fix: identify Virtool to NCBI and GitHub to avoid blocked requests - #1393
Merged
igboyes merged 1 commit intoAug 14, 2026
Conversation
Every outbound request went out anonymous. NCBI throttles or blocks
unidentified callers and BLAST polling is the highest-volume outbound
path here; GitHub refuses a request carrying no User-Agent at all.
Adds a single USER_AGENT constant in @virtool/data/userAgent and sends
it from the four third-party call sites: NCBI BLAST (submit, poll and
result fetch), the GenBank efetch call, the virtool.ca HMM manifest, and
the GitHub-hosted release archive apps/tasks downloads.
No shared HTTP client: each call site already takes its own
AbortSignal.timeout, and a singleton client would be the module-scope
construction packages/data avoids everywhere else.
The token carries no version. Python sent virtool/{version} from one
shared aiohttp session, but packages/data has no build-time global to
read one from -- apps/web has __APP_VERSION__ and apps/tasks a JSON
import of its own manifest, neither visible from there -- so matching it
would mean threading a string through nine signatures. One token every
call site agrees on beats a version on the subset that could reach one.
request() in blast/ncbi.ts now takes Omit<RequestInit, "headers" |
"signal"> so a caller cannot silently drop either.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
igboyes
deleted the
igboyes/vir-2971-identify-outbound-requests-to-ncbi-genbank-and-github-with-a
branch
August 14, 2026 18:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
User-Agentat all. A singleUSER_AGENTconstant in@virtool/data/userAgentnow travels with all four third-party call sites — NCBI BLAST (submit, poll, result fetch), the GenBank efetch call, the virtool.ca HMM manifest, and the GitHub-hosted release archiveapps/tasksdownloads.AbortSignal.timeout, and a singleton would be exactly the module-scope constructionpackages/dataavoids everywhere else.request()inblast/ncbi.tsnarrows itsinittoOmit<RequestInit, "headers" | "signal">so a caller cannot silently drop either.virtool/{version}from one shared aiohttp session, butpackages/datahas no build-time global to read one from —apps/webhas__APP_VERSION__andapps/tasksa JSON import of its own manifest, neither visible from there — so matching it meant threading a string through nine signatures and ~45 test call sites. Stamping only the sites that can reach a version would leaveinstall_hmmssendingvirtool/1.2.3whilesweep_blastsendsvirtool, which reads as a bug in a log. Easy to reverse if you'd rather have it.apps/site's build-timeapi.github.comfetch is deliberately untouched — separate deploy, separate gates, and not in the issue's scope.Closes VIR-2971.