GMOD · ChrisChilders-USDA · May 27, 2026 · May 27, 2026 · Jun 2, 2026 · Jun 4, 2026
diff --git a/.nvmrc b/.nvmrc
@@ -0,0 +1 @@
+22
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -10,6 +10,27 @@ git clone https://github.com/GMOD/Apollo3
 
 You'll need `yarn` to be installed.
 
+## Node version compatibility
+
+Apollo3 test tooling currently expects Node 20 or 22.
+
+- Node 26 is known to break Jest 29 in this repository with errors such as
+  `TypeError: require.resolve.paths is not a function`.
+- Run `yarn check:node` before running tests.
+
+If you use `nvm`, you can pin a compatible runtime with:
+
+```sh
+nvm use
+```
+
+If you do not use a Node version manager, you can still run commands with Node
+22 ad hoc:
+
+```sh
+npx -y node@22 .yarn/releases/yarn-4.14.1.cjs <yarn command>
+```
+
 You then have two options to start Apollo3 for development purposes. In both
 cases, the instance is then accessible via
 

diff --git a/Dockerfile b/Dockerfile
@@ -1,31 +1,14 @@
-# syntax=docker/dockerfile:1
-
-FROM node:24 AS setup
-WORKDIR /app
-COPY package.json yarn.lock .yarnrc.yml ./
-COPY .yarn/ .yarn/
-COPY packages/ packages/
-RUN find packages/ -type f \! \( -name "package.json" -o -name "yarn.lock" \) -delete && \
-find . -type d -empty -delete
-
-FROM node:24 AS build
-WORKDIR /app
-COPY --from=setup /app .
-RUN yarn install --immutable
-COPY . .
-WORKDIR /app/packages/apollo-collaboration-server
-RUN yarn build
-
 FROM node:24
 LABEL org.opencontainers.image.source=https://github.com/GMOD/Apollo3
 LABEL org.opencontainers.image.description="Apollo collaboration server"
 WORKDIR /app
-COPY --from=setup /app .
-COPY --from=build /app/packages/apollo-collaboration-server/dist /app/packages/apollo-collaboration-server/dist
-COPY --from=build /app/packages/apollo-common/dist /app/packages/apollo-common/dist
-COPY --from=build /app/packages/apollo-mst/dist /app/packages/apollo-mst/dist
-COPY --from=build /app/packages/apollo-schemas/dist /app/packages/apollo-schemas/dist
-COPY --from=build /app/packages/apollo-shared/dist /app/packages/apollo-shared/dist
+COPY package.json yarn.lock .yarnrc.yml ./
+COPY .yarn/ .yarn/
+COPY packages/apollo-collaboration-server packages/apollo-collaboration-server
+COPY packages/apollo-common packages/apollo-common
+COPY packages/apollo-mst packages/apollo-mst
+COPY packages/apollo-schemas packages/apollo-schemas
+COPY packages/apollo-shared packages/apollo-shared
 RUN yarn workspaces focus --production @apollo-annotation/collaboration-server
 EXPOSE 3999
 CMD ["yarn", "start:prod"]
diff --git a/README.md b/README.md
@@ -2,6 +2,32 @@
 
 Monorepo for Apollo3 development
 
+## Current integration status (2026-06-09)
+
+- Plugin authentication UX now surfaces failed local login attempts clearly
+  instead of appearing to pass through.
+- Apollo plugin menu now includes a visible signed-in indicator
+  (`Signed in as: <username>` when available).
+- Local USDA integration stack currently expects the plugin UMD bundle from
+  `packages/jbrowse-plugin-apollo/dist/jbrowse-plugin-apollo.umd.development.js`.
+
+## Local integration workflow
+
+For the NAL local stack (served through `jbrowse-apollo-infra`):
+
+1. Build shared package if needed:
+   - `yarn --cwd packages/apollo-shared build`
+2. Build plugin bundle:
+   - `yarn --cwd packages/jbrowse-plugin-apollo build`
+3. Start/restart infra stack from `../jbrowse-apollo-infra`:
+   - `./scripts/dev/start_local_stack.sh`
+
+## Where to look next
+
+- Infrastructure status and run commands: `../jbrowse-apollo-infra/README.md`
+- Active handoff notes and open risks:
+  `../jbrowse-apollo-infra/HANDOFF_APOLLO3_JBROWSE2.md`
+
 | Package                                                                | Description                                                |
 | ---------------------------------------------------------------------- | ---------------------------------------------------------- |
 | [apollo-collaboration-server](./packages/apollo-collaboration-server/) | Server-side code                                           |

