show the Edit UI when error accessing the
 dataset

---
 .../components/DatasetInformation/DatasetAttributes.vue    | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/client/src/components/DatasetInformation/DatasetAttributes.vue b/client/src/components/DatasetInformation/DatasetAttributes.vue
index e197e126b6a9..eef869f1e405 100644
--- a/client/src/components/DatasetInformation/DatasetAttributes.vue
+++ b/client/src/components/DatasetInformation/DatasetAttributes.vue
@@ -5,7 +5,7 @@
             {{ messageText | l }}
         </b-alert>
         <DatasetAttributesProvider :id="datasetId" v-slot="{ result, loading }" @error="onError">
-            <div v-if="!loading" class="mt-3">
+            <div v-if="!loading && !hasError" class="mt-3">
                 <b-tabs>
                     <b-tab v-if="!result['attribute_disable']">
                         <template v-slot:title>
@@ -121,6 +121,11 @@ export default {
             formData: {},
         };
     },
+    computed: {
+        hasError() {
+            return this.messageVariant === "danger";
+        },
+    },
     methods: {
         onAttribute(data) {
             this.formData["attribute"] = data;

From 5bd9fed08e368daaa309ee54fc5ee1b5c8e8e4a0 Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Tue, 21 May 2024 13:14:40 +0200
Subject: [PATCH 14/60] Add client unit test for edit dataset error

---
 .../DatasetAttributes.test.js                 | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/client/src/components/DatasetInformation/DatasetAttributes.test.js b/client/src/components/DatasetInformation/DatasetAttributes.test.js
index 7862c91da571..4822815f3805 100644
--- a/client/src/components/DatasetInformation/DatasetAttributes.test.js
+++ b/client/src/components/DatasetInformation/DatasetAttributes.test.js
@@ -33,6 +33,31 @@ async function buildWrapper(conversion_disable = false) {
     return wrapper;
 }
 
+async function buildWrapperWithError(error) {
+    const wrapper = mount(DatasetAttributes, {
+        propsData: {
+            datasetId: "dataset_id",
+            messageText: error,
+            messageVariant: "danger",
+        },
+        computed: {
+            hasError() {
+                return true;
+            },
+        },
+        localVue,
+        stubs: {
+            DatasetAttributesProvider: MockProvider({
+                result: null,
+            }),
+            FontAwesomeIcon: false,
+            FormElement: false,
+        },
+    });
+    await flushPromises();
+    return wrapper;
+}
+
 describe("DatasetAttributes", () => {
     it("check rendering", async () => {
         const axiosMock = new MockAdapter(axios);
@@ -61,4 +86,15 @@ describe("DatasetAttributes", () => {
         expect(wrapper.findAll(".tab-pane").length).toBe(3);
         expect(wrapper.findAll(".ui-portlet-section").length).toBe(1);
     });
+
+    it("doesn't render edit controls with error", async () => {
+        const wrapper = await buildWrapperWithError("error");
+        expect(wrapper.findAll("button").length).toBe(0);
+        expect(wrapper.findAll("#attribute_text").length).toBe(0);
+        expect(wrapper.findAll("#conversion_text").length).toBe(0);
+        expect(wrapper.findAll("#datatype_text").length).toBe(0);
+        expect(wrapper.findAll("#permission_text").length).toBe(0);
+        expect(wrapper.findAll(".tab-pane").length).toBe(0);
+        expect(wrapper.findAll(".ui-portlet-section").length).toBe(0);
+    });
 });

From 2f83ef358603747798e11e174c379cc793fdb622 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Tue, 21 May 2024 14:14:23 +0200
Subject: [PATCH 15/60] Create empty file if datatype is auto_primary_file

---
 lib/galaxy/metadata/set_metadata.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/galaxy/metadata/set_metadata.py b/lib/galaxy/metadata/set_metadata.py
index 58b8a2f5a15f..221346b8b438 100644
--- a/lib/galaxy/metadata/set_metadata.py
+++ b/lib/galaxy/metadata/set_metadata.py
@@ -421,6 +421,9 @@ def set_meta(new_dataset_instance, file_dict):
                         dataset.dataset.created_from_basename = created_from_basename
                     elif os.path.exists(dataset_path_to_extra_path(external_filename)):
                         # Only output extra files dir, but no primary output file, that's fine
+                        if dataset.datatype.composite_type == "auto_primary_file":
+                            with open(external_filename, "wb"):
+                                pass
                         pass
                     else:
                         raise Exception(f"Output file '{external_filename}' not found")

From e80204e951a8a27b39b09ffb6c2a0119ed726f44 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Tue, 21 May 2024 14:17:57 +0200
Subject: [PATCH 16/60] Create empty primary file if we only have extra files
 dir

---
 lib/galaxy/metadata/set_metadata.py | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/lib/galaxy/metadata/set_metadata.py b/lib/galaxy/metadata/set_metadata.py
index 221346b8b438..237b106d3c7f 100644
--- a/lib/galaxy/metadata/set_metadata.py
+++ b/lib/galaxy/metadata/set_metadata.py
@@ -420,11 +420,12 @@ def set_meta(new_dataset_instance, file_dict):
                         )
                         dataset.dataset.created_from_basename = created_from_basename
                     elif os.path.exists(dataset_path_to_extra_path(external_filename)):
-                        # Only output extra files dir, but no primary output file, that's fine
-                        if dataset.datatype.composite_type == "auto_primary_file":
-                            with open(external_filename, "wb"):
-                                pass
-                        pass
+                        # Only output is extra files dir, but no primary output file, that's fine,
+                        # but make sure we create an empty primary output file. It's a little
+                        # weird to do this, but it does indicate that there's nothing wrong with the file,
+                        # as opposed to perhaps a storage issue.
+                        with open(external_filename, "wb"):
+                            pass
                     else:
                         raise Exception(f"Output file '{external_filename}' not found")
 

From 51fbc1896f30688bd27ea29b0f08b6cbd8976398 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Tue, 21 May 2024 14:43:45 +0200
Subject: [PATCH 17/60] Avoid object store path lookup when constructing
 JobState object

This eliminates the code path that failed in
https://github.com/galaxyproject/galaxy/issues/18189, and should
generally be a nice performance improvement.
---
 lib/galaxy/jobs/runners/__init__.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/galaxy/jobs/runners/__init__.py b/lib/galaxy/jobs/runners/__init__.py
index e87d7c1b0091..4c4cc848ed6e 100644
--- a/lib/galaxy/jobs/runners/__init__.py
+++ b/lib/galaxy/jobs/runners/__init__.py
@@ -678,14 +678,16 @@ def __init__(self, job_wrapper: "JobWrapper", job_destination: "JobDestination")
         self.job_wrapper = job_wrapper
         self.job_destination = job_destination
         self.runner_state = None
-        self.exit_code_file = default_exit_code_file(job_wrapper.working_directory, job_wrapper.get_id_tag())
-
         self.redact_email_in_job_name = True
         if self.job_wrapper:
             self.redact_email_in_job_name = self.job_wrapper.app.config.redact_email_in_job_name
 
         self.cleanup_file_attributes = ["job_file", "output_file", "error_file", "exit_code_file"]
 
+    @property
+    def exit_code_file(self) -> str:
+        return default_exit_code_file(self.job_wrapper.working_directory, self.job_wrapper.get_id_tag())
+
     def set_defaults(self, files_dir):
         if self.job_wrapper is not None:
             id_tag = self.job_wrapper.get_id_tag()

From 44c7bb1bdeefc5ef61fc73701203c78eb2208e1c Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Tue, 21 May 2024 16:38:48 +0200
Subject: [PATCH 18/60] Move exit_code_file to fix AsynchronousJobState

---
 lib/galaxy/jobs/runners/__init__.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/galaxy/jobs/runners/__init__.py b/lib/galaxy/jobs/runners/__init__.py
index 4c4cc848ed6e..58485fc955ec 100644
--- a/lib/galaxy/jobs/runners/__init__.py
+++ b/lib/galaxy/jobs/runners/__init__.py
@@ -679,6 +679,7 @@ def __init__(self, job_wrapper: "JobWrapper", job_destination: "JobDestination")
         self.job_destination = job_destination
         self.runner_state = None
         self.redact_email_in_job_name = True
+        self._exit_code_file = None
         if self.job_wrapper:
             self.redact_email_in_job_name = self.job_wrapper.app.config.redact_email_in_job_name
 
@@ -686,7 +687,9 @@ def __init__(self, job_wrapper: "JobWrapper", job_destination: "JobDestination")
 
     @property
     def exit_code_file(self) -> str:
-        return default_exit_code_file(self.job_wrapper.working_directory, self.job_wrapper.get_id_tag())
+        return self._exit_code_file or default_exit_code_file(
+            self.job_wrapper.working_directory, self.job_wrapper.get_id_tag()
+        )
 
     def set_defaults(self, files_dir):
         if self.job_wrapper is not None:
@@ -755,7 +758,7 @@ def __init__(
         self.output_file = output_file
         self.error_file = error_file
         if exit_code_file:
-            self.exit_code_file = exit_code_file
+            self._exit_code_file = exit_code_file
         self.job_name = job_name
 
         self.set_defaults(files_dir)

From c4b51c6dc467e6641d3ca65887ccb78efe9924f2 Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Tue, 21 May 2024 13:14:32 -0500
Subject: [PATCH 19/60] Replace `Multiselect` `selectLabel` with icons in
 `FormSelect`

Fixes https://github.com/galaxyproject/galaxy/issues/18150
---
 .../components/Form/Elements/FormSelect.vue   | 26 ++++++++++++-------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/client/src/components/Form/Elements/FormSelect.vue b/client/src/components/Form/Elements/FormSelect.vue
index 3b93539f0de6..15e9d7a00479 100644
--- a/client/src/components/Form/Elements/FormSelect.vue
+++ b/client/src/components/Form/Elements/FormSelect.vue
@@ -1,10 +1,15 @@
 <script setup lang="ts">
+import { library } from "@fortawesome/fontawesome-svg-core";
+import { faCheckSquare, faSquare } from "@fortawesome/free-regular-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
 import { computed, type ComputedRef, onMounted, type PropType, watch } from "vue";
 import Multiselect from "vue-multiselect";
 
 import { useMultiselect } from "@/composables/useMultiselect";
 import { uid } from "@/utils/utils";
 
+library.add(faCheckSquare, faSquare);
+
 const { ariaExpanded, onOpen, onClose } = useMultiselect();
 
 type SelectValue = Record<string, unknown> | string | number | null;
@@ -70,13 +75,6 @@ const reorderedOptions = computed(() => {
     }
 });
 
-/**
- * Configure deselect label
- */
-const deselectLabel: ComputedRef<string> = computed(() => {
-    return props.multiple ? "Click to remove" : "";
-});
-
 /**
  * Tracks if the select field has options
  */
@@ -163,16 +161,24 @@ onMounted(() => {
             :aria-expanded="ariaExpanded"
             :close-on-select="!multiple"
             :disabled="disabled"
-            :deselect-label="deselectLabel"
+            :deselect-label="null"
             label="label"
             :multiple="multiple"
             :options="reorderedOptions"
             :placeholder="placeholder"
             :selected-label="selectedLabel"
-            select-label="Click to select"
+            :select-label="null"
             track-by="value"
             @open="onOpen"
-            @close="onClose" />
+            @close="onClose">
+            <template v-slot:option="{ option }">
+                <div class="d-flex align-items-center justify-content-between">
+                    <span>{{ option.label }}</span>
+                    <FontAwesomeIcon v-if="selectedValues.includes(option.value)" :icon="faCheckSquare" />
+                    <FontAwesomeIcon v-else :icon="faSquare" />
+                </div>
+            </template>
+        </Multiselect>
         <slot v-else name="no-options">
             <b-alert v-localize class="w-100" variant="warning" show> No options available. </b-alert>
         </slot>

From 4e03914bccb2527e2677011283966ce1359c56eb Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Wed, 22 May 2024 11:49:27 +0200
Subject: [PATCH 20/60] Raise appropriate API exceptions in `history`
 controller

Instead of the legacy ones.
---
 lib/galaxy/webapps/galaxy/controllers/history.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/galaxy/webapps/galaxy/controllers/history.py b/lib/galaxy/webapps/galaxy/controllers/history.py
index fd3f1a036f20..4d81338d3b08 100644
--- a/lib/galaxy/webapps/galaxy/controllers/history.py
+++ b/lib/galaxy/webapps/galaxy/controllers/history.py
@@ -123,7 +123,7 @@ def display_by_username_and_slug(self, trans, username, slug, **kwargs):
             )
         )
 
-    @web.legacy_expose_api
+    @web.expose_api
     @web.require_login("changing default permissions")
     def permissions(self, trans, payload=None, **kwd):
         """
@@ -131,7 +131,7 @@ def permissions(self, trans, payload=None, **kwd):
         """
         history_id = kwd.get("id")
         if not history_id:
-            return self.message_exception(trans, f"Invalid history id ({str(history_id)}) received")
+            raise exceptions.RequestParameterMissingException("No history id received")
         history = self.history_manager.get_owned(self.decode_id(history_id), trans.user, current_history=trans.history)
         if trans.request.method == "GET":
             inputs = []
@@ -166,7 +166,7 @@ def permissions(self, trans, payload=None, **kwd):
             trans.app.security_agent.history_set_default_permissions(history, permissions)
             return {"message": "Default history '%s' dataset permissions have been changed." % history.name}
 
-    @web.legacy_expose_api
+    @web.expose_api
     @web.require_login("make datasets private")
     def make_private(self, trans, history_id=None, all_histories=False, **kwd):
         """
@@ -184,7 +184,7 @@ def make_private(self, trans, history_id=None, all_histories=False, **kwd):
             if history:
                 histories.append(history)
         if not histories:
-            return self.message_exception(trans, "Invalid history or histories specified.")
+            raise exceptions.RequestParameterMissingException("No history or histories specified.")
         private_role = trans.app.security_agent.get_private_user_role(trans.user)
         user_roles = trans.user.all_roles()
         private_permissions = {
@@ -256,12 +256,12 @@ def resume_paused_jobs(self, trans, current=False, ids=None, **kwargs):
         return trans.show_ok_message("Your jobs have been resumed.", refresh_frames=refresh_frames)
         # TODO: used in index.mako
 
-    @web.legacy_expose_api
+    @web.expose_api
     @web.require_login("rename histories")
     def rename(self, trans, payload=None, **kwd):
         id = kwd.get("id")
         if not id:
-            return self.message_exception(trans, "No history id received for renaming.")
+            raise exceptions.RequestParameterMissingException("No history id received for renaming.")
         user = trans.get_user()
         id = listify(id)
         histories = []

From 994be2f49aae86b362c91ea930f07b0a68f839ec Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Wed, 22 May 2024 11:59:00 +0200
Subject: [PATCH 21/60] Do not fail hard when one history fails to be made
 private

