Verification of test01-database fails

[christoph-maurer]

mutation {
  verifyDatabase(input: { databaseId: "21ea41a4-c989-4862-a34d-1bce0a38d428" }) {
    errors {
      code
      message
      path
    }
  }
}

fails on https://www.building-integrated-solar-systems.com/graphql/, although

{
  "data": {
    "verificationCode": "FzopZGYWAMyj21pp1lBZHQMSSXbid8sQB9EDejzgu+MmgooWcbwebqs8lCJuLU/pCXHI8IT9JfHMhv7nUIfegA=="
  }
}

is available on https://www.solar-in-the-facade.com/graphql/ .

The logs show

backend-1        | [15:48:57 INF] The token request was successfully extracted: {
backend-1        |   "grant_type": "client_credentials",
backend-1        |   "resource": "https://www.building-integrated-solar-systems.com/graphql/",
backend-1        |   "client_id": "metabase",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.
backend-1        | [15:48:58 INF] The token request was rejected because the application 'metabase' was not allowed to use the resource https://www.building-integrated-solar-systems.com/graphql/.
backend-1        | [15:48:58 INF] The response was successfully returned as a JSON document: {
backend-1        |   "error": "invalid_request",
backend-1        |   "error_description": "This client application is not allowed to use the specified resource(s).",
backend-1        |   "error_uri": "https://documentation.openiddict.com/errors/ID2192"
backend-1        | }.
backend-1        | [15:48:58 INF] HTTP POST /connect/token responded 400 in 7.3722 ms
backend-1        | [15:48:58 INF] The token request was successfully sent to https://www.building-integrated-solar-systems.com/connect/token: {
backend-1        |   "grant_type": "client_credentials",
backend-1        |   "resource": [
backend-1        |     "https://www.building-integrated-solar-systems.com/graphql/"
backend-1        |   ],
backend-1        |   "client_id": "metabase",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.

[christoph-maurer]

I think the problem is "rsrc:https://staging.building-integrated-solar-systems.com/graphql/" in

xbase=# select * from metabase."OpenIddictApplications" ;
─[ RECORD 1 ]──────────┬───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Id                     │ 019d8c8d-945f-7bc7-abf1-c25e101f6889
ClientId               │ metabase
ClientSecret           │ AQAAAAEAACcQAAAAEOvWVU9VRE/S4GGj9zfxvbdqHv+2AhBForPdQfnLwr0Dbx7eZrDptCcvisMn8YlgtQ==
ConcurrencyToken       │ 40cea2d3-5cd7-42d9-8e23-067583ce2e28
ConsentType            │ explicit
DisplayName            │ Metabase client application
DisplayNames           │ ∅
Permissions            │ ["ept:authorization","ept:end_session","ept:introspection","ept:pushed_authorization","ept:revocation","ept:token","rst:code","rst:id_token","rst:token","gt:authorization_code","gt:client_credentials","gt:refresh_token","gt:urn:ietf:params:oauth:grant-type:token-exchange","scp:address","scp:email","scp:phone","scp:profile","scp:roles","scp:api:read","scp:api:write","scp:api:administrate","scp:api:verify","scp:api:database:manage","scp:api:gnu_pg:manage","scp:api:institution_representative:manage","scp:api:open_id_connect:manage","scp:api:user:manage","aud:metabase","rsrc:https://staging.building-integrated-solar-systems.com/graphql/"]
PostLogoutRedirectUris │ ["https://www.building-integrated-solar-systems.com/connect/callback/logout/metabase"]
Properties             │ ∅
RedirectUris           │ ["https://www.building-integrated-solar-systems.com/connect/callback/login/metabase"]
Requirements           │ ["ft:pkce","ft:par"]
ClientType             │ confidential
ApplicationType        │ ∅
JsonWebKeySet          │ ∅
Settings               │ ∅
OwnerId                │ 5320d6fb-b96d-4aeb-a24c-eb7036d3437a

[christoph-maurer]

The command could be update metabase."OpenIddictApplications" set "Permissions"='["ept:authorization","ept:end_session","ept:introspection","ept:pushed_authorization","ept:revocation","ept:token","rst:code","rst:id_token","rst:token","gt:authorization_code","gt:client_credentials","gt:refresh_token","gt:urn:ietf:params:oauth:grant-type:token-exchange","scp:address","scp:email","scp:phone","scp:profile","scp:roles","scp:api:read","scp:api:write","scp:api:administrate","scp:api:verify","scp:api:database:manage","scp:api:gnu_pg:manage","scp:api:institution_representative:manage","scp:api:open_id_connect:manage","scp:api:user:manage","aud:metabase","rsrc:https://www.building-integrated-solar-systems.com/graphql/"]' where "ClientId"='metabase';