diff --git a/package.json b/package.json
@@ -7,14 +7,15 @@
     "packages/*"
   ],
   "scripts": {
+    "check:node": "node -e \"const major=Number(process.versions.node.split('.')[0]); if (major>=26){console.error('Apollo3 test tooling is not compatible with Node '+process.versions.node+'. Use Node 20 or 22.'); process.exit(1)} console.log('Node version OK for Apollo3 test tooling:', process.versions.node)\"",
     "lint": "cross-env NODE_OPTIONS='--max-old-space-size=4096' yarn eslint --max-warnings 0",
     "build:shared": "yarn workspace @apollo-annotation/shared run build",
     "release": "tsx scripts/makeGitTag.ts",
     "start:shared": "yarn workspace @apollo-annotation/shared run start",
     "start:server": "yarn workspace @apollo-annotation/collaboration-server run start",
     "start:plugin": "yarn workspace @apollo-annotation/jbrowse-plugin-apollo run start",
     "start": "npm-run-all --print-label --parallel start:shared start:server start:plugin",
-    "test": "yarn workspaces foreach --all run test:ci",
+    "test": "yarn check:node && yarn workspaces foreach --all run test:ci",
     "postinstall": "husky"
   },
   "devDependencies": {

diff --git a/packages/apollo-cli/README.md b/packages/apollo-cli/README.md
@@ -16,7 +16,7 @@ $ npm install -g @apollo-annotation/cli
 $ apollo COMMAND
 running command...
 $ apollo (--version)
-@apollo-annotation/cli/1.0.0 linux-x64 node-v24.15.0
+@apollo-annotation/cli/1.0.0 darwin-arm64 node-v26.0.0
 $ apollo --help [COMMAND]
 USAGE
   $ apollo COMMAND
@@ -62,6 +62,9 @@ USAGE
 - [`apollo jbrowse set-config INPUTFILE`](#apollo-jbrowse-set-config-inputfile)
 - [`apollo login`](#apollo-login)
 - [`apollo logout`](#apollo-logout)
+- [`apollo permissions grant`](#apollo-permissions-grant)
+- [`apollo permissions list`](#apollo-permissions-list)
+- [`apollo permissions revoke`](#apollo-permissions-revoke)
 - [`apollo refseq add-alias INPUT-FILE`](#apollo-refseq-add-alias-input-file)
 - [`apollo refseq get`](#apollo-refseq-get)
 - [`apollo status`](#apollo-status)
@@ -335,8 +338,8 @@ DESCRIPTION
   Address and port e.g http://localhost:3999
 
   - accessType:
-  How to access Apollo. accessType is typically one of: google, microsoft, guest, root. Allowed types depend on your
-  Apollo setup
+  How to access Apollo. accessType is typically one of: google, microsoft, logingov, guest, root. Allowed types depend
+  on your Apollo setup
 