---
 .../webapps/galaxy/controllers/history.py     | 32 +++++++++++--------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/lib/galaxy/webapps/galaxy/controllers/history.py b/lib/galaxy/webapps/galaxy/controllers/history.py
index 4d81338d3b08..1511cde700a4 100644
--- a/lib/galaxy/webapps/galaxy/controllers/history.py
+++ b/lib/galaxy/webapps/galaxy/controllers/history.py
@@ -192,20 +192,24 @@ def make_private(self, trans, history_id=None, all_histories=False, **kwd):
             trans.app.security_agent.permitted_actions.DATASET_ACCESS: [private_role],
         }
         for history in histories:
-            self.history_manager.error_unless_mutable(history)
-            # Set default role for history to private
-            trans.app.security_agent.history_set_default_permissions(history, private_permissions)
-            # Set private role for all datasets
-            for hda in history.datasets:
-                if (
-                    not hda.dataset.library_associations
-                    and not trans.app.security_agent.dataset_is_private_to_user(trans, hda.dataset)
-                    and trans.app.security_agent.can_manage_dataset(user_roles, hda.dataset)
-                ):
-                    # If it's not private to me, and I can manage it, set fixed private permissions.
-                    trans.app.security_agent.set_all_dataset_permissions(hda.dataset, private_permissions)
-                    if not trans.app.security_agent.dataset_is_private_to_user(trans, hda.dataset):
-                        raise exceptions.InternalServerError("An error occurred and the dataset is NOT private.")
+            try:
+                self.history_manager.error_unless_mutable(history)
+                # Set default role for history to private
+                trans.app.security_agent.history_set_default_permissions(history, private_permissions)
+                # Set private role for all datasets
+                for hda in history.datasets:
+                    if (
+                        not hda.dataset.library_associations
+                        and not trans.app.security_agent.dataset_is_private_to_user(trans, hda.dataset)
+                        and trans.app.security_agent.can_manage_dataset(user_roles, hda.dataset)
+                    ):
+                        # If it's not private to me, and I can manage it, set fixed private permissions.
+                        trans.app.security_agent.set_all_dataset_permissions(hda.dataset, private_permissions)
+                        if not trans.app.security_agent.dataset_is_private_to_user(trans, hda.dataset):
+                            raise exceptions.InternalServerError("An error occurred and the dataset is NOT private.")
+            except Exception:
+                log.exception("Error making datasets private.")
+                continue
         return {
             "message": f"Success, requested permissions have been changed in {'all histories' if all_histories else history.name}."
         }

From f3c63541c6a3ccb97ecfefd034a14f9d00e274aa Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Wed, 22 May 2024 12:20:49 +0200
Subject: [PATCH 22/60] Allow to make private purged and archived histories

---
 client/src/components/User/UserPreferences.vue   | 2 +-
 lib/galaxy/webapps/galaxy/controllers/history.py | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/client/src/components/User/UserPreferences.vue b/client/src/components/User/UserPreferences.vue
index 0eb8a0c4d5e2..b186dac1092b 100644
--- a/client/src/components/User/UserPreferences.vue
+++ b/client/src/components/User/UserPreferences.vue
@@ -243,7 +243,7 @@ export default {
                     _l(
                         "WARNING: This will make all datasets (excluding library datasets) for which you have " +
                             "'management' permissions, in all of your histories " +
-                            "private, and will set permissions such that all " +
+                            "private (including archived and purged), and will set permissions such that all " +
                             "of your new data in these histories is created as private.  Any " +
                             "datasets within that are currently shared will need " +
                             "to be re-shared or published.  Are you sure you " +
diff --git a/lib/galaxy/webapps/galaxy/controllers/history.py b/lib/galaxy/webapps/galaxy/controllers/history.py
index 1511cde700a4..9d20adfed4c8 100644
--- a/lib/galaxy/webapps/galaxy/controllers/history.py
+++ b/lib/galaxy/webapps/galaxy/controllers/history.py
@@ -193,7 +193,6 @@ def make_private(self, trans, history_id=None, all_histories=False, **kwd):
         }
         for history in histories:
             try:
-                self.history_manager.error_unless_mutable(history)
                 # Set default role for history to private
                 trans.app.security_agent.history_set_default_permissions(history, private_permissions)
                 # Set private role for all datasets

From c1a8fd48950d077d4157c6aa4d8bdd94c91c9cb1 Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Wed, 22 May 2024 14:58:42 +0200
Subject: [PATCH 23/60] Drop redundant check after setting dataset permissions

---
 lib/galaxy/webapps/galaxy/controllers/history.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lib/galaxy/webapps/galaxy/controllers/history.py b/lib/galaxy/webapps/galaxy/controllers/history.py
index 9d20adfed4c8..2dbe94cb44ef 100644
--- a/lib/galaxy/webapps/galaxy/controllers/history.py
+++ b/lib/galaxy/webapps/galaxy/controllers/history.py
@@ -204,8 +204,6 @@ def make_private(self, trans, history_id=None, all_histories=False, **kwd):
                     ):
                         # If it's not private to me, and I can manage it, set fixed private permissions.
                         trans.app.security_agent.set_all_dataset_permissions(hda.dataset, private_permissions)
-                        if not trans.app.security_agent.dataset_is_private_to_user(trans, hda.dataset):
-                            raise exceptions.InternalServerError("An error occurred and the dataset is NOT private.")
             except Exception:
                 log.exception("Error making datasets private.")
                 continue

From bec8f0cd346b75cea999ec05e178667333490f59 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Wed, 22 May 2024 15:13:09 +0200
Subject: [PATCH 24/60] Add selenium test that fails because wrong dataset is
 submitted

---
 lib/galaxy_test/base/workflow_fixtures.py     | 40 +++++++++++++++++++
 lib/galaxy_test/selenium/test_workflow_run.py | 20 ++++++++++
 2 files changed, 60 insertions(+)

diff --git a/lib/galaxy_test/base/workflow_fixtures.py b/lib/galaxy_test/base/workflow_fixtures.py
index 912adecb32f9..ed96bb322cca 100644
--- a/lib/galaxy_test/base/workflow_fixtures.py
+++ b/lib/galaxy_test/base/workflow_fixtures.py
@@ -1177,3 +1177,43 @@
           format: txt
           location: https://raw.githubusercontent.com/galaxyproject/galaxy/dev/test-data/1.bed
 """
+
+WORKFLOW_WITH_DATA_TAG_FILTER = r"""{
+    "a_galaxy_workflow": "true",
+    "annotation": null,
+    "comments": [],
+    "format-version": "0.1",
+    "name": "Export WF4 Assembly HiC (imported from URL) (imported from uploaded file)",
+    "steps": {
+        "0": {
+            "annotation": "With dataset tag : genomescope_model ",
+            "content_id": null,
+            "errors": null,
+            "id": 0,
+            "input_connections": {},
+            "inputs": [
+                {
+                    "description": "With dataset tag : genomescope_model ",
+                    "name": "Genomescope Model"
+                }
+            ],
+            "label": "Genomescope Model",
+            "name": "Input dataset",
+            "outputs": [],
+            "position": {
+                "left": 0,
+                "top": 0
+            },
+            "tool_id": null,
+            "tool_state": "{\"optional\": false, \"format\": [\"txt\"], \"tag\": \"genomescope_model\"}",
+            "tool_version": null,
+            "type": "data_input",
+            "uuid": "a165c531-371f-4073-9cdd-85ce3506586f",
+            "when": null,
+            "workflow_outputs": []
+        }
+    },
+    "tags": [],
+    "uuid": "03a95ebe-af1e-4628-ac2f-e7553babfb2f",
+    "version": 3
+}"""
diff --git a/lib/galaxy_test/selenium/test_workflow_run.py b/lib/galaxy_test/selenium/test_workflow_run.py
index afb6085b98bf..4d0a6d9f1188 100644
--- a/lib/galaxy_test/selenium/test_workflow_run.py
+++ b/lib/galaxy_test/selenium/test_workflow_run.py
@@ -1,4 +1,5 @@
 import json
+from uuid import uuid4
 
 import yaml
 from selenium.webdriver.common.by import By
@@ -14,6 +15,7 @@
     WORKFLOW_SIMPLE_CAT_TWICE,
     WORKFLOW_WITH_CUSTOM_REPORT_1,
     WORKFLOW_WITH_CUSTOM_REPORT_1_TEST_DATA,
+    WORKFLOW_WITH_DATA_TAG_FILTER,
     WORKFLOW_WITH_DYNAMIC_OUTPUT_COLLECTION,
     WORKFLOW_WITH_OLD_TOOL_VERSION,
     WORKFLOW_WITH_RULES_1,
@@ -308,6 +310,24 @@ def test_workflow_run_button_disabled_when_required_input_missing(self):
         input_element.clear()
         workflow_run.run_workflow_disabled.wait_for_present()
 
+    @selenium_test
+    @managed_history
+    def test_workflow_run_tag_filter(self):
+        history_id = self.current_history_id()
+        dataset = self.dataset_populator.new_dataset(history_id, wait=True)
+        self.dataset_populator.tag_dataset(history_id, dataset["id"], tags=["genomescope_model"])
+        # Add another possible input that should not be selected
+        self.dataset_populator.new_dataset(history_id, wait=True)
+        wf = json.loads(WORKFLOW_WITH_DATA_TAG_FILTER)
+        wf["name"] = str(uuid4())
+        workflow_id = self.workflow_populator.create_workflow(wf)
+        self.workflow_run_with_name(wf["name"])
+        self.workflow_run_submit()
+        self.sleep_for(self.wait_types.HISTORY_POLL)
+        invocations = self.workflow_populator.workflow_invocations(workflow_id=workflow_id)
+        invocation = self.workflow_populator.get_invocation(invocations[-1]["id"])
+        assert invocation["inputs"]["0"]["id"] == dataset["id"]
+
     def _assert_has_3_lines_after_run(self, hid):
         self.workflow_run_wait_for_ok(hid=hid)
         history_id = self.current_history_id()

From d33b0d783c8e5b8cb1b9bb8ef2988fe4a0ad5cf5 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Wed, 22 May 2024 10:31:37 +0200
Subject: [PATCH 25/60] Fix Select value prop type

Can be string or array
---
 client/src/components/Form/Elements/FormSelect.vue | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/components/Form/Elements/FormSelect.vue b/client/src/components/Form/Elements/FormSelect.vue
index 3b93539f0de6..d442dfc2832d 100644
--- a/client/src/components/Form/Elements/FormSelect.vue
+++ b/client/src/components/Form/Elements/FormSelect.vue
@@ -37,7 +37,7 @@ const props = defineProps({
         default: "Select Value",
     },
     value: {
-        type: String as PropType<SelectValue | SelectValue[]>,
+        type: [String, Array] as PropType<SelectValue | SelectValue[]>,
         default: null,
     },
 });

From ab2086d5dd3067660af30af7fe98ec2199269c2a Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Wed, 22 May 2024 15:07:35 +0200
Subject: [PATCH 26/60] Also filter out matchedValues using tags

This now matched the filter in formattedOptions, so that upon first
rendering there's no discrepancy with currentValue.
---
 client/src/components/Form/Elements/FormData/FormData.vue | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/client/src/components/Form/Elements/FormData/FormData.vue b/client/src/components/Form/Elements/FormData/FormData.vue
index 2322b9b17ab8..123d24bb43b5 100644
--- a/client/src/components/Form/Elements/FormData/FormData.vue
+++ b/client/src/components/Form/Elements/FormData/FormData.vue
@@ -417,7 +417,10 @@ const matchedValues = computed(() => {
                 const options = props.options[entry.src] || [];
                 const option = options.find((v) => v.id === entry.id && v.src === entry.src);
                 if (option) {
-                    values.push({ ...option, name: option.name || entry.id });
+                    const accepted = !props.tag || option.tags?.includes(props.tag);
+                    if (accepted) {
+                        values.push({ ...option, name: option.name || entry.id });
+                    }
                 }
             }
         });
@@ -426,7 +429,7 @@ const matchedValues = computed(() => {
 });
 
 onMounted(() => {
-    if (props.value) {
+    if (props.value && matchedValues.value.length > 0) {
         $emit("input", createValue(matchedValues.value));
     } else {
         $emit("input", createValue(currentValue.value));

From ec2bd513747eadbb8b9c5bfba0e60847b977f9a3 Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Wed, 22 May 2024 15:22:46 +0200
Subject: [PATCH 27/60] Remove unnecessary catch all

---
 .../webapps/galaxy/controllers/history.py     | 26 ++++++++-----------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/lib/galaxy/webapps/galaxy/controllers/history.py b/lib/galaxy/webapps/galaxy/controllers/history.py
index 2dbe94cb44ef..5a7824fd3129 100644
--- a/lib/galaxy/webapps/galaxy/controllers/history.py
+++ b/lib/galaxy/webapps/galaxy/controllers/history.py
@@ -192,21 +192,17 @@ def make_private(self, trans, history_id=None, all_histories=False, **kwd):
             trans.app.security_agent.permitted_actions.DATASET_ACCESS: [private_role],
         }
         for history in histories:
-            try:
-                # Set default role for history to private
-                trans.app.security_agent.history_set_default_permissions(history, private_permissions)
-                # Set private role for all datasets
-                for hda in history.datasets:
-                    if (
-                        not hda.dataset.library_associations
-                        and not trans.app.security_agent.dataset_is_private_to_user(trans, hda.dataset)
-                        and trans.app.security_agent.can_manage_dataset(user_roles, hda.dataset)
-                    ):
-                        # If it's not private to me, and I can manage it, set fixed private permissions.
-                        trans.app.security_agent.set_all_dataset_permissions(hda.dataset, private_permissions)
-            except Exception:
-                log.exception("Error making datasets private.")
-                continue
+            # Set default role for history to private
+            trans.app.security_agent.history_set_default_permissions(history, private_permissions)
+            # Set private role for all datasets
+            for hda in history.datasets:
+                if (
+                    not hda.dataset.library_associations
+                    and not trans.app.security_agent.dataset_is_private_to_user(trans, hda.dataset)
+                    and trans.app.security_agent.can_manage_dataset(user_roles, hda.dataset)
+                ):
+                    # If it's not private to me, and I can manage it, set fixed private permissions.
+                    trans.app.security_agent.set_all_dataset_permissions(hda.dataset, private_permissions)
         return {
             "message": f"Success, requested permissions have been changed in {'all histories' if all_histories else history.name}."
         }

From 659c2fa3e1bb05ec5d85c99ee374c695ff7586aa Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Wed, 22 May 2024 12:24:23 -0500
Subject: [PATCH 28/60] fix jests since each option is in a `div` instead of a
 `span`

---
 client/src/components/Form/Elements/FormSelect.test.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/components/Form/Elements/FormSelect.test.js b/client/src/components/Form/Elements/FormSelect.test.js
index 1854a23698ac..580c72ea34e1 100644
--- a/client/src/components/Form/Elements/FormSelect.test.js
+++ b/client/src/components/Form/Elements/FormSelect.test.js
@@ -25,7 +25,7 @@ const defaultOptions = [
 
 function testDefaultOptions(wrapper) {
     const target = wrapper.findComponent(MountTarget);
-    const options = target.findAll("li > span > span");
+    const options = target.findAll("li > span > div");
     expect(options.length).toBe(4);
     for (let i = 0; i < options.length; i++) {
         expect(options.at(i).text()).toBe(`label_${i + 1}`);
@@ -52,7 +52,7 @@ describe("FormSelect", () => {
             optional: true,
         });
         const target = wrapper.findComponent(MountTarget);
-        const options = target.findAll("li > span > span");
+        const options = target.findAll("li > span > div");
         expect(options.length).toBe(5);
         expect(options.at(0).text()).toBe("Nothing selected");
         const selectedDefault = wrapper.find(".multiselect__option--selected");

From d0e460cb406fe9ca5eab699ec3dad56324281997 Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Tue, 21 May 2024 10:22:49 -0500
Subject: [PATCH 29/60] [24.0] Prevent anonymous users from running workflows

