14ecff0730596f8be147b255afc8acb99e9095e2
max
  Fri Sep 18 09:06:06 2026 -0700
hgHubConnect: an api key made on one geo mirror now works on all of them, behind syncHubApiKeys

#Preview2 week - bugs introduced now will need a build patch to fix
#Preview2 week - bugs introduced now will need a build patch to fix
Api keys live in the hgcentral of whichever mirror issued them, so a key made on
genome.ucsc.edu was rejected on genome-euro and genome-asia, and the botDelay
error told the user to go and make a second one. hgHubConnect now tells the other
nodes about a key as soon as it generates or revokes one: cjGenerateApiKey and
cjRevokeApiKey call syncApiKeyToOtherNodes(), which posts a hgHubSyncApiKey
cartJson request to each peer, and cjSyncApiKey() on the far side writes it into
that mirror's own table.

The peers come from hgcentral.gbNode via the new geoMirrorNotifyOtherNodes(), and
the request is signed with login.cookieSalt, which all of a site's mirrors already
share - it is what makes the login cookie verifiable on each of them. So neither a
list of mirror addresses nor a new shared secret needs provisioning. The notify is
best effort: a peer that is down is warn()ed about and skipped, never failing the
local generate or revoke, which has already committed by then.

All of it is off unless hg.conf says syncHubApiKeys=on. With the gate off the
sender returns at once, the receiver refuses the request outright rather than
merely being unreachable, and botDelay keeps printing the old server-specific
wording, which off is still the truth. Registered in hgConfCatalog.py as a gate,
to be flipped once this is released.

refs #38323

diff --git src/hg/lib/geoMirror.c src/hg/lib/geoMirror.c
index 996dc803799..05c8e660463 100644
--- src/hg/lib/geoMirror.c
+++ src/hg/lib/geoMirror.c
@@ -1,24 +1,27 @@
 /* geoMirror - support geographic based mirroring (e.g. euro and asia nodes) */
 
 /* Copyright (C) 2014 The Regents of the University of California 
  * See kent/LICENSE or http://genome.ucsc.edu/license/ for licensing information. */
 
 #include "common.h"
 #include "geoMirror.h"
 #include "hgConfig.h"
 #include "internet.h"
+#include "net.h"
+#include "cheapcgi.h"
+#include "errCatch.h"
 
 /* geographic server (mirror) support
 
    Customize 'Mirrors' drop-down menu based on current server.  If the server
    is a UCSC-sponsored site (USA/Ca or European), show this in drop-down menu
    with a checkmark, and allow user to change server.  Based on design notes here:
         http://genomewiki.ucsc.edu/genecats/index.php/Euronode
 
    NOTE: Uses hgcentral.gbNode table
    to populate menu items and locate redirects.  This implementation uses the
    spec from above wiki page:
         browser.node=1 -> US server (genome.ucsc.edu)
         browser.node=2 -> European server (genome-euro.ucsc.edu)
         browser.node=3 -> Asian server (genome-asia.ucsc.edu)
 
@@ -329,30 +332,64 @@
 struct slPair *geoMirrorThisNode()
 /* Return this node (browser.node) as a single pair of name=shortLabel, val=domain, or NULL when
  * geo mirroring is off or gbNode has no row for it.  slPairFreeValsAndList when done. */
 {
 return geoMirrorNodeList(TRUE);
 }
 
 struct slPair *geoMirrorOtherNodes()
 /* Return the other geo mirror nodes, as pairs of name=shortLabel, val=domain, ordered by node.
  * The node this CGI is running on (browser.node) is left out.  Returns NULL when geo mirroring
  * is off or this is the only node.  slPairFreeValsAndList when done. */
 {
 return geoMirrorNodeList(FALSE);
 }
 
+void geoMirrorNotifyOtherNodes(char *cgiName, struct slPair *cgiVars)
+/* Best-effort: fire cgiVars (name=value) as a GET request at cgiName on every other geo mirror
+ * node (per geoMirrorOtherNodes()).  No-ops if geo mirroring is off or this is the only node.
+ * Adds no authentication of its own -- callers must put their own signed proof into cgiVars,
+ * since the receiving CGI runs with no session/cart tying the request to a user.  A slow or
+ * unreachable peer is logged with warn() and skipped; the caller's own action must already be
+ * complete locally before this is called, since a peer being down must never fail the local
+ * action. */
+{
+struct slPair *nodes = geoMirrorOtherNodes();
+struct slPair *node;
+for (node = nodes; node != NULL; node = node->next)
+    {
+    struct dyString *url = dyStringCreate("http://%s/cgi-bin/%s?", (char *)node->val, cgiName);
+    struct slPair *var;
+    for (var = cgiVars; var != NULL; var = var->next)
+        dyStringPrintf(url, "%s%s=%s", (var == cgiVars) ? "" : "&", var->name,
+                       cgiEncodeFull((char *)var->val));
+    struct errCatch *errCatch = errCatchNew();
+    if (errCatchStart(errCatch))
+        {
+        struct dyString *response = netSlurpUrl(url->string);
+        dyStringFree(&response);
+        }
+    errCatchEnd(errCatch);
+    if (errCatch->gotError)
+        warn("geoMirrorNotifyOtherNodes: failed to reach %s (%s): %s",
+             node->name, (char *)node->val, errCatch->message->string);
+    errCatchFree(&errCatch);
+    dyStringFree(&url);
+    }
+slPairFreeValsAndList(&nodes);
+}
+
 char *geoMirrorMenu()
 /* Create customized geoMirror menu string for substitution of  into
  * <!-- OPTIONAL_MIRROR_MENU --> in htdocs/inc/globalNavBar.inc
  * Reads hgcentral geo tables and hg.conf settings. 
  * Free the returned string when done. */
 {
 struct dyString *dy = dyStringNew(0);  // by default replacment is just an empty string.
 if (geoMirrorEnabled())
     {
     dyStringAppend(dy, "<li id=\"geoMirrorMenu\" class=\"noHighlight\"><hr></li>\n");
     // Geo mirror functionality (e.g. in nav bar)
     char *myNode = geoMirrorNode();
     /* hgcentral.gbNode table so UI can share w/ browser GEO mirror redirect code */
     char **row = NULL;
     struct sqlConnection *conn = hConnectCentral();  // after hClade since it access hgcentral too