[christoph-maurer]

After updating rsrc, the logs look much better:

backend-1        | [16:51:26 INF] HTTP GET /service-worker.js responded 304 in 3381.3228 ms
backend-1        | [16:51:26 INF] HTTP GET /assets/codicon.b80d8424.Hscy-R9e.ttf responded 304 in 4713.2493 ms
backend-1        | [16:51:34 INF] The request URI matched a server endpoint: Token.
backend-1        | [16:51:34 INF] The token request was successfully extracted: {
backend-1        |   "grant_type": "client_credentials",
backend-1        |   "resource": "https://www.building-integrated-solar-systems.com/graphql/",
backend-1        |   "client_id": "metabase",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.
backend-1        | [16:51:34 INF] The token request was successfully validated.
backend-1        | [16:51:34 INF] The response was successfully returned as a JSON document: {
backend-1        |   "access_token": "[redacted]",
backend-1        |   "token_type": "Bearer",
backend-1        |   "expires_in": 3600
backend-1        | }.
backend-1        | [16:51:34 INF] The token request was successfully sent to https://www.building-integrated-solar-systems.com/connect/token: {
backend-1        |   "grant_type": "client_credentials",
backend-1        |   "resource": [
backend-1        |     "https://www.building-integrated-solar-systems.com/graphql/"
backend-1        |   ],
backend-1        |   "client_id": "metabase",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.
backend-1        | [16:51:34 INF] The token response returned by https://www.building-integrated-solar-systems.com/connect/token was successfully extracted: {
backend-1        |   "access_token": "[redacted]",
backend-1        |   "token_type": "Bearer",
backend-1        |   "expires_in": 3600
backend-1        | }.
backend-1        | [16:51:34 INF] HTTP POST /connect/token responded 200 in 116.4502 ms
backend-1        | [16:51:34 INF] The request URI matched a server endpoint: Token.
backend-1        | [16:51:34 INF] The token request was successfully extracted: {
backend-1        |   "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
backend-1        |   "audience": "metabase",
backend-1        |   "resource": "https://www.building-integrated-solar-systems.com/graphql/",
backend-1        |   "requested_token_type": "urn:ietf:params:oauth:token-type:access_token",
backend-1        |   "subject_token": "[redacted]",
backend-1        |   "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
backend-1        |   "actor_token": "[redacted]",
backend-1        |   "actor_token_type": "urn:ietf:params:oauth:token-type:access_token",
backend-1        |   "client_id": "metabase",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.
backend-1        | [16:51:34 INF] The token request was successfully validated.
backend-1        | [16:51:34 INF] The response was successfully returned as a JSON document: {
backend-1        |   "access_token": "[redacted]",
backend-1        |   "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
backend-1        |   "token_type": "Bearer",
backend-1        |   "expires_in": 3600
backend-1        | }.
backend-1        | [16:51:34 INF] HTTP POST /connect/token responded 200 in 59.0190 ms
backend-1        | [16:51:34 INF] The token request was successfully sent to https://www.building-integrated-solar-systems.com/connect/token: {
backend-1        |   "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
backend-1        |   "audience": [
backend-1        |     "metabase"
backend-1        |   ],
backend-1        |   "resource": [
backend-1        |     "https://www.building-integrated-solar-systems.com/graphql/"
backend-1        |   ],
backend-1        |   "requested_token_type": "urn:ietf:params:oauth:token-type:access_token",
backend-1        |   "subject_token": "[redacted]",
backend-1        |   "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
backend-1        |   "actor_token": "[redacted]",
backend-1        |   "actor_token_type": "urn:ietf:params:oauth:token-type:access_token",
backend-1        |   "client_id": "metabase",
backend-1        |   "client_secret": "[redacted]"
backend-1        | }.
backend-1        | [16:51:34 INF] The token response returned by https://www.building-integrated-solar-systems.com/connect/token was successfully extracted: {
backend-1        |   "access_token": "[redacted]",
backend-1        |   "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
backend-1        |   "token_type": "Bearer",
backend-1        |   "expires_in": 3600
backend-1        | }.
backend-1        | [16:51:34 INF] The request URI matched a server endpoint: UserInfo.
backend-1        | [16:51:34 INF] The userinfo request was successfully extracted: {
backend-1        |   "access_token": "[redacted]"
backend-1        | }.
backend-1        | [16:51:34 INF] The userinfo request was successfully validated.
backend-1        | [16:51:34 INF] HTTP GET /connect/userinfo responded 200 in 14.6145 ms
backend-1        | [16:51:34 INF] The userinfo request was successfully sent to https://www.building-integrated-solar-systems.com/connect/userinfo: {}.
backend-1        | [16:51:34 INF] The userinfo response returned by https://www.building-integrated-solar-systems.com/connect/userinfo was successfully extracted: {
backend-1        |   "sub": "019d8c8d-907b-75f8-8d64-e1e31c24f5e4",
backend-1        |   "email": "administrator@buildingenvelopedata.org",
backend-1        |   "email_verified": true,
backend-1        |   "phone_number_verified": false,
backend-1        |   "name": "Administrator",
backend-1        |   "role": [
backend-1        |     "Administrator"
backend-1        |   ]
backend-1        | }.
reverse_proxy-1  | 172.20.0.1 - - [29/Apr/2026:16:51:34 +0000] "POST /connect/token HTTP/1.1" 200 2225 "-" "Metabase/1.0.0.0 OpenIddict.Client.SystemNetHttp/7.4.0.0" "172.26.4.1"
reverse_proxy-1  | 172.20.0.1 - - [29/Apr/2026:16:51:34 +0000] "POST /connect/token HTTP/1.1" 200 2890 "-" "Metabase/1.0.0.0 OpenIddict.Client.SystemNetHttp/7.4.0.0" "172.26.4.1"
reverse_proxy-1  | 172.20.0.1 - - [29/Apr/2026:16:51:34 +0000] "GET /connect/userinfo HTTP/1.1" 200 206 "-" "Metabase/1.0.0.0 OpenIddict.Client.SystemNetHttp/7.4.0.0" "172.26.4.1"
backend-1        | [16:51:38 INF] HTTP POST /graphql responded 200 in 8404.3280 ms
reverse_proxy-1  | 172.20.0.1 - - [29/Apr/2026:16:51:38 +0000] "POST /graphql HTTP/1.1" 200 187 "https://www.building-integrated-solar-systems.com/graphql/assets/graphql-engine-scheduler.b80d8424.BIAP1cE9.js" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" "109.41.241.54"
reverse_proxy-1  | 172.20.0.1 - - [29/Apr/2026:16:51:47 +0000] "GET /graphql/service-worker.js HTTP/1.1" 304 0 "https://www.building-integrated-solar-systems.com/graphql/service-worker.js" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" "109.41.241.54"
backend-1        | [16:51:47 INF] HTTP GET /health responded 200 in 12.5350 ms
backend-1        | [16:51:47 INF] HTTP GET /service-worker.js responded 304 in 30.5494 ms