Fixes https://github.com/galaxyproject/galaxy/issues/18147
---
 lib/galaxy/webapps/galaxy/services/workflows.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/galaxy/webapps/galaxy/services/workflows.py b/lib/galaxy/webapps/galaxy/services/workflows.py
index 52e35d96c8fe..3cce4e906c6e 100644
--- a/lib/galaxy/webapps/galaxy/services/workflows.py
+++ b/lib/galaxy/webapps/galaxy/services/workflows.py
@@ -124,6 +124,8 @@ def invoke_workflow(
         workflow_id,
         payload: InvokeWorkflowPayload,
     ) -> Union[WorkflowInvocationResponse, List[WorkflowInvocationResponse]]:
+        if trans.anonymous:
+            raise exceptions.AuthenticationRequired("You need to be logged in to run workflows.")
         # Get workflow + accessibility check.
         by_stored_id = not payload.instance
         stored_workflow = self._workflows_manager.get_stored_accessible_workflow(trans, workflow_id, by_stored_id)

From f516679399a423724265796bd1c102e23a754b45 Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Wed, 22 May 2024 13:46:38 -0500
Subject: [PATCH 30/60] add api test for running workflow as anon user

---
 lib/galaxy_test/api/test_workflows.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/galaxy_test/api/test_workflows.py b/lib/galaxy_test/api/test_workflows.py
index 36549c820015..852f9bc806a2 100644
--- a/lib/galaxy_test/api/test_workflows.py
+++ b/lib/galaxy_test/api/test_workflows.py
@@ -5444,6 +5444,14 @@ def test_cannot_run_against_other_users_history(self):
         run_workflow_response = self._post(f"workflows/{workflow_id}/invocations", data=workflow_request, json=True)
         self._assert_status_code_is(run_workflow_response, 403)
 
+    def test_cannot_run_workflow_as_anon(self):
+        workflow = self.workflow_populator.load_workflow(name="test_for_run_anon_user")
+        workflow_request, _, workflow_id = self._setup_workflow_run(workflow)
+        with self._different_user(anon=True):
+            run_workflow_response = self._post(f"workflows/{workflow_id}/invocations", data=workflow_request, json=True)
+            self._assert_status_code_is(run_workflow_response, 403)
+            self._assert_error_code_is(run_workflow_response, error_codes.error_codes_by_name["USER_NO_API_KEY"])
+
     def test_cannot_run_bootstrap_admin_workflow(self):
         workflow = self.workflow_populator.load_workflow(name="test_bootstrap_admin_cannot_run")
         workflow_request, *_ = self._setup_workflow_run(workflow)

From 04e77ef1347b954d8aa7db87fc929ad4ffca41c4 Mon Sep 17 00:00:00 2001
From: John Davis <jdavcs@gmail.com>
Date: Wed, 22 May 2024 14:57:53 -0400
Subject: [PATCH 31/60] Remove legacy ref to sqlalchemy migrate

---
 scripts/manage_db.py | 23 +++--------------------
 1 file changed, 3 insertions(+), 20 deletions(-)

diff --git a/scripts/manage_db.py b/scripts/manage_db.py
index ef180096f9d5..b359cf85c79b 100644
--- a/scripts/manage_db.py
+++ b/scripts/manage_db.py
@@ -16,12 +16,10 @@
 
 
 def run():
-    """
-    If the target database is 'tool_shed', delegate to sqlalchemy migrate.
-    Otherwise, handle with Alembic.
-    """
     if sys.argv[-1] == "tool_shed":
-        _run_sqlalchemy_migrate_on_toolshed()
+        raise Exception(
+            "Please use the `manage_toolshed_db.sh` script (or `scripts/toolshed_db.py` if running Ansible)."
+        )
     else:
         arg = _get_command_argument()
         lmdb = LegacyManageDb()
@@ -46,20 +44,5 @@ def _get_command_argument():
         raise Exception("Invalid command argument; should be: 'version', 'db_version', or 'upgrade'")
 
 
-def _run_sqlalchemy_migrate_on_toolshed():
-    # This is the only case when we use SQLAlchemy Migrate.
-    # This intentionally duplicates the code in `migrate_toolshed_db.py`.
-    # The dependency on `migrate` should be removed prior to the move to SQLAlchemy 2.0.
-    from migrate.versioning.shell import main
-
-    from galaxy.model.orm.scripts import get_config
-
-    config = get_config(sys.argv, use_argparse=False, cwd=os.getcwd())
-    db_url = config["db_url"]
-    repo = config["repo"]
-
-    main(repository=repo, url=db_url)
-
-
 if __name__ == "__main__":
     run()

From 09a91e0749c49158e267f507425dee9f7a027f93 Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Wed, 22 May 2024 15:06:15 -0500
Subject: [PATCH 32/60] [24.0] Add `GenericItem` error handling

`GenericItem` was missing a `onError` function. Now, it catches backend errors and displays a `Toast` message for any failed operation.
Fixes https://github.com/galaxyproject/galaxy/issues/18176
---
 .../History/Content/GenericItem.vue           | 39 +++++++++++++++----
 1 file changed, 31 insertions(+), 8 deletions(-)

diff --git a/client/src/components/History/Content/GenericItem.vue b/client/src/components/History/Content/GenericItem.vue
index d852539f2d15..0669ee3f866d 100644
--- a/client/src/components/History/Content/GenericItem.vue
+++ b/client/src/components/History/Content/GenericItem.vue
@@ -25,12 +25,14 @@
 
 <script>
 import LoadingSpan from "components/LoadingSpan";
+import { Toast } from "composables/toast";
 import { mapActions } from "pinia";
 
 import { deleteContent, updateContentFields } from "@/components/History/model/queries";
 import { DatasetCollectionProvider, DatasetProvider } from "@/components/providers";
 import { DatasetCollectionElementProvider } from "@/components/providers/storeProviders";
 import { useHistoryStore } from "@/stores/historyStore";
+import { errorMessageAsString } from "@/utils/simple-error";
 
 import ContentItem from "./ContentItem";
 import GenericElement from "./GenericElement";
@@ -76,17 +78,38 @@ export default {
     },
     methods: {
         ...mapActions(useHistoryStore, ["applyFilters"]),
-        onDelete(item, recursive = false) {
-            deleteContent(item, { recursive: recursive });
+        async onDelete(item, recursive = false) {
+            try {
+                await deleteContent(item, { recursive: recursive });
+            } catch (error) {
+                this.onError(error);
+            }
         },
-        onUndelete(item) {
-            updateContentFields(item, { deleted: false });
+        onError(e) {
+            const error = errorMessageAsString(e, "Dataset operation failed.");
+            Toast.error(error);
+            console.error(error);
         },
-        onHide(item) {
-            updateContentFields(item, { visible: false });
+        async onUndelete(item) {
+            try {
+                await updateContentFields(item, { deleted: false });
+            } catch (error) {
+                this.onError(error);
+            }
         },
-        onUnhide(item) {
-            updateContentFields(item, { visible: true });
+        async onHide(item) {
+            try {
+                await updateContentFields(item, { visible: false });
+            } catch (error) {
+                this.onError(error);
+            }
+        },
+        async onUnhide(item) {
+            try {
+                await updateContentFields(item, { visible: true });
+            } catch (error) {
+                this.onError(error);
+            }
         },
         async onHighlight(item) {
             const { history_id } = item;

From ccec683fb5c79b37d98c6d38173de6fbc8ada1d6 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Thu, 23 May 2024 10:18:39 +0200
Subject: [PATCH 33/60] Add string cast for dbkey / genome_build

pydantic v1 would automatically apply the string casting.
I've verified that we raise RequestParameterInvlalid for new requests.
---
 lib/galaxy/managers/datasets.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/galaxy/managers/datasets.py b/lib/galaxy/managers/datasets.py
index 612a69989deb..1bbe86ee7021 100644
--- a/lib/galaxy/managers/datasets.py
+++ b/lib/galaxy/managers/datasets.py
@@ -640,7 +640,8 @@ def add_serializers(self):
             # 'extended_metadata': self.serialize_extended_metadata,
             # 'extended_metadata_id': self.serialize_id,
             # remapped
-            "genome_build": lambda item, key, **context: item.dbkey,
+            # TODO: Replace string cast with https://github.com/pydantic/pydantic/pull/9137 on 24.1
+            "genome_build": lambda item, key, **context: str(item.dbkey) if item.dbkey is not None else None,
             # derived (not mapped) attributes
             "data_type": lambda item, key, **context: f"{item.datatype.__class__.__module__}.{item.datatype.__class__.__name__}",
             "converted": self.serialize_converted_datasets,

From 6d930fdebd6be0f41da38c460a51f8cfca3f0279 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Thu, 23 May 2024 10:47:03 +0200
Subject: [PATCH 34/60] Include stack when reporting delete error

---
 lib/galaxy/objectstore/__init__.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/galaxy/objectstore/__init__.py b/lib/galaxy/objectstore/__init__.py
index 5d7596be6036..6b25071ccad3 100644
--- a/lib/galaxy/objectstore/__init__.py
+++ b/lib/galaxy/objectstore/__init__.py
@@ -849,7 +849,9 @@ def _delete(self, obj, entire_dir=False, **kwargs):
             # Absolutely possible that a delete request races, but that's "fine".
             return True
         except OSError as ex:
-            log.critical(f"{self.__get_filename(obj, **kwargs)} delete error {ex}")
+            # Likely a race condition in which we delete the job working directory
+            # and another process writes files into that directory.
+            log.critical(f"{self.__get_filename(obj, **kwargs)} delete error {ex}", exc_info=True)
         return False
 
     def _get_data(self, obj, start=0, count=-1, **kwargs):

From 8fcc151f6fcf535bb9d1e5d4870c4868badf5cac Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Thu, 23 May 2024 13:15:01 +0200
Subject: [PATCH 35/60] Limit templated visualization data, fix PCA plot for
 tabular datasets

---
 .../PCA_3Dplot/templates/PCA_3Dplot.mako      | 20 +++++++++++++------
 .../ts_visjs/templates/ts_visjs.mako          | 15 ++++++++++++--
 2 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/config/plugins/visualizations/PCA_3Dplot/templates/PCA_3Dplot.mako b/config/plugins/visualizations/PCA_3Dplot/templates/PCA_3Dplot.mako
index b85d9645932a..f36e0ea10fce 100644
--- a/config/plugins/visualizations/PCA_3Dplot/templates/PCA_3Dplot.mako
+++ b/config/plugins/visualizations/PCA_3Dplot/templates/PCA_3Dplot.mako
@@ -1,7 +1,11 @@
 <%!
+import csv
 import sys
 from io import StringIO
-import csv
+
+from galaxy.exceptions import RequestParameterInvalidException
+
+MAX_SIZE = 100000  # 100 KB, empirically the largest value I can render on my browser (m2 mac, chrome)
 %>
 
 <%
@@ -29,11 +33,15 @@ def create_options(header):
     return colour_options, start_options
 
 def load_data():
-    input = "\n".join(list(hda.datatype.dataprovider(hda, 'line', comment_char=none, provide_blank=True, strip_lines=False, strip_newlines=True)))
-    tabular_file = StringIO(input)
-    dialect = csv.Sniffer().sniff(tabular_file.read(1024), delimiters=";,\t")
-    tabular_file.seek(0)
-    table = csv.reader(tabular_file, dialect)
+    lines = []
+    size = 0
+    for line in hda.datatype.dataprovider(hda, 'line', comment_char=none, provide_blank=True, strip_lines=False, strip_newlines=True):
+        size += len(line)
+        if size > MAX_SIZE:
+            raise RequestParameterInvalidException("Dataset too large to render, dataset must be less than 100 KB in size.")
+        lines.append(line)
+    dialect = csv.Sniffer().sniff("\n".join(lines))
+    table = csv.reader(lines, dialect)
     data = "["
     for i, row in enumerate(table):
         if i == 0:
diff --git a/config/plugins/visualizations/ts_visjs/templates/ts_visjs.mako b/config/plugins/visualizations/ts_visjs/templates/ts_visjs.mako
index 7504667c5347..e96868683401 100644
--- a/config/plugins/visualizations/ts_visjs/templates/ts_visjs.mako
+++ b/config/plugins/visualizations/ts_visjs/templates/ts_visjs.mako
@@ -3,6 +3,10 @@ import collections
 import json
 import sys
 from numpy import inf
+
+from galaxy.exceptions import RequestParameterInvalidException
+
+MAX_SIZE = 100000  # 100 KB
 %>
 
 <%
@@ -58,8 +62,15 @@ def write_reaction(edge_id, left_index, right_index, substrates, products, rate,
 def load_data():
     output = {"nodes": "", "border_nodes": "", "edges": "", "edges": "", "self_loops": ""}
 
-    data = ''.join(list(hda.datatype.dataprovider(hda, 'line', strip_lines=True, strip_newlines=True)))
-    data = json.loads(data)
+    lines = []
+    size = 0
+
+    for line in hda.datatype.dataprovider(hda, 'line', strip_lines=True, strip_newlines=True):
+        size += len(line)
+        if size > MAX_SIZE:
+            raise RequestParameterInvalidException("Dataset too large to render, dataset must be less than 100 KB in size.")
+        lines.append(line)
+    data = json.loads("".join(lines))
 
     ordering = data['ordering']
     nodes = {int(key): to_counter(data['nodes'][key], ordering) for key in data['nodes'].keys()}

From 15fa3a43f787cfa1f752d9ee7da45a88c2ec5af0 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Thu, 23 May 2024 13:15:26 +0200
Subject: [PATCH 36/60] Fix display of error messages in visualizations

---
 lib/galaxy/webapps/galaxy/controllers/visualization.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/galaxy/webapps/galaxy/controllers/visualization.py b/lib/galaxy/webapps/galaxy/controllers/visualization.py
index 157cfde250d2..b70fc5ad6f85 100644
--- a/lib/galaxy/webapps/galaxy/controllers/visualization.py
+++ b/lib/galaxy/webapps/galaxy/controllers/visualization.py
@@ -242,7 +242,7 @@ def render(self, trans, visualization_name, embedded=None, **kwargs):
         try:
             return plugin.render(trans=trans, embedded=embedded, **kwargs)
         except Exception as exception:
-            self._handle_plugin_error(trans, visualization_name, exception)
+            return self._handle_plugin_error(trans, visualization_name, exception)
 
     def _get_plugin_from_registry(self, trans, visualization_name):
         """

From 4c4ed106a473addb38b0c42ae168ef4299bd3ca0 Mon Sep 17 00:00:00 2001
From: Nicola Soranzo <nicola.soranzo@earlham.ac.uk>
Date: Tue, 21 May 2024 12:40:22 +0100
Subject: [PATCH 37/60] Use job permissions instead of token

---
 .github/workflows/labels-verifier.yaml | 3 ++-
 .github/workflows/maintenance_bot.yaml | 9 ++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/labels-verifier.yaml b/.github/workflows/labels-verifier.yaml
index 484040885dd8..415942a371d1 100644
--- a/.github/workflows/labels-verifier.yaml
+++ b/.github/workflows/labels-verifier.yaml
@@ -5,6 +5,8 @@ on:
 jobs:
   onMerged:
     name: "Check Labels on merge"
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Check Labels on merge
@@ -15,7 +17,6 @@ jobs:
           ! contains(github.event.pull_request.labels.*.name, 'minor')
         uses: actions/github-script@v6
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             github.rest.issues.createComment({
               owner: context.repo.owner,
diff --git a/.github/workflows/maintenance_bot.yaml b/.github/workflows/maintenance_bot.yaml
index d307e97d5ac7..3ff2d86d6f86 100644
--- a/.github/workflows/maintenance_bot.yaml
+++ b/.github/workflows/maintenance_bot.yaml
@@ -6,6 +6,9 @@ jobs:
   labeler:
     name: Assign labels and milestone
     if: github.repository_owner == 'galaxyproject'
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     env:
       MILESTONE_NUMBER: 27
@@ -14,7 +17,6 @@ jobs:
         id: get_pr_labels
         uses: actions/github-script@v6
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             const response = await github.rest.issues.listLabelsOnIssue({
               owner: context.repo.owner,
@@ -25,9 +27,7 @@ jobs:
             return response.data;
       - name: Add area labels
         if: ${{ ! contains(join(fromJSON(steps.get_pr_labels.outputs.result).*.name, ', '), 'area/') }}
-        uses: actions/labeler@v4
-        with:
-          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+        uses: actions/labeler@v5
       - name: Assign milestone
         if: |
           ! github.event.pull_request.milestone &&
@@ -37,7 +37,6 @@ jobs:
           ! github.event.pull_request.draft
         uses: actions/github-script@v6
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             github.rest.issues.update({
               owner: context.repo.owner,

