jupyterlab-rtclauncher

A small JupyterLab 4 extension for the NASA Research Platform. It adds a Launcher tile — "Open <project> Collaboration" — that opens the project's shared real-time-collaboration (RTC) server.

Without it, members reach the shared server through JupyterHub's admin UI (/hub/admin), which is why they were granted the broad-looking admin-ui scope. This extension replaces that route so the scope can be dropped.

How it works

1. On activation the frontend calls GET /jupyterlab-rtclauncher/config.
2. The server extension reads the spawn-time environment and answers with the project and the shared account name.
3. If enabled, the tile navigates the browser to <hubPrefix>/spawn/<project>-collab. JupyterHub starts the shared server if it is down, then redirects to /user/<project>-collab/lab.

Launcher tile  ──▶  /hub/spawn/abtesting-collab  ──▶  /user/abtesting-collab/lab

Which projects get a tile

Any project with collaboration enabled — there is no hardcoded project list and no allowlist to configure here.

The enablement signal is the RP_COLLAB_ACCOUNT environment variable:

1. A platform admin flips Real-Time Collaboration → Enable collaboration for a project in the RPAdmin console, which provisions its login-less <key>-collab principal.
2. RPAdmin's GET /api/me/spawn-identity — already called on every spawn — now returns collab_account: "<key>-collab" for that project, or null.
3. rp-deployment terraform/config/20-nojovyan.py forwards a non-null value to the notebook as RP_COLLAB_ACCOUNT.
4. This extension shows the tile only when that variable is present.

So enabling a new project is a toggle in RPAdmin — no change to this extension, the spawner, or the image. OSSProject supplies the project key for the tile's label; the account name comes from RP_COLLAB_ACCOUNT so the naming convention lives only in RPAdmin.

Operational note. JupyterHub access is granted separately, by the RP_COLLAB_PROJECT_KEYS allowlist in rp-deployment (the ISSO widening gate, feature 083). A project enabled in RPAdmin but missing from that allowlist will show a tile whose spawn the hub refuses — enabling collaboration is a two-step operation by design, and the two must be kept in sync.

The tile grants nothing

It is a link. Starting the shared server requires admin:servers!user=<acct> and entering it requires access:servers!user=<acct>; both are granted to the project's Keycloak /smdc-oss/<project> group by rp-deployment terraform/config/41-collab-accounts.py, and auto-revoke when Keycloak drops the membership. A user without them who follows the link is refused by the hub.

The tile hides itself when RP_COLLAB_ACCOUNT is unset (collaboration is off for the project), or when the current server is the collaboration server (JUPYTERHUB_USER ends in -collab).

Install

pip install jupyterlab-rtclauncher

Both the frontend and the server extension are enabled automatically. To verify:

jupyter labextension list   # jupyterlab-rtclauncher ... enabled OK
jupyter server extension list

Development

pip install -e ".[test]"
jupyter labextension develop . --overwrite
jlpm build

Run the tests:

python -m pytest tests/   # server extension
jlpm test                 # frontend

Rebuild after a source change with jlpm build, or run jlpm watch in one terminal and jupyter lab in another.

Uninstall

pip uninstall jupyterlab-rtclauncher

Related

• Feature 083 — RTC collaboration accounts (rpadmin/specs/083-rtc-collab-accounts/)
• jupyterlab-resource-tracker — the usage & cost extension shipped in the same image