   - accessToken:
   Access token. Usually inserted by `apollo login`
@@ -1019,7 +1022,7 @@ DESCRIPTION
 ```
 
 _See code:
-[@oclif/plugin-help](https://github.com/oclif/plugin-help/blob/v6.0.8//workspaces/Apollo3/.yarn/cache/@oclif-plugin-help-npm-6.0.8-336726b8e7-4b3be03d8a.zip/node_modules/@oclif/plugin-help/lib/commands/help.ts)_
+[@oclif/plugin-help](https://github.com/oclif/plugin-help/blob/v6.0.8/src/commands/help.ts)_
 
 ## `apollo jbrowse desktop JBROWSEFILE`
 
@@ -1190,6 +1193,104 @@ EXAMPLES
 _See code:
 [src/commands/logout.ts](https://github.com/GMOD/Apollo3/blob/v1.0.0/packages/apollo-cli/src/commands/logout.ts)_
 
+## `apollo permissions grant`
+
+Grant assembly permissions to a user
+
+```
+USAGE
+  $ apollo permissions grant -u <value> -a <value> [--profile <value>] [--config-file <value>] [--view] [--edit]
+
+FLAGS
+  -a, --assembly=<value>...  (required) Assembly name or id
+  -u, --user=<value>         (required) User id, username, or email
+      --config-file=<value>  Use this config file (mostly for testing)
+      --edit                 Grant edit permission (implies view)
+      --profile=<value>      Use credentials from this profile
+      --view                 Grant view permission
+
+DESCRIPTION
+  Grant assembly permissions to a user
+
+  Grants annotation permissions for one user across one or more assemblies.
+
+EXAMPLES
+  Grant view access to one assembly:
+
+    $ apollo permissions grant -u user@example.org -a myAssembly --view
+
+  Grant edit access to multiple assemblies (implies view):
+
+    $ apollo permissions grant -u user@example.org -a asm1 asm2 --edit
+```
+
+_See code:
+[src/commands/permissions/grant.ts](https://github.com/GMOD/Apollo3/blob/v1.0.0/packages/apollo-cli/src/commands/permissions/grant.ts)_
+
+## `apollo permissions list`
+
+List assembly permissions
+
+```
+USAGE
+  $ apollo permissions list [--profile <value>] [--config-file <value>] [-u <value>] [-a <value>]
+
+FLAGS
+  -a, --assembly=<value>     Filter by one assembly name or id
+  -u, --user=<value>         Filter by user id, username, or email
+      --config-file=<value>  Use this config file (mostly for testing)
+      --profile=<value>      Use credentials from this profile
+
+DESCRIPTION
+  List assembly permissions
+
+  Lists assembly permission documents, optionally filtered by user and/or assembly.
+
+EXAMPLES
+  List all permissions:
+
+    $ apollo permissions list
+
+  List permissions for one user:
+
+    $ apollo permissions list -u user@example.org
+
+  List permissions for one assembly:
+
+    $ apollo permissions list -a myAssembly
+```
+
+_See code:
+[src/commands/permissions/list.ts](https://github.com/GMOD/Apollo3/blob/v1.0.0/packages/apollo-cli/src/commands/permissions/list.ts)_
+
+## `apollo permissions revoke`
+
+Revoke assembly permissions from a user
+
+```
+USAGE
+  $ apollo permissions revoke -u <value> -a <value> [--profile <value>] [--config-file <value>]
+
+FLAGS
+  -a, --assembly=<value>...  (required) Assembly name or id
+  -u, --user=<value>         (required) User id, username, or email
+      --config-file=<value>  Use this config file (mostly for testing)
+      --profile=<value>      Use credentials from this profile
+
+DESCRIPTION
+  Revoke assembly permissions from a user
+
+  Revokes annotation permissions for one user across one or more assemblies.
+
+EXAMPLES
+  Revoke access from one assembly:
+
+    $ apollo permissions revoke -u user@example.org -a myAssembly
+```
+
+_See code:
+[src/commands/permissions/revoke.ts](https://github.com/GMOD/Apollo3/blob/v1.0.0/packages/apollo-cli/src/commands/permissions/revoke.ts)_
+
 ## `apollo refseq add-alias INPUT-FILE`
 
 Add reference name aliases from a file

diff --git a/packages/apollo-cli/package.json b/packages/apollo-cli/package.json
@@ -27,6 +27,7 @@
     "prepare": "yarn build",
     "test": "yarn tsx src/test/test.ts",
     "test:ci": "yarn tsx src/test/test.ts",
+    "test:permissions": "yarn tsx --test-name-pattern='Permissions grant/list/revoke' src/test/test.ts",
     "version": "oclif readme --multi --dir ../website/docs/03-guides/04-cli/ && oclif readme && git add README.md"
   },
   "oclif": {
@@ -61,6 +62,9 @@
       "jbrowse": {
         "description": "Commands to manage the JBrowse configuration"
       },
+      "permissions": {
+        "description": "Commands to manage assembly permissions"
+      },
       "refseq": {
         "description": "Commands to manage reference sequences"
       },

diff --git a/packages/apollo-cli/src/ApolloConf.ts b/packages/apollo-cli/src/ApolloConf.ts
@@ -32,7 +32,7 @@ function optionDocs(): { key: string; description: string }[] {
         docs.push({
           key: v,
           description:
-            'How to access Apollo. accessType is typically one of: google, microsoft, guest, root. Allowed types depend on your Apollo setup',
+            'How to access Apollo. accessType is typically one of: google, microsoft, logingov, guest, root. Allowed types depend on your Apollo setup',
         })
         break
       }
@@ -147,7 +147,13 @@ export class ApolloConf extends Conf {
 
 const profileSchema = Joi.object({
   address: Joi.string().uri({ scheme: /https?/ }),
-  accessType: Joi.string().valid('google', 'microsoft', 'root', 'guest'),
+  accessType: Joi.string().valid(
+    'google',
+    'microsoft',
+    'logingov',
+    'root',
+    'guest',
+  ),
   accessToken: Joi.string(),
   rootPassword: Joi.string().when('accessType', {
     is: Joi.string().valid('root'),

diff --git a/packages/apollo-cli/src/commands/permissions/README.md b/packages/apollo-cli/src/commands/permissions/README.md
@@ -0,0 +1,25 @@
+# CLI Permissions Commands
+
+This folder defines assembly ACL management commands for the Apollo CLI.
+
+Commands:
+
+- `apollo permissions list`
+- `apollo permissions grant`
+- `apollo permissions revoke`
+
+Resolution behavior:
+
+- User input supports user id, username, or email.
+- Assembly input supports assembly id or common assembly name.
+
+Grant semantics:
+
+- `--edit` implies `canViewAnnotations=true`.
+- If no explicit permission flags are provided to `grant`, it defaults to
+  view-only.
+
+Implementation notes:
+
+- Commands call collaboration-server endpoint `assemblyPermissions`.
+- `grant` and `revoke` perform `PUT` upserts per assembly.