From de2d36afe2eaad48474e139b82d9f09d221d515f Mon Sep 17 00:00:00 2001
From: Nicola Soranzo <nicola.soranzo@earlham.ac.uk>
Date: Tue, 21 May 2024 12:45:57 +0100
Subject: [PATCH 38/60] Update versions of GitHub actions

---
 .github/workflows/api.yaml                    | 12 ++--
 .github/workflows/build_client.yaml           |  6 +-
 .github/workflows/build_container_image.yaml  |  2 +-
 .github/workflows/check_test_class_names.yaml |  6 +-
 .github/workflows/codeql-analysis.yml         | 56 +++++++++----------
 .github/workflows/converter_tests.yaml        | 12 ++--
 .github/workflows/cwl_conformance.yaml        | 12 ++--
 .github/workflows/db_indexes.yaml             |  8 +--
 .github/workflows/dependencies.yaml           |  6 +-
 .github/workflows/deployment.yaml             | 13 ++---
 .github/workflows/docs.yaml                   |  6 +-
 .github/workflows/first_startup.yaml          | 12 ++--
 .github/workflows/framework.yaml              | 12 ++--
 .github/workflows/integration.yaml            | 12 ++--
 .github/workflows/integration_selenium.yaml   | 16 +++---
 .github/workflows/jest.yaml                   |  4 +-
 .github/workflows/js_lint.yaml                |  4 +-
 .github/workflows/labels-verifier.yaml        |  2 +-
 .github/workflows/lint.yaml                   | 10 ++--
 .github/workflows/lint_openapi_schema.yml     |  8 +--
 .github/workflows/maintenance_bot.yaml        |  4 +-
 .github/workflows/mulled.yaml                 | 10 ++--
 .github/workflows/osx_startup.yaml            | 10 ++--
 .github/workflows/performance.yaml            | 18 +++---
 .github/workflows/publish_artifacts.yaml      |  4 +-
 .github/workflows/reports_startup.yaml        | 10 ++--
 .github/workflows/selenium.yaml               | 16 +++---
 .github/workflows/test_galaxy_packages.yaml   |  8 +--
 .../test_galaxy_packages_for_pulsar.yaml      |  6 +-
 .github/workflows/test_galaxy_release.yaml    |  2 +-
 .github/workflows/toolshed.yaml               | 12 ++--
 .github/workflows/unit-postgres.yaml          | 10 ++--
 .github/workflows/unit.yaml                   | 12 ++--
 33 files changed, 170 insertions(+), 171 deletions(-)

diff --git a/.github/workflows/api.yaml b/.github/workflows/api.yaml
index 753f669f148f..ea717e7edccb 100644
--- a/.github/workflows/api.yaml
+++ b/.github/workflows/api.yaml
@@ -44,15 +44,15 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -60,12 +60,12 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache galaxy venv
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-api
@@ -76,7 +76,7 @@ jobs:
         with:
           flags: api
           working-directory: 'galaxy root'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: API test results (${{ matrix.python-version }}, ${{ matrix.chunk }})
diff --git a/.github/workflows/build_client.yaml b/.github/workflows/build_client.yaml
index 59e2192dc354..6156b565f939 100644
--- a/.github/workflows/build_client.yaml
+++ b/.github/workflows/build_client.yaml
@@ -11,10 +11,10 @@ jobs:
     outputs:
       commit-id: ${{ steps.client-commit.outputs.commit }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
@@ -25,7 +25,7 @@ jobs:
         run: echo "commit=$(git rev-parse HEAD 2>/dev/null)" >> $GITHUB_OUTPUT
         working-directory: 'galaxy root'
       - name: cache client build
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         id: cache
         with:
           key: galaxy-static-${{ steps.client-commit.outputs.commit }}
diff --git a/.github/workflows/build_container_image.yaml b/.github/workflows/build_container_image.yaml
index 1820e34cb4a3..53a4a285a73d 100644
--- a/.github/workflows/build_container_image.yaml
+++ b/.github/workflows/build_container_image.yaml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'galaxyproject'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       # https://stackoverflow.com/questions/59810838/how-to-get-the-short-sha-for-the-github-workflow
       - name: Set outputs
         id: commit
diff --git a/.github/workflows/check_test_class_names.yaml b/.github/workflows/check_test_class_names.yaml
index 217995df93e4..1d73f57af374 100644
--- a/.github/workflows/check_test_class_names.yaml
+++ b/.github/workflows/check_test_class_names.yaml
@@ -13,12 +13,12 @@ jobs:
       matrix:
         python-version: ['3.8']
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('requirements.txt') }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 2ddfee5bad8c..1d2d551b0192 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -32,41 +32,41 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ['javascript', 'python']
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        language: ['javascript-typescript', 'python']
+        # CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
         # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
 
-        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
+          # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+          # queries: security-extended,security-and-quality
 
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
 
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
 
-    #   If the Autobuild fails above, remove it and uncomment the following three lines
-    #   modify them (or add more) to build your code if your project
-    #   uses a compiled language
+      #   If the Autobuild fails above, remove it and uncomment the following three lines
+      #   modify them (or add more) to build your code if your project
+      #   uses a compiled language
 
-    #- run: |
-    #   make bootstrap
-    #   make release
+      #- run: |
+      #   make bootstrap
+      #   make release
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/converter_tests.yaml b/.github/workflows/converter_tests.yaml
index 1d8c0ee963b8..23848f81c014 100644
--- a/.github/workflows/converter_tests.yaml
+++ b/.github/workflows/converter_tests.yaml
@@ -28,24 +28,24 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
       - name: Clone galaxyproject/galaxy-test-data
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           repository: galaxyproject/galaxy-test-data
           path: galaxy-test-data
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Cache venv dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         id: pip-cache
         with:
           path: ~/.cache/pip
@@ -69,7 +69,7 @@ jobs:
         run: |
           mapfile -t TOOL_ARRAY < tool_list.txt
           planemo test --biocontainers --galaxy_python_version ${{ matrix.python-version }} --galaxy_root 'galaxy root' "${TOOL_ARRAY[@]}"
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: Converter test results (${{ matrix.python-version }})
diff --git a/.github/workflows/cwl_conformance.yaml b/.github/workflows/cwl_conformance.yaml
index 206bd33798a1..f9ac963071ac 100644
--- a/.github/workflows/cwl_conformance.yaml
+++ b/.github/workflows/cwl_conformance.yaml
@@ -35,15 +35,15 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -51,12 +51,12 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache galaxy venv
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}
@@ -67,7 +67,7 @@ jobs:
         with:
           flags: cwl-conformance
           working-directory: 'galaxy root'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: CWL conformance test results (${{ matrix.python-version }}, ${{ matrix.marker }}, ${{ matrix.conformance-version }})
diff --git a/.github/workflows/db_indexes.yaml b/.github/workflows/db_indexes.yaml
index 88f1d02297af..cc5ec407b5d4 100644
--- a/.github/workflows/db_indexes.yaml
+++ b/.github/workflows/db_indexes.yaml
@@ -39,10 +39,10 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -50,13 +50,13 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         id: pip-cache
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache tox env
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .tox
           key: tox-cache-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-check-indexes
diff --git a/.github/workflows/dependencies.yaml b/.github/workflows/dependencies.yaml
index 12f2a0919a89..56530f565278 100644
--- a/.github/workflows/dependencies.yaml
+++ b/.github/workflows/dependencies.yaml
@@ -12,8 +12,8 @@ jobs:
       matrix:
         python-version: ['3.8']
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Update dependencies
@@ -21,7 +21,7 @@ jobs:
           python -m venv .venv
           make update-dependencies
       - name: Create pull request
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@v6
         with:
           author: galaxybot <galaxybot@users.noreply.github.com>
           token: ${{ secrets.GALAXYBOT_PAT }}
diff --git a/.github/workflows/deployment.yaml b/.github/workflows/deployment.yaml
index 082e93d9328d..6e6506e9fdf8 100644
--- a/.github/workflows/deployment.yaml
+++ b/.github/workflows/deployment.yaml
@@ -35,19 +35,18 @@ jobs:
       matrix:
         python-version: ['3.8']
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.branch }}
           fetch-depth: 0
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('requirements.txt') }}
-      - uses: nanasess/setup-chromedriver@v1
+      - uses: nanasess/setup-chromedriver@v2
       - name: Run tests
         run: bash ./test/deployment/usegalaxystar.bash
         env:
@@ -64,8 +63,8 @@ jobs:
           GALAXY_TEST_USEGALAXYEU_USER_PASSWORD: ${{ secrets.USEGALAXYEU_USER_PASSWORD }}
           GALAXY_TEST_USEGALAXYEU_USER_KEY: ${{ secrets.USEGALAXYEU_USER_KEY }}
           GALAXY_TEST_TIMEOUT_MULTIPLIER: 10
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: Deployment test results (${{ inputs.target }}, ${{ inputs.type }})
+          name: Deployment test results (${{ inputs.target }}, ${{ inputs.type }}, ${{ inputs.debug }}, ${{ matrix.python-version }})
           path: 'deployment_tests.html'
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index fb72e3853e64..77a01f531907 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -26,14 +26,14 @@ jobs:
         run: echo "TARGET_BRANCH=$GITHUB_BASE_REF" >> $GITHUB_ENV
       - name: Show target branch name
         run: echo $TARGET_BRANCH
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('requirements.txt') }}
diff --git a/.github/workflows/first_startup.yaml b/.github/workflows/first_startup.yaml
index 732388cc1ff2..bc487ab9ec32 100644
--- a/.github/workflows/first_startup.yaml
+++ b/.github/workflows/first_startup.yaml
@@ -28,16 +28,16 @@ jobs:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -45,18 +45,18 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         id: pip-cache
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache tox env
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .tox
           key: tox-cache-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-first-startup
       - name: Restore client cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
           path: 'galaxy root/static'
diff --git a/.github/workflows/framework.yaml b/.github/workflows/framework.yaml
index 53a287c5d7c0..dcc5e7614b15 100644
--- a/.github/workflows/framework.yaml
+++ b/.github/workflows/framework.yaml
@@ -40,15 +40,15 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -56,12 +56,12 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache galaxy venv
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-framework
@@ -72,7 +72,7 @@ jobs:
         with:
           flags: framework
           working-directory: 'galaxy root'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: Framework test results (${{ matrix.python-version }})
diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml
index e90a4ea836b2..0a3b14434449 100644
--- a/.github/workflows/integration.yaml
+++ b/.github/workflows/integration.yaml
@@ -68,15 +68,15 @@ jobs:
       - name: Check pods
         run: |
           kubectl get pods
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -84,13 +84,13 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         id: pip-cache
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache galaxy venv
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-integration
@@ -105,7 +105,7 @@ jobs:
         with:
           flags: integration
           working-directory: 'galaxy root'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: Integration test results (${{ matrix.python-version }}, ${{ matrix.chunk }})
diff --git a/.github/workflows/integration_selenium.yaml b/.github/workflows/integration_selenium.yaml
index d294d91f9902..414446b5d827 100644
--- a/.github/workflows/integration_selenium.yaml
+++ b/.github/workflows/integration_selenium.yaml
@@ -48,10 +48,10 @@ jobs:
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
       - name: Prune unused docker image, volumes and containers
         run: docker system prune -a -f
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -59,22 +59,22 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache galaxy venv
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-integration-selenium
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
       - name: Restore client cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
           path: 'galaxy root/static'
@@ -85,12 +85,12 @@ jobs:
         with:
           flags: integration-selenium
           working-directory: 'galaxy root'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: Integration Selenium test results (${{ matrix.python-version }})
           path: 'galaxy root/run_integration_tests.html'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: Integration Selenium debug info (${{ matrix.python-version }})
diff --git a/.github/workflows/jest.yaml b/.github/workflows/jest.yaml
index 97be31032156..0d69a1498299 100644
--- a/.github/workflows/jest.yaml
+++ b/.github/workflows/jest.yaml
@@ -18,9 +18,9 @@ jobs:
       matrix:
         node: [18]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node}}
           cache: 'yarn'
diff --git a/.github/workflows/js_lint.yaml b/.github/workflows/js_lint.yaml
index 90b818e8b68b..ea821e1c105b 100644
--- a/.github/workflows/js_lint.yaml
+++ b/.github/workflows/js_lint.yaml
@@ -18,9 +18,9 @@ jobs:
       matrix:
         node: [18]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node}}
           cache: 'yarn'
diff --git a/.github/workflows/labels-verifier.yaml b/.github/workflows/labels-verifier.yaml
index 415942a371d1..61dee02ee73e 100644
--- a/.github/workflows/labels-verifier.yaml
+++ b/.github/workflows/labels-verifier.yaml
@@ -15,7 +15,7 @@ jobs:
           ! contains(join(github.event.pull_request.labels.*.name, ', '), 'kind/') &&
           ! contains(github.event.pull_request.labels.*.name, 'merge') &&
           ! contains(github.event.pull_request.labels.*.name, 'minor')
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         with:
           script: |
             github.rest.issues.createComment({
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 3174f6ceb5d7..fc03fde8c3a9 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -28,8 +28,8 @@ jobs:
       TYPE_PATH: 'lib/galaxy/dependencies/pinned-typecheck-requirements.txt'
       CORE_PATH: 'lib/galaxy/dependencies/pinned-requirements.txt'
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -37,12 +37,12 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles(env.LINT_PATH, env.TYPE_PATH, env.CORE_PATH) }}
       - name: Cache tox env
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .tox
           key: tox-cache-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles(env.LINT_PATH, env.TYPE_PATH, env.CORE_PATH) }}-lint
@@ -55,4 +55,4 @@ jobs:
       - name: Run mypy checks
         run: tox -e mypy
       - uses: psf/black@stable
-      - uses: isort/isort-action@master
+      - uses: isort/isort-action@v1
diff --git a/.github/workflows/lint_openapi_schema.yml b/.github/workflows/lint_openapi_schema.yml
index 780b584f3b05..464d1cef825f 100644
--- a/.github/workflows/lint_openapi_schema.yml
+++ b/.github/workflows/lint_openapi_schema.yml
@@ -22,10 +22,10 @@ jobs:
       matrix:
         python-version: ['3.8', '3.12']
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -33,12 +33,12 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache galaxy venv
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-api
diff --git a/.github/workflows/maintenance_bot.yaml b/.github/workflows/maintenance_bot.yaml
index 3ff2d86d6f86..b1f5cac1db20 100644
--- a/.github/workflows/maintenance_bot.yaml
+++ b/.github/workflows/maintenance_bot.yaml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Get latest pull request labels
         id: get_pr_labels
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         with:
           script: |
             const response = await github.rest.issues.listLabelsOnIssue({
@@ -35,7 +35,7 @@ jobs:
           ! contains(github.event.pull_request.labels.*.name, 'status/WIP') &&
           ! contains(github.event.pull_request.title, 'WIP') &&
           ! github.event.pull_request.draft
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         with:
           script: |
             github.rest.issues.update({
diff --git a/.github/workflows/mulled.yaml b/.github/workflows/mulled.yaml
index 1b140eb1f6c3..4d33cc3febd7 100644
--- a/.github/workflows/mulled.yaml
+++ b/.github/workflows/mulled.yaml
@@ -22,10 +22,10 @@ jobs:
       matrix:
         python-version: ['3.8']
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -33,12 +33,12 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache tox env
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .tox
           key: tox-cache-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-mulled
@@ -49,7 +49,7 @@ jobs:
       - name: Run tests
         run: tox -e mulled
         working-directory: 'galaxy root'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: Mulled unit test results (${{ matrix.python-version }})
diff --git a/.github/workflows/osx_startup.yaml b/.github/workflows/osx_startup.yaml
index 5c0ffbe2b534..0a3050cbcb6b 100644
--- a/.github/workflows/osx_startup.yaml
+++ b/.github/workflows/osx_startup.yaml
@@ -26,10 +26,10 @@ jobs:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
@@ -39,13 +39,13 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         id: pip-cache
         with:
           path: ~/Library/Caches/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache tox env
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .tox
           key: tox-cache-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-osx
@@ -54,7 +54,7 @@ jobs:
         with:
           activate-environment: ''
       - name: Restore client cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
           path: 'galaxy root/static'
diff --git a/.github/workflows/performance.yaml b/.github/workflows/performance.yaml
index 48287a739f8c..45413a608f19 100644
--- a/.github/workflows/performance.yaml
+++ b/.github/workflows/performance.yaml
@@ -39,15 +39,15 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -55,24 +55,24 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache galaxy venv
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-performance
       - name: Run tests
         run: ./run_tests.sh --ci_test_metrics --structured_data_html --structured_data_report_file "test.json" --skip_flakey_fails -api lib/galaxy_test/performance
         working-directory: 'galaxy root'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
-          name: API test results
+          name: API test results (${{ matrix.python-version }})
           path: 'galaxy root/run_api_tests.html'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: Performance Metrics
+          name: Performance Metrics (${{ matrix.python-version }})
           path: 'galaxy root/test.html'
diff --git a/.github/workflows/publish_artifacts.yaml b/.github/workflows/publish_artifacts.yaml
index 3703d932c0cc..dded5d1086eb 100644
--- a/.github/workflows/publish_artifacts.yaml
+++ b/.github/workflows/publish_artifacts.yaml
@@ -11,10 +11,10 @@ jobs:
         matrix:
             python-version: ['3.8']
     steps:
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Install script dependencies
         run: pip install galaxy-release-util
       - name: Build and publish
diff --git a/.github/workflows/reports_startup.yaml b/.github/workflows/reports_startup.yaml
index 397e78442a4a..d2a730549837 100644
--- a/.github/workflows/reports_startup.yaml
+++ b/.github/workflows/reports_startup.yaml
@@ -23,16 +23,16 @@ jobs:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -40,13 +40,13 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         id: pip-cache
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache galaxy venv
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-reports-startup
diff --git a/.github/workflows/selenium.yaml b/.github/workflows/selenium.yaml
index 2d2d30ee56d6..3c3d9126cbb5 100644
--- a/.github/workflows/selenium.yaml
+++ b/.github/workflows/selenium.yaml
@@ -48,15 +48,15 @@ jobs:
         run: |
           echo "GALAXY_CONFIG_OVERRIDE_METADATA_STRATEGY=extended" >> $GITHUB_ENV
           echo "GALAXY_CONFIG_OVERRIDE_OUTPUTS_TO_WORKING_DIRECTORY=true" >> $GITHUB_ENV
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -64,17 +64,17 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache galaxy venv
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-selenium
       - name: Restore client cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           key: galaxy-static-${{ needs.build-client.outputs.commit-id }}
           path: 'galaxy root/static'
@@ -85,12 +85,12 @@ jobs:
         with:
           flags: selenium
           working-directory: 'galaxy root'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: Selenium test results (${{ matrix.python-version }}, ${{ matrix.chunk }})
           path: 'galaxy root/run_selenium_tests.html'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: Selenium debug info (${{ matrix.python-version }}, ${{ matrix.chunk }})
diff --git a/.github/workflows/test_galaxy_packages.yaml b/.github/workflows/test_galaxy_packages.yaml
index 51f871b3fe38..da5e092118dc 100644
--- a/.github/workflows/test_galaxy_packages.yaml
+++ b/.github/workflows/test_galaxy_packages.yaml
@@ -20,19 +20,19 @@ jobs:
       matrix:
         python-version: ['3.8', '3.12']
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
diff --git a/.github/workflows/test_galaxy_packages_for_pulsar.yaml b/.github/workflows/test_galaxy_packages_for_pulsar.yaml
index 2a8e39cadbce..3ce8c2f3bece 100644
--- a/.github/workflows/test_galaxy_packages_for_pulsar.yaml
+++ b/.github/workflows/test_galaxy_packages_for_pulsar.yaml
@@ -22,14 +22,14 @@ jobs:
       matrix:
         python-version: ['3.7']  # don't upgrade, see https://github.com/galaxyproject/galaxy/pull/16649
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
diff --git a/.github/workflows/test_galaxy_release.yaml b/.github/workflows/test_galaxy_release.yaml
index 722399a1cb1f..6e39d98adc8e 100644
--- a/.github/workflows/test_galaxy_release.yaml
+++ b/.github/workflows/test_galaxy_release.yaml
@@ -22,7 +22,7 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Run tests
diff --git a/.github/workflows/toolshed.yaml b/.github/workflows/toolshed.yaml
index 5552bc4f3900..df121215d9f1 100644
--- a/.github/workflows/toolshed.yaml
+++ b/.github/workflows/toolshed.yaml
@@ -34,15 +34,15 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -50,13 +50,13 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         id: pip-cache
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache galaxy venv
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-toolshed
@@ -82,7 +82,7 @@ jobs:
           TOOL_SHED_API_VERSION: ${{ matrix.shed-api }}
           TOOL_SHED_TEST_BROWSER: ${{ matrix.shed-api == 'v1' && 'twill' || 'playwright' }}
         working-directory: 'galaxy root'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: Toolshed test results (${{ matrix.python-version }}, ${{ matrix.shed-api }}, ${{ matrix.test-install-client }})
diff --git a/.github/workflows/unit-postgres.yaml b/.github/workflows/unit-postgres.yaml
index f2c57b6228d4..dbb9b21587c7 100644
--- a/.github/workflows/unit-postgres.yaml
+++ b/.github/workflows/unit-postgres.yaml
@@ -33,15 +33,15 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
           cache-dependency-path: 'galaxy root/client/yarn.lock'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Get full Python version
@@ -49,12 +49,12 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache galaxy venv
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: 'galaxy root/.venv'
           key: gxy-venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-unit-postgres
diff --git a/.github/workflows/unit.yaml b/.github/workflows/unit.yaml
index af5f7810a894..33b2857ddeee 100644
--- a/.github/workflows/unit.yaml
+++ b/.github/workflows/unit.yaml
@@ -22,13 +22,13 @@ jobs:
       matrix:
         python-version: ['3.8', '3.12']
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           path: 'galaxy root'
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.12.1'
           cache: 'yarn'
@@ -38,12 +38,12 @@ jobs:
         shell: bash
         run: echo "version=$(python -c 'import sys; print("-".join(str(v) for v in sys.version_info))')" >> $GITHUB_OUTPUT
       - name: Cache pip dir
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pip
           key: pip-cache-${{ matrix.python-version }}-${{ hashFiles('galaxy root/requirements.txt') }}
       - name: Cache tox env
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: .tox
           key: tox-cache-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('galaxy root/requirements.txt') }}-unit
@@ -58,7 +58,7 @@ jobs:
         with:
           flags: py-unit
           working-directory: 'galaxy root'
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: Unit test results (${{ matrix.python-version }})