However, the mutation

mutation {
  verifyDatabase(input: { databaseId: "21ea41a4-c989-4862-a34d-1bce0a38d428" }) {
    errors {
      code
      message
      path
    }
  }
}

still fails with

{
  "data": {
    "verifyDatabase": {
      "errors": [
        {
          "code": "REQUEST_FAILED",
          "message": "Failed with status code  to request https://www.solar-in-the-facade.com/graphql.",
          "path": [
            "input"
          ]
        }
      ]
    }
  }
}

[christoph-maurer]

The verification is now successful.

{
  "data": {
    "verifyDatabase": {
      "errors": null
    }
  }
}

Maybe solar-in-the-facade.com/graphql behaves differently than www.solar-in-the-facade.com/graphql.

 printf '%s
' 'https://solar-in-the-facade.com/graphql/' 'https://www.solar-in-the-facade.com/graphql/' | while read url; do echo "$url"; curl -sS "$url" -H 'content-type: application/json' --data '{"query":"query VerificationCode { verificationCode }","operationName":"VerificationCode"}' | tr -d '\n'; echo; echo; done
https://solar-in-the-facade.com/graphql/
</html>nter>nginx</center>anently</h1></center>d>

https://www.solar-in-the-facade.com/graphql/
{"data":{"verificationCode":"FzopZGYWAMyj21pp1lBZHQMSSXbid8sQB9EDejzgu+MmgooWcbwebqs8lCJuLU/pCXHI8IT9JfHMhv7nUIfegA=="}}