From b19136073ed35868d4f0e9da63d519020df4cb57 Mon Sep 17 00:00:00 2001
From: Nicola Soranzo <nicola.soranzo@earlham.ac.uk>
Date: Tue, 21 May 2024 16:47:03 +0100
Subject: [PATCH 39/60] Use official minikube GitHub action

Cannot used the new default driver (`docker`) as it crashes the
PostgreSQL Docker container started via job services.
---
 .github/workflows/integration.yaml | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml
index 0a3b14434449..0dc78ef4bb1c 100644
--- a/.github/workflows/integration.yaml
+++ b/.github/workflows/integration.yaml
@@ -59,15 +59,12 @@ jobs:
         # ffmpeg: ffprobe needed by media datatypes
         run: sudo apt-get update && sudo apt-get -y install conntrack ffmpeg
       - name: Setup Minikube
-        id: minikube
-        uses: CodingNagger/minikube-setup-action@v1.0.6
+        uses: medyagh/setup-minikube@latest
         with:
-          k8s-version: '1.23.0'
-      - name: Launch Minikube
-        run: eval ${{ steps.minikube.outputs.launcher }}
+          driver: none
+          kubernetes-version: '1.23.0'
       - name: Check pods
-        run: |
-          kubectl get pods
+        run: kubectl get pods -A
       - uses: actions/checkout@v4
         with:
           path: 'galaxy root'

From 028630afcbc6bf9976ce2c23fe0827c262be5a98 Mon Sep 17 00:00:00 2001
From: Nicola Soranzo <nicola.soranzo@earlham.ac.uk>
Date: Wed, 22 May 2024 10:25:06 +0100
Subject: [PATCH 40/60] Update syntax for labeler action v5

See https://github.com/marketplace/actions/labeler#breaking-changes-in-v5
---
 .github/labeler.yml | 146 ++++++++++++++++++++++++++++++--------------
 1 file changed, 101 insertions(+), 45 deletions(-)

diff --git a/.github/labeler.yml b/.github/labeler.yml
index fc5c7eb38d11..898b95abbdf9 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -1,73 +1,129 @@
 ---
 area/admin:
-  - client/src/components/admin/**/*
-  - doc/source/admin/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - client/src/components/admin/**/*
+      - doc/source/admin/**/*
 area/API:
-  - lib/galaxy/webapps/galaxy/api/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/webapps/galaxy/api/**/*
 area/auth:
-  - lib/galaxy/auth/**/*
-  - lib/galaxy/authnz/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/auth/**/*
+      - lib/galaxy/authnz/**/*
 area/client:
-  - client/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - client/*
 area/database:
-  - lib/galaxy/model/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/model/**/*
 area/datatypes:
-  - lib/galaxy/datatypes/**/*
-  - lib/galaxy/config/sample/datatypes_conf.xml.sample
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/datatypes/**/*
+      - lib/galaxy/config/sample/datatypes_conf.xml.sample
 area/dependencies:
-  - lib/galaxy/dependencies/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/dependencies/**/*
 area/documentation:
-  - doc/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - doc/**/*
 area/jobs:
-  - lib/galaxy/jobs/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/jobs/**/*
 area/libraries:
-  - client/src/components/LibraryFolder/**/*
-  - lib/galaxy/webapps/galaxy/api/libraries.py
+  - changed-files:
+    - any-glob-to-any-file:
+      - client/src/components/LibraryFolder/**/*
+      - lib/galaxy/webapps/galaxy/api/libraries.py
 area/objectstore:
-  - lib/galaxy/objectstore/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/objectstore/**/*
 area/packaging:
-  - packages/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - packages/**/*
 area/reports:
-  - client/src/reports/**/*
-  - lib/galaxy/webapps/reports/**/*
-  - templates/webapps/reports/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - client/src/reports/**/*
+      - lib/galaxy/webapps/reports/**/*
+      - templates/webapps/reports/**/*
 area/scripts:
-  - scripts/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - scripts/**/*
 area/security:
-  - lib/galaxy/security/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/security/**/*
 area/testing:
-  - lib/galaxy_test/**/*
-  - run_tests.sh
-  - test/**/*
-  - test-data/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy_test/**/*
+      - run_tests.sh
+      - test/**/*
+      - test-data/**/*
 area/testing/api:
-  - lib/galaxy_test/api/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy_test/api/**/*
 area/testing/integration:
-  - test/integration/**/*
-  - test/integration_selenium/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - test/integration/**/*
+      - test/integration_selenium/**/*
 area/testing/selenium:
-  - lib/galaxy/selenium/**/*
-  - lib/galaxy_test/selenium/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/selenium/**/*
+      - lib/galaxy_test/selenium/**/*
 area/tool-dependencies:
-  - lib/galaxy/tool_util/deps/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/tool_util/deps/**/*
 area/tool-framework:
-  - lib/galaxy/tools/**/*
-  - lib/galaxy/tool_util/**/*
-  - lib/galaxy/webapps/galaxy/api/tools.py
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/tools/**/*
+      - lib/galaxy/tool_util/**/*
+      - lib/galaxy/webapps/galaxy/api/tools.py
 area/tools:
-  - tools/**/*
-  - tool-data/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - tools/**/*
+      - tool-data/**/*
 area/toolshed:
-  - client/src/toolshed/**/*
-  - lib/galaxy/webapps/galaxy/api/toolshed.py
-  - lib/toolshed/**/*
-  - templates/webapps/tool_shed/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - client/src/toolshed/**/*
+      - lib/galaxy/webapps/galaxy/api/toolshed.py
+      - lib/toolshed/**/*
+      - templates/webapps/tool_shed/**/*
 area/UI-UX:
-  - all: ["client/src/**/*", "!client/src/api/schema/schema.ts"]
-    any: ["templates/**/*"]
+  - changed-files:
+    - any-glob-to-any-file:
+      - client/src/**/*
+      - templates/**/*
+    - all-globs-to-all-files:
+      - '!client/src/api/schema/schema.ts'
 area/util:
-  - lib/galaxy/util/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/util/**/*
 area/visualizations:
-  - config/plugins/visualizations/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - config/plugins/visualizations/**/*
 area/workflows:
-  - lib/galaxy/workflow/**/*
+  - changed-files:
+    - any-glob-to-any-file:
+      - lib/galaxy/workflow/**/*

From 9b70b7582dc7f39987663683d9594fb7adb0e289 Mon Sep 17 00:00:00 2001
From: Nicola Soranzo <nicola.soranzo@earlham.ac.uk>
Date: Wed, 22 May 2024 15:36:01 +0100
Subject: [PATCH 41/60] Exclude bcsl.ts test files from CodeQL code scanning

Fix errors like:

```
lib/galaxy/datatypes/test/test_file3.bcsl.ts#L2C12:12: A parse error
occurred: `';' expected.`. Check the syntax of the file. If the file
is invalid, correct the error or
[exclude](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning)
the file from analysis.
```

seen in https://github.com/galaxyproject/galaxy/actions/runs/9170180020/job/25211944475 .
---
 .github/codeql/codeql-config.yml      | 2 ++
 .github/workflows/codeql-analysis.yml | 3 +++
 2 files changed, 5 insertions(+)
 create mode 100644 .github/codeql/codeql-config.yml

diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 000000000000..3cf65b36a7c5
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,2 @@
+paths-ignore:
+  - 'lib/galaxy/datatypes/test/*.bcsl.ts'
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 1d2d551b0192..a4cb056311a5 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -52,6 +52,9 @@ jobs:
           # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
           # queries: security-extended,security-and-quality
 
+          config-file: ./.github/codeql/codeql-config.yml
+
+
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild

From 1e94915c98bf1bf3af1d14dd357eec619c7839b2 Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Thu, 23 May 2024 10:34:59 -0500
Subject: [PATCH 42/60] add titles to `Toast`s for `GenericItem`

---
 .../src/components/History/Content/GenericItem.vue | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/client/src/components/History/Content/GenericItem.vue b/client/src/components/History/Content/GenericItem.vue
index 0669ee3f866d..5ba543ea0b89 100644
--- a/client/src/components/History/Content/GenericItem.vue
+++ b/client/src/components/History/Content/GenericItem.vue
@@ -82,33 +82,33 @@ export default {
             try {
                 await deleteContent(item, { recursive: recursive });
             } catch (error) {
-                this.onError(error);
+                this.onError(error, "Failed to delete item");
             }
         },
-        onError(e) {
+        onError(e, title = "Error") {
             const error = errorMessageAsString(e, "Dataset operation failed.");
-            Toast.error(error);
+            Toast.error(error, title);
             console.error(error);
         },
         async onUndelete(item) {
             try {
                 await updateContentFields(item, { deleted: false });
             } catch (error) {
-                this.onError(error);
+                this.onError(error, "Failed to undelete item");
             }
         },
         async onHide(item) {
             try {
                 await updateContentFields(item, { visible: false });
             } catch (error) {
-                this.onError(error);
+                this.onError(error, "Failed to hide item");
             }
         },
         async onUnhide(item) {
             try {
                 await updateContentFields(item, { visible: true });
             } catch (error) {
-                this.onError(error);
+                this.onError(error, "Failed to unhide item");
             }
         },
         async onHighlight(item) {
@@ -121,7 +121,7 @@ export default {
             try {
                 await this.applyFilters(history_id, filters);
             } catch (error) {
-                this.onError(error);
+                this.onError(error, "Failed to highlight related items");
             }
         },
     },

From cef091bcd129fbb06a0f9e1272c2d1cd9f3ff8f3 Mon Sep 17 00:00:00 2001
From: Ahmed Hamid Awan <qe66653@umbc.edu>
Date: Thu, 23 May 2024 11:00:37 -0500
Subject: [PATCH 43/60] Update
 client/src/components/History/Content/GenericItem.vue

Co-authored-by: Marius van den Beek <m.vandenbeek@gmail.com>
---
 client/src/components/History/Content/GenericItem.vue | 1 -
 1 file changed, 1 deletion(-)

diff --git a/client/src/components/History/Content/GenericItem.vue b/client/src/components/History/Content/GenericItem.vue
index 5ba543ea0b89..4a899b495416 100644
--- a/client/src/components/History/Content/GenericItem.vue
+++ b/client/src/components/History/Content/GenericItem.vue
@@ -88,7 +88,6 @@ export default {
         onError(e, title = "Error") {
             const error = errorMessageAsString(e, "Dataset operation failed.");
             Toast.error(error, title);
-            console.error(error);
         },
         async onUndelete(item) {
             try {

From 538570b3e23401206d21535363ece619357b08fd Mon Sep 17 00:00:00 2001
From: Ahmed Hamid Awan <qe66653@umbc.edu>
Date: Thu, 23 May 2024 11:05:41 -0500
Subject: [PATCH 44/60] Update lib/galaxy/webapps/galaxy/services/workflows.py

Co-authored-by: Nicola Soranzo <nicola.soranzo@gmail.com>
---
 lib/galaxy/webapps/galaxy/services/workflows.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/galaxy/webapps/galaxy/services/workflows.py b/lib/galaxy/webapps/galaxy/services/workflows.py
index 3cce4e906c6e..15f99996fb49 100644
--- a/lib/galaxy/webapps/galaxy/services/workflows.py
+++ b/lib/galaxy/webapps/galaxy/services/workflows.py
@@ -126,6 +126,7 @@ def invoke_workflow(
     ) -> Union[WorkflowInvocationResponse, List[WorkflowInvocationResponse]]:
         if trans.anonymous:
             raise exceptions.AuthenticationRequired("You need to be logged in to run workflows.")
+        trans.check_user_activation()
         # Get workflow + accessibility check.
         by_stored_id = not payload.instance
         stored_workflow = self._workflows_manager.get_stored_accessible_workflow(trans, workflow_id, by_stored_id)

From 59803e968ea64b875d51ed498dc10928932c5e9a Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Thu, 23 May 2024 18:45:06 +0200
Subject: [PATCH 45/60] Check dataset state when attempting to acces dataset
 contents

---
 lib/galaxy/managers/datasets.py               | 19 +++++++++++++++++++
 .../webapps/galaxy/services/datasets.py       | 17 +++++++++++++++--
 lib/galaxy_test/api/test_datasets.py          | 11 +++++++++++
 3 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/lib/galaxy/managers/datasets.py b/lib/galaxy/managers/datasets.py
index 612a69989deb..23e73953f25c 100644
--- a/lib/galaxy/managers/datasets.py
+++ b/lib/galaxy/managers/datasets.py
@@ -488,6 +488,25 @@ def serialize_dataset_association_roles(self, trans, dataset_assoc):
             rval["modify_item_roles"] = modify_item_role_list
         return rval
 
+    def ensure_dataset_on_disk(self, trans, dataset):
+        # Not a guarantee data is really present, but excludes a lot of expected cases
+        if dataset.purged or dataset.dataset.purged:
+            raise exceptions.ItemDeletionException("The dataset you are attempting to view has been purged.")
+        elif dataset.deleted and not (trans.user_is_admin or self.is_owner(dataset, trans.get_user())):
+            raise exceptions.ItemDeletionException("The dataset you are attempting to view has been deleted.")
+        elif dataset.state == Dataset.states.UPLOAD:
+            raise exceptions.Conflict("Please wait until this dataset finishes uploading before attempting to view it.")
+        elif dataset.state == Dataset.states.DISCARDED:
+            raise exceptions.ItemDeletionException("The dataset you are attempting to view has been discarded.")
+        elif dataset.state == Dataset.states.DEFERRED:
+            raise exceptions.Conflict(
+                "The dataset you are attempting to view has deferred data. You can only use this dataset as input for jobs."
+            )
+        elif dataset.state == Dataset.states.PAUSED:
+            raise exceptions.Conflict(
+                "The dataset you are attempting to view is in paused state. One of the inputs for the job that creates this dataset has failed."
+            )
+
     def ensure_can_change_datatype(self, dataset: model.DatasetInstance, raiseException: bool = True) -> bool:
         if not dataset.datatype.is_datatype_change_allowed():
             if not raiseException:
diff --git a/lib/galaxy/webapps/galaxy/services/datasets.py b/lib/galaxy/webapps/galaxy/services/datasets.py
index fc67929c3c24..87d4da9c537a 100644
--- a/lib/galaxy/webapps/galaxy/services/datasets.py
+++ b/lib/galaxy/webapps/galaxy/services/datasets.py
@@ -364,7 +364,17 @@ def show(
         """
         Displays information about and/or content of a dataset.
         """
-        dataset = self.dataset_manager_by_type[hda_ldda].get_accessible(dataset_id, trans.user)
+        dataset_manager = self.dataset_manager_by_type[hda_ldda]
+        dataset = dataset_manager.get_accessible(dataset_id, trans.user)
+        requests_that_require_data = (
+            RequestDataType.converted_datasets_state,
+            RequestDataType.data,
+            RequestDataType.features,
+            RequestDataType.raw_data,
+            RequestDataType.track_config,
+        )
+        if data_type in requests_that_require_data:
+            dataset_manager.ensure_dataset_on_disk(trans, dataset)
 
         # Use data type to return particular type of data.
         rval: Any
@@ -606,7 +616,9 @@ def display(
         headers = {}
         rval: Any = ""
         try:
-            dataset_instance = self.dataset_manager_by_type[hda_ldda].get_accessible(dataset_id, trans.user)
+            dataset_manager = self.dataset_manager_by_type[hda_ldda]
+            dataset_instance = dataset_manager.get_accessible(dataset_id, trans.user)
+            dataset_manager.ensure_dataset_on_disk(trans, dataset_instance)
             if raw:
                 if filename and filename != "index":
                     object_store = trans.app.object_store
@@ -668,6 +680,7 @@ def get_metadata_file(
         TODO: Remove the `open_file` parameter when removing the associated legacy endpoint.
         """
         hda = self.hda_manager.get_accessible(history_content_id, trans.user)
+        self.hda_manager.ensure_dataset_on_disk(trans, hda)
         file_ext = hda.metadata.spec.get(metadata_file).get("file_ext", metadata_file)
         fname = "".join(c in util.FILENAME_VALID_CHARS and c or "_" for c in hda.name)[0:150]
         headers = {}
diff --git a/lib/galaxy_test/api/test_datasets.py b/lib/galaxy_test/api/test_datasets.py
index 3c8c9daf3420..9705d2d2b577 100644
--- a/lib/galaxy_test/api/test_datasets.py
+++ b/lib/galaxy_test/api/test_datasets.py
@@ -343,6 +343,17 @@ def test_display(self, history_id):
         self._assert_status_code_is(display_response, 200)
         assert display_response.text == contents
 
+    def test_display_error_handling(self, history_id):
+        hda1 = self.dataset_populator.create_deferred_hda(
+            history_id, "https://raw.githubusercontent.com/galaxyproject/galaxy/dev/test-data/1.bed"
+        )
+        display_response = self._get(f"histories/{history_id}/contents/{hda1['id']}/display", {"raw": "True"})
+        self._assert_status_code_is(display_response, 409)
+        assert (
+            display_response.json()["err_msg"]
+            == "The dataset you are attempting to view has deferred data. You can only use this dataset as input for jobs."
+        )
+
     def test_get_content_as_text(self, history_id):
         contents = textwrap.dedent(
             """\

From a047ea086196e8bb0a6ef98ccf77ba8d71cc01c0 Mon Sep 17 00:00:00 2001
From: John Davis <jdavcs@gmail.com>
Date: Thu, 23 May 2024 14:34:10 -0400
Subject: [PATCH 46/60] Use config_section to distinguish between galaxy and ts
 or other apps

---
 lib/galaxy/util/properties.py                    | 2 +-
 lib/tool_shed/webapp/model/migrations/scripts.py | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/galaxy/util/properties.py b/lib/galaxy/util/properties.py
index d020b34d1691..7cf3b8710a75 100644
--- a/lib/galaxy/util/properties.py
+++ b/lib/galaxy/util/properties.py
@@ -100,7 +100,7 @@ def load_app_properties(
 ):
     if config_file is None:
         config_file = ini_file
-        config_section = ini_section
+        config_section = config_section or ini_section
 
     # read from file or init w/no file
     if config_file:
diff --git a/lib/tool_shed/webapp/model/migrations/scripts.py b/lib/tool_shed/webapp/model/migrations/scripts.py
index 7bd280001063..fc92de362e94 100644
--- a/lib/tool_shed/webapp/model/migrations/scripts.py
+++ b/lib/tool_shed/webapp/model/migrations/scripts.py
@@ -28,7 +28,9 @@ def get_dburl_from_file(cwd: str, config_file: Optional[str] = None) -> str:
         cwds = [cwd, os.path.join(cwd, CONFIG_DIR_NAME)]
         config_file = find_config_file(DEFAULT_CONFIG_NAMES, dirs=cwds)
 
-    properties = load_app_properties(config_file=config_file, config_prefix=TOOLSHED_CONFIG_PREFIX)
+    properties = load_app_properties(
+        config_file=config_file, config_prefix=TOOLSHED_CONFIG_PREFIX, config_section="tool_shed"
+    )
     default_url = f"sqlite:///{os.path.join(get_data_dir(properties), 'community.sqlite')}?isolation_level=IMMEDIATE"
     url = properties.get("database_connection", default_url)
     return url

From 4e47b8de13934961d237c5ffcfa2b05f5eab7d5f Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Thu, 23 May 2024 23:10:58 +0200
Subject: [PATCH 47/60] Restrict job_files access to jobs that are not terminal

That should fix https://sentry.galaxyproject.org/share/issue/c4eb157823c240d5a664ec6517354db2/
---
 lib/galaxy/webapps/galaxy/api/job_files.py  | 2 +-
 lib/galaxy/webapps/galaxy/api/job_tokens.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/galaxy/webapps/galaxy/api/job_files.py b/lib/galaxy/webapps/galaxy/api/job_files.py
index df2edf2415cb..9abc3363a017 100644
--- a/lib/galaxy/webapps/galaxy/api/job_files.py
+++ b/lib/galaxy/webapps/galaxy/api/job_files.py
@@ -182,7 +182,7 @@ def __authorize_job_access(self, trans, encoded_job_id, **kwargs):
 
         # Verify job is active. Don't update the contents of complete jobs.
         job = trans.sa_session.get(Job, job_id)
-        if job.finished:
+        if job.state not in Job.non_ready_states:
             error_message = "Attempting to read or modify the files of a job that has already completed."
             raise exceptions.ItemAccessibilityException(error_message)
         return job
diff --git a/lib/galaxy/webapps/galaxy/api/job_tokens.py b/lib/galaxy/webapps/galaxy/api/job_tokens.py
index 8853f33d62bd..5cc5e6e9b4a5 100644
--- a/lib/galaxy/webapps/galaxy/api/job_tokens.py
+++ b/lib/galaxy/webapps/galaxy/api/job_tokens.py
@@ -64,7 +64,7 @@ def __authorize_job_access(self, trans, encoded_job_id, job_key):
 
         # Verify job is active
         job = session.get(Job, job_id)
-        if job.finished:
+        if job.state not in Job.non_ready_states:
             error_message = "Attempting to get oidc token for a job that has already completed."
             raise exceptions.ItemAccessibilityException(error_message)
         return job

From 7961b475bbd80ceb8bdd615b1e6eb0c67a9ff2a1 Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Fri, 24 May 2024 10:47:32 +0200
Subject: [PATCH 48/60] Fix bool const OpenAPI TS schema conversion

---
 client/openapi_to_schema.mjs    | 14 +++++++++-----
 client/src/api/schema/schema.ts |  2 +-
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/client/openapi_to_schema.mjs b/client/openapi_to_schema.mjs
index eb6e22a290cc..d85b349f096d 100644
--- a/client/openapi_to_schema.mjs
+++ b/client/openapi_to_schema.mjs
@@ -7,11 +7,15 @@ const inputFilePath = process.argv[2];
 const localPath = new URL(inputFilePath, import.meta.url);
 openapiTS(localPath, {
     transform(schemaObject, metadata) {
-        if (
-            "const" in schemaObject &&
-            (typeof schemaObject.const === "string" || schemaObject.const instanceof String)
-        ) {
-            return `"${schemaObject.const}"`;
+        if ("const" in schemaObject) {
+            const constType = typeof schemaObject.const;
+            switch (constType) {
+                case "number":
+                case "boolean":
+                    return `${schemaObject.const}`;
+                default:
+                    return `"${schemaObject.const}"`;
+            }
         }
     },
 }).then((output) => console.log(output));
diff --git a/client/src/api/schema/schema.ts b/client/src/api/schema/schema.ts
index 13de4b70d8e5..d48a58025dad 100644
--- a/client/src/api/schema/schema.ts
+++ b/client/src/api/schema/schema.ts
@@ -6006,7 +6006,7 @@ export interface components {
              * Accessible
              * @constant
              */
-            accessible: Record<string, never>;
+            accessible: false;
             /** Copied From Ldda Id */
             copied_from_ldda_id?: string | null;
             /**

From afac2afa24664e19a751e7c59ea697de1566d13b Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Fri, 24 May 2024 10:50:08 +0200
Subject: [PATCH 49/60] Serialize accessible field for collection elements

---
 client/src/api/schema/schema.ts                           | 2 ++
 lib/galaxy/schema/schema.py                               | 1 +
 lib/galaxy/webapps/galaxy/services/dataset_collections.py | 5 +++++
 3 files changed, 8 insertions(+)

diff --git a/client/src/api/schema/schema.ts b/client/src/api/schema/schema.ts
index d48a58025dad..36a71aa1d4e1 100644
--- a/client/src/api/schema/schema.ts
+++ b/client/src/api/schema/schema.ts
@@ -6083,6 +6083,8 @@ export interface components {
          * @description History Dataset Association Object
          */
         HDAObject: {
+            /** Accessible */
+            accessible: boolean;
             /** Copied From Ldda Id */
             copied_from_ldda_id?: string | null;
             /**
diff --git a/lib/galaxy/schema/schema.py b/lib/galaxy/schema/schema.py
index 9e9360d56764..aeadf4d8874e 100644
--- a/lib/galaxy/schema/schema.py
+++ b/lib/galaxy/schema/schema.py
@@ -939,6 +939,7 @@ class HDAObject(Model, WithModelClass):
     history_id: HistoryID
     tags: List[str]
     copied_from_ldda_id: Optional[EncodedDatabaseIdField] = None
+    accessible: bool
     model_config = ConfigDict(extra="allow")
 
 
diff --git a/lib/galaxy/webapps/galaxy/services/dataset_collections.py b/lib/galaxy/webapps/galaxy/services/dataset_collections.py
index 25fcdb61f0aa..40d32be49e7e 100644
--- a/lib/galaxy/webapps/galaxy/services/dataset_collections.py
+++ b/lib/galaxy/webapps/galaxy/services/dataset_collections.py
@@ -24,6 +24,7 @@
     dictify_element_reference,
 )
 from galaxy.managers.context import ProvidesHistoryContext
+from galaxy.managers.hdas import HDAManager
 from galaxy.managers.hdcas import HDCAManager
 from galaxy.managers.histories import HistoryManager
 from galaxy.model import DatasetCollectionElement
@@ -94,12 +95,14 @@ def __init__(
         self,
         security: IdEncodingHelper,
         history_manager: HistoryManager,
+        hda_manager: HDAManager,
         hdca_manager: HDCAManager,
         collection_manager: DatasetCollectionManager,
         datatypes_registry: Registry,
     ):
         super().__init__(security)
         self.history_manager = history_manager
+        self.hda_manager = hda_manager
         self.hdca_manager = hdca_manager
         self.collection_manager = collection_manager
         self.datatypes_registry = datatypes_registry
@@ -270,6 +273,8 @@ def serialize_element(dsc_element) -> DCESummary:
                     hdca_id=self.encode_id(hdca.id),
                     parent_id=self.encode_id(result["object"]["id"]),
                 )
+            else:
+                result["object"]["accessible"] = self.hda_manager.is_accessible(dsc_element.element_object, trans.user)
             return result
 
         rval = [serialize_element(el) for el in contents]

From a0adf7e76bb17db36d1bb14cd64bc83e68bd4b8d Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Fri, 24 May 2024 10:53:00 +0200
Subject: [PATCH 50/60] Add missing event declaration

Fixes typescript error:
Argument of type '"edit"' is not assignable to parameter of type '"toggleHighlights"'
---
 client/src/components/History/Content/Dataset/DatasetDetails.vue | 1 +
 1 file changed, 1 insertion(+)

diff --git a/client/src/components/History/Content/Dataset/DatasetDetails.vue b/client/src/components/History/Content/Dataset/DatasetDetails.vue
index 5cf6b2880e1d..ad083eb75584 100644
--- a/client/src/components/History/Content/Dataset/DatasetDetails.vue
+++ b/client/src/components/History/Content/Dataset/DatasetDetails.vue
@@ -26,6 +26,7 @@ const props = withDefaults(defineProps<Props>(), {
 
 const emit = defineEmits<{
     (e: "toggleHighlights"): void;
+    (e: "edit"): void;
 }>();
 
 const result = computed(() => datasetStore.getDataset(props.id));

From 810b246fbf6872b268c2ab68043884c9aa0777e3 Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Fri, 24 May 2024 10:53:51 +0200
Subject: [PATCH 51/60] Avoid requesting details for inaccessible datasets

---
 client/src/api/index.ts                               | 11 ++++++++++-
 .../History/Content/Dataset/DatasetDetails.vue        |  3 ++-
 client/src/stores/collectionElementsStore.test.ts     |  1 +
 client/src/stores/datasetStore.ts                     |  5 ++++-
 4 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/client/src/api/index.ts b/client/src/api/index.ts
index a32e076b84ff..75574ac0834b 100644
--- a/client/src/api/index.ts
+++ b/client/src/api/index.ts
@@ -89,6 +89,11 @@ export type DatasetSummary = components["schemas"]["HDASummary"];
  */
 export type DatasetDetails = components["schemas"]["HDADetailed"];
 
+/**
+ * Represents a HistoryDatasetAssociation that is inaccessible to the user.
+ */
+export type HDAInaccessible = components["schemas"]["HDAInaccessible"];
+
 /**
  * Contains storage (object store, quota, etc..) details for a dataset.
  */
@@ -97,7 +102,7 @@ export type DatasetStorageDetails = components["schemas"]["DatasetStorageDetails
 /**
  * Represents a HistoryDatasetAssociation with either summary or detailed information.
  */
-export type DatasetEntry = DatasetSummary | DatasetDetails;
+export type DatasetEntry = DatasetSummary | DatasetDetails | HDAInaccessible;
 
 /**
  * Contains summary information about a DCE (DatasetCollectionElement).
@@ -183,6 +188,10 @@ export function hasDetails(entry: DatasetEntry): entry is DatasetDetails {
     return "peek" in entry;
 }
 
+export function isInaccessible(entry: DatasetEntry): entry is HDAInaccessible {
+    return "accessible" in entry && !entry.accessible;
+}
+
 /**
  * Contains dataset metadata information.
  */
diff --git a/client/src/components/History/Content/Dataset/DatasetDetails.vue b/client/src/components/History/Content/Dataset/DatasetDetails.vue
index ad083eb75584..2dcae1313163 100644
--- a/client/src/components/History/Content/Dataset/DatasetDetails.vue
+++ b/client/src/components/History/Content/Dataset/DatasetDetails.vue
@@ -2,6 +2,7 @@
 import { BLink } from "bootstrap-vue";
 import { computed } from "vue";
 
+import { hasDetails } from "@/api";
 import { STATES } from "@/components/History/Content/model/states";
 import { useDatasetStore } from "@/stores/datasetStore";
 
@@ -41,7 +42,7 @@ function toggleHighlights() {
 
 <template>
     <div>
-        <div v-if="result && !isLoading" class="dataset">
+        <div v-if="result && !isLoading && hasDetails(result)" class="dataset">
             <div class="details not-loading">
                 <div class="summary">
                     <div v-if="stateText" class="mb-1">{{ stateText }}</div>
diff --git a/client/src/stores/collectionElementsStore.test.ts b/client/src/stores/collectionElementsStore.test.ts
index 4a2c7be2e2ce..af3096c49a4d 100644
--- a/client/src/stores/collectionElementsStore.test.ts
+++ b/client/src/stores/collectionElementsStore.test.ts
@@ -150,6 +150,7 @@ function mockElement(collectionId: string, i: number): DCESummary {
             hda_ldda: "hda",
             history_id: "1",
             tags: [],
+            accessible: true,
         },
     };
 }
diff --git a/client/src/stores/datasetStore.ts b/client/src/stores/datasetStore.ts
index 8c4582505294..da887a83300b 100644
--- a/client/src/stores/datasetStore.ts
+++ b/client/src/stores/datasetStore.ts
@@ -1,7 +1,7 @@
 import { defineStore } from "pinia";
 import { computed, set } from "vue";
 
-import type { DatasetDetails, DatasetEntry, HistoryContentItemBase } from "@/api";
+import { type DatasetDetails, type DatasetEntry, type HistoryContentItemBase, isInaccessible } from "@/api";
 import { fetchDataset } from "@/api/datasets";
 import { ApiResponse } from "@/api/schema";
 import { useKeyedCache } from "@/composables/keyedCache";
@@ -17,6 +17,9 @@ export const useDatasetStore = defineStore("datasetStore", () => {
             if (!dataset) {
                 return true;
             }
+            if (isInaccessible(dataset)) {
+                return false;
+            }
             const isNotDetailed = !("peek" in dataset);
             return isNotDetailed;
         };

From 0104764bb81c1fc4ad85d0dab5e4385ee4497fa8 Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Fri, 24 May 2024 13:43:33 +0200
Subject: [PATCH 52/60] Make accessible optional in HDAObject

It is probably enough to serialize the `accessible` property only when requesting collection contents displayed in the UI.
---
 client/src/api/schema/schema.ts | 2 +-
 lib/galaxy/schema/schema.py     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/api/schema/schema.ts b/client/src/api/schema/schema.ts
index 36a71aa1d4e1..d22b21166646 100644
--- a/client/src/api/schema/schema.ts
+++ b/client/src/api/schema/schema.ts
@@ -6084,7 +6084,7 @@ export interface components {
          */
         HDAObject: {
             /** Accessible */
-            accessible: boolean;
+            accessible?: boolean | null;
             /** Copied From Ldda Id */
             copied_from_ldda_id?: string | null;
             /**
diff --git a/lib/galaxy/schema/schema.py b/lib/galaxy/schema/schema.py
index aeadf4d8874e..88c946c5ad48 100644
--- a/lib/galaxy/schema/schema.py
+++ b/lib/galaxy/schema/schema.py
@@ -939,7 +939,7 @@ class HDAObject(Model, WithModelClass):
     history_id: HistoryID
     tags: List[str]
     copied_from_ldda_id: Optional[EncodedDatabaseIdField] = None
-    accessible: bool
+    accessible: Optional[bool] = None
     model_config = ConfigDict(extra="allow")
 
 

From cc2f83dac08eb0add166a5635f8c5f2af4bd8c4e Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Fri, 24 May 2024 18:26:18 +0200
Subject: [PATCH 53/60] Raise appropriate exception if accessing deleted input
 file

---
 lib/galaxy/webapps/galaxy/api/job_files.py | 21 +++++++++++++++++----
 test/integration/test_job_files.py         | 19 ++++++++++++++++++-
 2 files changed, 35 insertions(+), 5 deletions(-)

diff --git a/lib/galaxy/webapps/galaxy/api/job_files.py b/lib/galaxy/webapps/galaxy/api/job_files.py
index df2edf2415cb..fa30c3433e48 100644
--- a/lib/galaxy/webapps/galaxy/api/job_files.py
+++ b/lib/galaxy/webapps/galaxy/api/job_files.py
@@ -11,6 +11,7 @@
     exceptions,
     util,
 )
+from galaxy.managers.context import ProvidesAppContext
 from galaxy.model import Job
 from galaxy.web import (
     expose_api_anonymous_and_sessionless,
@@ -34,7 +35,7 @@ class JobFilesAPIController(BaseGalaxyAPIController):
     """
 
     @expose_api_raw_anonymous_and_sessionless
-    def index(self, trans, job_id, **kwargs):
+    def index(self, trans: ProvidesAppContext, job_id, **kwargs):
         """
         GET /api/jobs/{job_id}/files
 
@@ -56,9 +57,21 @@ def index(self, trans, job_id, **kwargs):
         :rtype:     binary
         :returns:   contents of file
         """
-        self.__authorize_job_access(trans, job_id, **kwargs)
-        path = kwargs.get("path", None)
-        return open(path, "rb")
+        job = self.__authorize_job_access(trans, job_id, **kwargs)
+        path = kwargs["path"]
+        try:
+            return open(path, "rb")
+        except FileNotFoundError:
+            # We know that the job is not terminal, but users (or admin scripts) can purge input datasets.
+            # Here we discriminate that case from truly unexpected bugs.
+            # Not failing the job here, this is or should be handled by pulsar.
+            match = re.match(r"(galaxy_)?dataset_(.*)\.dat", os.path.basename(path))
+            if match:
+                # This looks like a galaxy dataset, check if any job input has been deleted.
+                if any(jtid.dataset.dataset.purged for jtid in job.input_datasets):
+                    raise exceptions.ItemDeletionException("Input dataset(s) for job have been purged.")
+            else:
+                raise
 
     @expose_api_anonymous_and_sessionless
     def create(self, trans, job_id, payload, **kwargs):
diff --git a/test/integration/test_job_files.py b/test/integration/test_job_files.py
index 36babdcebf6e..fce3bf4bd6bd 100644
--- a/test/integration/test_job_files.py
+++ b/test/integration/test_job_files.py
@@ -43,6 +43,7 @@
 
 class TestJobFilesIntegration(integration_util.IntegrationTestCase):
     initialized = False
+    dataset_populator: DatasetPopulator
 
     @classmethod
     def handle_galaxy_config_kwds(cls, config):
@@ -60,7 +61,7 @@ def setUp(self):
             sa_session = self.sa_session
             stmt = select(model.HistoryDatasetAssociation)
             assert len(sa_session.scalars(stmt).all()) == 0
-            self.dataset_populator.new_dataset(history_id, content=TEST_INPUT_TEXT, wait=True)
+            self.input_hda_dict = self.dataset_populator.new_dataset(history_id, content=TEST_INPUT_TEXT, wait=True)
             assert len(sa_session.scalars(stmt).all()) == 1
             self.input_hda = sa_session.scalars(stmt).all()[0]
             TestJobFilesIntegration.initialized = True
@@ -86,6 +87,22 @@ def test_read_by_state(self):
         response = requests.get(get_url, params=data)
         _assert_insufficient_permissions(response)
 
+    def test_read_fails_if_input_file_purged(self):
+        job, _, _ = self.create_static_job_with_state("running")
+        job_id, job_key = self._api_job_keys(job)
+        input_file_path = self.input_hda.get_file_name()
+        data = {"path": input_file_path, "job_key": job_key}
+        get_url = self._api_url(f"jobs/{job_id}/files", use_key=True)
+        head_response = requests.head(get_url, params=data)
+        api_asserts.assert_status_code_is_ok(head_response)
+        delete_response = self.dataset_populator.delete_dataset(
+            self.input_hda_dict["history_id"], content_id=self.input_hda_dict["id"], purge=True, wait_for_purge=True
+        )
+        assert delete_response.status_code == 200
+        head_response = requests.get(get_url, params=data)
+        assert head_response.status_code == 400
+        assert head_response.json()["err_msg"] == "Input dataset(s) for job have been purged."
+
     def test_write_by_state(self):
         job, output_hda, working_directory = self.create_static_job_with_state("running")
         job_id, job_key = self._api_job_keys(job)

From ed70432254ed799ec83233a6f902f0452b71de65 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Mon, 27 May 2024 08:58:02 +0200
Subject: [PATCH 54/60] Decrease visualization log level

Minor followup to https://github.com/galaxyproject/galaxy/pull/18211.
If we've got a MessageException I don't think we need to log this as an
error, since we're also showing a reasonable message to the user.
---
 lib/galaxy/webapps/galaxy/controllers/visualization.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/galaxy/webapps/galaxy/controllers/visualization.py b/lib/galaxy/webapps/galaxy/controllers/visualization.py
index b70fc5ad6f85..abd650b5475c 100644
--- a/lib/galaxy/webapps/galaxy/controllers/visualization.py
+++ b/lib/galaxy/webapps/galaxy/controllers/visualization.py
@@ -11,6 +11,7 @@
     model,
     web,
 )
+from galaxy.exceptions import MessageException
 from galaxy.managers.hdas import HDAManager
 from galaxy.managers.sharable import SlugBuilder
 from galaxy.model.base import transaction
@@ -258,7 +259,10 @@ def _handle_plugin_error(self, trans, visualization_name, exception):
         """
         Log, raise if debugging; log and show html message if not.
         """
-        log.exception("error rendering visualization (%s)", visualization_name)
+        if isinstance(exception, MessageException):
+            log.debug("error rendering visualization (%s): %s", visualization_name, exception)
+        else:
+            log.exception("error rendering visualization (%s)", visualization_name)
         if trans.debug:
             raise exception
         return trans.show_error_message(

From 30b1f4b2f9cff6735e0bb1e22b32a08a5c5bfd1a Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Mon, 27 May 2024 09:51:34 +0200
Subject: [PATCH 55/60] Raise RequestParameterInvalidException if url can't be
 verified

Kind of a followup to
https://github.com/galaxyproject/galaxy/pull/18155.

Fixes:
```
ValueError
invalid literal for int() with base 10: 'sequences'
```
For the attempted url `"http://emp-single-end-sequences:sequences"`.
---
 lib/galaxy/files/uris.py | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/lib/galaxy/files/uris.py b/lib/galaxy/files/uris.py
index 42b502d77fdc..d35e51d696c4 100644
--- a/lib/galaxy/files/uris.py
+++ b/lib/galaxy/files/uris.py
@@ -6,6 +6,7 @@
 from typing import (
     List,
     Optional,
+    Tuple,
 )
 from urllib.parse import urlparse
 
@@ -78,6 +79,18 @@ def validate_uri_access(uri: str, is_admin: bool, ip_allowlist: List[IpAllowedLi
         raise AdminRequiredException()
 
 
+def split_port(parsed_url: str, url: str) -> Tuple[str, int]:
+    try:
+        idx = parsed_url.rindex(":")
+        # We parse as an int and let this fail ungracefully if parsing
+        # fails because we desire to fail closed rather than open.
+        port = int(parsed_url[idx + 1 :])
+        parsed_url = parsed_url[:idx]
+        return (parsed_url, port)
+    except Exception:
+        raise RequestParameterInvalidException(f"Could not verify url '{url}'.")
+
+
 def validate_non_local(uri: str, ip_allowlist: List[IpAllowedListEntryT]) -> str:
     # If it doesn't look like a URL, ignore it.
     if not (uri.lstrip().startswith("http://") or uri.lstrip().startswith("https://")):
@@ -106,22 +119,14 @@ def validate_non_local(uri: str, ip_allowlist: List[IpAllowedListEntryT]) -> str
             # However if it ends with a ']' then there is no port after it and
             # they've wrapped it in brackets just for fun.
             if "]" in parsed_url and not parsed_url.endswith("]"):
-                # If this +1 throws a range error, we don't care, their url
-                # shouldn't end with a colon.
-                idx = parsed_url.rindex(":")
-                # We parse as an int and let this fail ungracefully if parsing
-                # fails because we desire to fail closed rather than open.
-                port = int(parsed_url[idx + 1 :])
-                parsed_url = parsed_url[:idx]
+                parsed_url, port = split_port(parsed_url=parsed_url, url=url)
             else:
                 # Plain ipv6 without port
                 pass
         else:
             # This should finally be ipv4 with port. It cannot be IPv6 as that
             # was caught by earlier cases, and it cannot be due to credentials.
-            idx = parsed_url.rindex(":")
-            port = int(parsed_url[idx + 1 :])
-            parsed_url = parsed_url[:idx]
+            parsed_url, port = split_port(parsed_url=parsed_url, url=url)
 
     # safe to log out, no credentials/request path, just an IP + port
     log.debug("parsed url %s, port:  %s", parsed_url, port)

From 11ae179c9a646573f262a2d1d4f9a28e5019e4ec Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Mon, 27 May 2024 10:06:41 +0200
Subject: [PATCH 56/60] Don't set dataset peek for errored jobs

This is consistent with the extended metadata logic, and prevents:
```
Message
Job wrapper finish method failed
Stack Trace

Newest

IndexError
list index out of range
```
which only makes it harder to diagnose the actual error, which in the
case of https://sentry.galaxyproject.org/share/issue/831261683ce642a4976efa20a9a0e55c/
is `\nslurmstepd: error: *** JOB 1910486 ON js2-gpu-small0 CANCELLED AT 2024-05-26T23:30:00 DUE TO TIME LIMIT ***\n`
---
 lib/galaxy/jobs/__init__.py | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/lib/galaxy/jobs/__init__.py b/lib/galaxy/jobs/__init__.py
index 084f0e9d62ec..0d7c9572af17 100644
--- a/lib/galaxy/jobs/__init__.py
+++ b/lib/galaxy/jobs/__init__.py
@@ -1786,13 +1786,14 @@ def _finish_dataset(self, output_name, dataset, job, context, final_job_state, r
                     working_directory=self.working_directory,
                     remote_metadata_directory=remote_metadata_directory,
                 )
-            line_count = context.get("line_count", None)
-            try:
-                # Certain datatype's set_peek methods contain a line_count argument
-                dataset.set_peek(line_count=line_count)
-            except TypeError:
-                # ... and others don't
-                dataset.set_peek()
+            if final_job_state != job.states.ERROR:
+                line_count = context.get("line_count", None)
+                try:
+                    # Certain datatype's set_peek methods contain a line_count argument
+                    dataset.set_peek(line_count=line_count)
+                except TypeError:
+                    # ... and others don't
+                    dataset.set_peek()
         else:
             # Handle purged datasets.
             dataset.blurb = "empty"

From 3cd64e78610f56bc8d7d7fdc306c9448234b2e1e Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Mon, 27 May 2024 10:15:54 +0200
Subject: [PATCH 57/60] Refactor set_peek and move exception handling

---
 lib/galaxy/jobs/__init__.py         |  7 +------
 lib/galaxy/metadata/set_metadata.py |  7 +------
 lib/galaxy/model/__init__.py        | 12 ++++++++++--
 3 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/lib/galaxy/jobs/__init__.py b/lib/galaxy/jobs/__init__.py
index 0d7c9572af17..fe3d4995fb4e 100644
--- a/lib/galaxy/jobs/__init__.py
+++ b/lib/galaxy/jobs/__init__.py
@@ -1788,12 +1788,7 @@ def _finish_dataset(self, output_name, dataset, job, context, final_job_state, r
                 )
             if final_job_state != job.states.ERROR:
                 line_count = context.get("line_count", None)
-                try:
-                    # Certain datatype's set_peek methods contain a line_count argument
-                    dataset.set_peek(line_count=line_count)
-                except TypeError:
-                    # ... and others don't
-                    dataset.set_peek()
+                dataset.set_peek(line_count=line_count)
         else:
             # Handle purged datasets.
             dataset.blurb = "empty"
diff --git a/lib/galaxy/metadata/set_metadata.py b/lib/galaxy/metadata/set_metadata.py
index 237b106d3c7f..8f1f9ea86be9 100644
--- a/lib/galaxy/metadata/set_metadata.py
+++ b/lib/galaxy/metadata/set_metadata.py
@@ -506,12 +506,7 @@ def set_meta(new_dataset_instance, file_dict):
                     dataset.dataset.uuid = context["uuid"]
                 if not final_job_state == Job.states.ERROR:
                     line_count = context.get("line_count", None)
-                    try:
-                        # Certain datatype's set_peek methods contain a line_count argument
-                        dataset.set_peek(line_count=line_count)
-                    except TypeError:
-                        # ... and others don't
-                        dataset.set_peek()
+                    dataset.set_peek(line_count=line_count)
                 for context_key in TOOL_PROVIDED_JOB_METADATA_KEYS:
                     if context_key in context:
                         context_value = context[context_key]
diff --git a/lib/galaxy/model/__init__.py b/lib/galaxy/model/__init__.py
index 2519eaec39af..172aab242b03 100644
--- a/lib/galaxy/model/__init__.py
+++ b/lib/galaxy/model/__init__.py
@@ -4652,8 +4652,16 @@ def get_mime(self):
             # extension is None
             return "data"
 
-    def set_peek(self, **kwd):
-        return self.datatype.set_peek(self, **kwd)
+    def set_peek(self, line_count=None, **kwd):
+        try:
+            # Certain datatype's set_peek methods contain a line_count argument
+            return self.datatype.set_peek(self, line_count=line_count, **kwd)
+        except TypeError:
+            # ... and others don't
+            return self.datatype.set_peek(self, **kwd)
+        except Exception:
+            # Never fail peek setting, but do log exception so datatype logic can be fixed
+            log.exception("Setting peek failed")
 
     def init_meta(self, copy_from=None):
         return self.datatype.init_meta(self, copy_from=copy_from)

From 54db4e9a7a8824712540c8e6b02da8d8ad8271df Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Mon, 27 May 2024 10:22:34 +0200
Subject: [PATCH 58/60] Don't fail set_peek if file does not look like GRO file

---
 lib/galaxy/datatypes/molecules.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/galaxy/datatypes/molecules.py b/lib/galaxy/datatypes/molecules.py
index a4cc26b549d2..698ebb2ec07a 100644
--- a/lib/galaxy/datatypes/molecules.py
+++ b/lib/galaxy/datatypes/molecules.py
@@ -1546,8 +1546,12 @@ def sniff_prefix(self, file_prefix: FilePrefix) -> bool:
     def set_peek(self, dataset: DatasetProtocol, **kwd) -> None:
         if not dataset.dataset.purged:
             dataset.peek = get_file_peek(dataset.get_file_name())
-            atom_number = int(dataset.peek.split("\n")[1])
-            dataset.blurb = f"{atom_number} atoms"
+            peek_lines = dataset.peek.split("\n")
+            try:
+                atom_number = int(peek_lines[1])
+                dataset.blurb = f"{atom_number} atoms"
+            except (ValueError, IndexError):
+                dataset.blurb = "file does not look like valid GRO file."
         else:
             dataset.peek = "file does not exist"
             dataset.blurb = "file purged from disk"

From 3c6a9a8eaf9e6451f31ffb74408aa0d28bdf2541 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Mon, 27 May 2024 11:17:13 +0200
Subject: [PATCH 59/60] Reset content-length for unhandled exceptions

This prevents `ProtocolError` caused by the error middleware not being
able to reset the content length. Only affects routes that explicitly
set the content-length and don't have a default response handler.

This is effectively the case when using `web.expose`. To test this,
make sure you get Galaxy's error middleware output in the browser
and your console.
```
diff --git a/lib/galaxy/webapps/galaxy/controllers/dataset.py b/lib/galaxy/webapps/galaxy/controllers/dataset.py
index c95d9df788..92b04684d3 100644
--- a/lib/galaxy/webapps/galaxy/controllers/dataset.py
+++ b/lib/galaxy/webapps/galaxy/controllers/dataset.py
@@ -456,6 +456,8 @@ class DatasetInterface(BaseUIController, UsesAnnotations, UsesItemRatings, UsesE
     def imp(self, trans, dataset_id=None, **kwd):
         """Import another user's dataset via a shared URL; dataset is added to user's current history."""
         # Set referer message.
+        trans.response.headers["content-length"] = 0
+        trans = None
         referer = trans.request.referer
         if referer and not referer.startswith(f"{trans.request.application_url}{url_for('/login')}"):
             referer_message = f"<a href='{escape(referer)}'>return to the previous page</a>"

```
---
 lib/galaxy/web/framework/base.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/galaxy/web/framework/base.py b/lib/galaxy/web/framework/base.py
index 364e6d4c72e2..276ac0b52d5d 100644
--- a/lib/galaxy/web/framework/base.py
+++ b/lib/galaxy/web/framework/base.py
@@ -264,6 +264,7 @@ def handle_request(self, request_id, path_info, environ, start_response, body_re
         except Exception as e:
             body = self.handle_controller_exception(e, trans, method, **kwargs)
             if not body:
+                trans.response.headers.pop("content-length", None)
                 raise
         body_renderer = body_renderer or self._render_body
         return body_renderer(trans, body, environ, start_response)

From 16cb72703ae9d113b450b81399090efdc43c9858 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Tue, 28 May 2024 14:37:15 +0200
Subject: [PATCH 60/60] Fix up loading failed error state in Dataset Attributes
 component

---
 .../DatasetInformation/DatasetAttributes.test.ts   | 14 ++++----------
 .../DatasetInformation/DatasetAttributes.vue       | 10 +++++-----
 2 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/client/src/components/DatasetInformation/DatasetAttributes.test.ts b/client/src/components/DatasetInformation/DatasetAttributes.test.ts
index ef30659da852..ca9a8e2425d0 100644
--- a/client/src/components/DatasetInformation/DatasetAttributes.test.ts
+++ b/client/src/components/DatasetInformation/DatasetAttributes.test.ts
@@ -39,23 +39,17 @@ async function mountDatasetAttributes(conversion_disable = false) {
     return wrapper;
 }
 
-async function buildWrapperWithError(error) {
+async function buildWrapperWithError(error: string) {
+    const axiosMock = new MockAdapter(axios);
+    axiosMock.onGet(`/dataset/get_edit?dataset_id=${DATASET_ID}`).reply(400);
     const wrapper = mount(DatasetAttributes, {
         propsData: {
-            datasetId: "dataset_id",
+            datasetId: DATASET_ID,
             messageText: error,
             messageVariant: "danger",
         },
-        computed: {
-            hasError() {
-                return true;
-            },
-        },
         localVue,
         stubs: {
-            DatasetAttributesProvider: MockProvider({
-                result: null,
-            }),
             FontAwesomeIcon: false,
             FormElement: false,
         },
diff --git a/client/src/components/DatasetInformation/DatasetAttributes.vue b/client/src/components/DatasetInformation/DatasetAttributes.vue
index 726ce64b0fd6..a9fa7db9acd0 100644
--- a/client/src/components/DatasetInformation/DatasetAttributes.vue
+++ b/client/src/components/DatasetInformation/DatasetAttributes.vue
@@ -4,7 +4,7 @@ import { faBars, faCog, faDatabase, faExchangeAlt, faRedo, faSave, faUser } from
 import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
 import { type AxiosError } from "axios";
 import { BAlert, BButton, BTab, BTabs } from "bootstrap-vue";
-import { computed, onMounted, ref } from "vue";
+import { onMounted, ref } from "vue";
 
 import { fetchDatasetAttributes } from "@/api/datasets";
 import { setAttributes } from "@/components/DatasetInformation/services";
@@ -26,11 +26,11 @@ const props = defineProps<Props>();
 const historyStore = useHistoryStore();
 
 const loading = ref(false);
-const messageText = ref("");
+const loadingFailed = ref(false);
+const messageText = ref<string>();
 const messageVariant = ref("danger");
 const formData = ref<Record<string, any>>({});
 const datasetAttributes = ref<Record<string, any>>({});
-const hasError = computed(() => messageVariant.value === "danger");
 
 function onAttribute(data: object) {
     formData.value["attribute"] = data;
@@ -77,7 +77,7 @@ async function loadDatasetAttributes() {
         datasetAttributes.value = data;
     } catch (e) {
         const error = e as AxiosError<{ err_msg?: string }>;
-
+        loadingFailed.value = true;
         onError(error.response?.data?.err_msg || "Unable to fetch available dataset attributes.");
     } finally {
         loading.value = false;
@@ -102,7 +102,7 @@ onMounted(async () => {
         <BAlert v-if="loading" variant="info" show>
             <LoadingSpan message="Loading dataset attributes..." />
         </BAlert>
-        <div v-else-if="!hasError" class="mt-3">
+        <div v-else-if="!loadingFailed" class="mt-3">
             <BTabs>
                 <BTab v-if="!datasetAttributes['attribute_disable']">
                     <template v-slot:title>